Agent Security and Trust

Data protection rules to check before an agent touches customer data

Connecting an AI agent to customer records brings data protection law with it. A country-by-country checklist for all seven Infercline editions.

The Infercline Desk · Friday, 6 November 2026 Sign in to save

Rows of white archive boxes on wooden shelves — Photo by Luke Caunt on Unsplash

The moment an AI agent can read your customer records, inbox or order history, it is processing personal data. Every Infercline edition has a law that governs this. The details differ, but five questions recur everywhere: do you have a lawful reason to use the data this way, have you told people, where is the data going, is it secure, and are there limits on decisions made by software alone. This guide gives the main points by market at the time of writing (November 2026). It is not legal advice, and you should confirm the position with a qualified adviser.

United Kingdom. UK GDPR and the Data Protection Act 2018 apply. Under section 157 of the 2018 Act, the higher maximum fine is 17.5 million pounds or 4 per cent of total annual worldwide turnover, whichever is higher. The Data (Use and Access) Act 2025 replaced the old rule on automated decisions with new Articles 22A to 22D, in force from 5 February 2026. The government describes the result as a more permissive framework with safeguards: where significant decisions are made with no meaningful human involvement, people must be told and be able to contest them and obtain human intervention.

South Africa. The Protection of Personal Information Act, POPIA, applies, enforced by the Information Regulator. Section 71 restricts decisions with legal or substantial effects based solely on automated profiling. Section 72 limits sending personal information to another country unless conditions are met, such as the recipient being bound by laws or agreements giving adequate protection, or the person consenting. The Information Regulator has said that administrative fines can reach 10 million rand, and offences can carry imprisonment.

Nigeria. The Nigeria Data Protection Act 2023 established the Nigeria Data Protection Commission. Section 37 gives people the right not to be subject to solely automated decisions with legal or similarly significant effects, subject to exceptions and safeguards. Under section 48, the higher maximum penalty for data controllers of major importance is the greater of 10 million naira and 2 per cent of annual gross revenue. The Commission's General Application and Implementation Directive, issued in March 2025, addresses emerging technologies including AI and calls for a data protection impact assessment, a written risk check, before such processing.

Australia. The Privacy Act 1988 and its Australian Privacy Principles apply to covered organisations. The OAIC's guidance on commercially available AI products says the Act covers both the data that goes into AI and what comes out, that personal information AI generates or infers counts as a collection, and that organisations should not enter personal information, especially sensitive information, into public generative AI tools. From 10 December 2026, according to the OAIC, privacy policies must explain when computer programs make or inform decisions that significantly affect people.

Singapore. The Personal Data Protection Act applies, overseen by the PDPC. The PDPC's Advisory Guidelines on Use of Personal Data in AI Recommendation and Decision Systems, issued in March 2024, cover consent and its exceptions, transparency and the duties of outside developers acting as data intermediaries. According to PDPC guidance, the maximum fine is 1 million Singapore dollars or 10 per cent of annual turnover in Singapore, whichever is higher, where that turnover exceeds 10 million Singapore dollars. IMDA's Model AI Governance Framework for Agentic AI, launched in January 2026, adds guidance specific to agents.

Middle East. In the UAE, the federal Personal Data Protection Law, Federal Decree-Law No. 45 of 2021, applies, while the DIFC and ADGM financial free zones have their own data protection laws and regulators. In Saudi Arabia, the Personal Data Protection Law came into force on 14 September 2023, with a one-year period to comply, according to SDAIA. Its regulation on transferring personal data outside the Kingdom relies on a list of countries with adequate protection, or safeguards such as standard contractual clauses, and requires a risk assessment before transfer.

United States. There is no single national privacy law; protection comes from sector rules and a growing number of state laws, tracked by the IAPP. California's privacy regulator finalised rules on automated decision-making technology in September 2025, with compliance required from 1 January 2027 according to the California Privacy Protection Agency. Colorado replaced its earlier AI law with a new automated decision-making act, SB26-189, signed in May 2026. Businesses selling into the EU should also note the EU AI Act, whose transparency duties, including telling people they are dealing with an AI system, apply from August 2026 according to the European Commission.

Why it matters to your business

AI agents move data in ways older software did not: to model providers, across borders, and into decisions that affect people. Regulators in every Infercline market have shown they will apply existing data protection law to AI, and several have added rules aimed at automated decisions. Checking before you connect an agent is far cheaper than explaining a breach or a complaint afterwards, and it reassures the customers whose data you hold.

What to do on Monday

List every agent that can see personal data, which data it sees and which countries that data comes from.
Ask each vendor where data is processed, whether it is used for model training and for its data processing agreement and sub-processor list.
Check cross-border transfer rules for each country on your list, particularly South Africa, Saudi Arabia and any EU or UK data.
Carry out a short written risk assessment for each agent before it goes live, and keep it on file.
Update your privacy notice to say how you use AI, and where decisions are automated, how people can ask for a person to review them.

More on this topic: AI agent security and risk

Data protection rules to check before an agent touches customer data

Why it matters to your business

What to do on Monday

Sources