Agentic AI and GDPR: the CNIL–CIANum note of July 20, 2026

In short: on July 20, 2026, France’s data protection authority (CNIL) and the Conseil de l’IA et du Numérique (CIANum) published an exploratory note, “IA agentique et protection des données personnelles : équation à inconnues multiples pour les utilisateurs” (announcement, note in PDF, in French). It is neither a recommendation nor a new rule: it is an analysis concluding that GDPR fully applies to AI agents, but that their persistent memory, decision-making autonomy and ability to act across many services “put its principles under strain”. It proposes legal and technical ways forward. The work echoes discussions at the G7 of data protection authorities hosted by the CNIL during France’s G7 presidency.

What the note says, point by point

The note also points out that the EU AI Act already applies to agentic systems without defining them as a specific category or setting rules specific to them, and that its full application is scheduled for 2027. It adds no obligation: it shows how the CNIL reads GDPR when applied to agents, and which safeguards it expects to see built in from the design stage.

What the research confirms

A 2026 survey by Bhosale, Chandre, Mehetre, Powar, Mathur and Ghandat, The dark side of autonomous intelligence: a survey on data leakage and privacy failures in agentic AI (Frontiers in Computer Science), describes the same shift: moving from stateless language models to agents with persistent memory, tool use and multi-agent collaboration creates a new class of privacy risk — unintended retention, propagation and amplification of sensitive information across tasks, users and execution cycles. The authors map leakage pathways through each component of an agent: memory modules, planning, tool calls, communication between agents and feedback loops. It is the architecture around the model, not the model alone, that creates the exposure — which is why the CNIL’s proposals target memory, access and traceability.

Applying the note in an SME: six checks

• →Access inventory: for each agent, list the mailboxes, folders, applications and categories of personal data its connectors actually reach, and remove what the task does not need.
• →Action log: keep, for each task, the data read, the tools called, the actions taken and when. It is the traceability the note describes, and your only way to answer an access request or explain a mistake.
• →Memory: one memory per agent and per use, with a written retention period; no shared memory kept “just in case”.
• →Human validation: classify actions (read, modify, delete, send outside the company) and require a person’s approval for the riskiest — a payment, a message to a customer, a deletion.
• →Emergency stop: make sure someone can cut an agent off immediately.
• →Records: add the processing to your GDPR record of processing activities and, if the agent handles sensitive data or data at scale, check whether a data protection impact assessment is required.

For customer-facing agents, the AI Act adds a transparency duty covered in our article on the AI Act in France.