Legal, Compliance & Data Handling
GDPR basics, BAAs, audit logs, and what to put in your privacy policy.
Data minimization
Only ingest data fields your agent actually needs to complete its task. A support agent needs ticket content, customer name, and account status - not the customer's full payment history, social security number, or personal address.
Redact PII from logs and traces. When debugging agent runs, you need to see tool inputs/outputs - but customer email addresses, phone numbers, and financial data should be masked. Set retention limits on conversation history: 90 days for support agents, 30 days for transactional agents, configurable per customer for enterprise.
Data minimization is not just compliance - it reduces your liability surface and inference costs. An agent that processes 5 fields per task is cheaper and safer than one that ingests entire customer records 'just in case.'
Subprocessors
Your agent product uses subprocessors - OpenAI, Anthropic, Google, AWS, Vercel, Supabase, and others. Enterprise customers will ask for your subprocessor list in the first security review. Have it ready.
Disclose all subprocessors in your privacy policy using a Data Processing Agreement (DPA) using standard templates (Common Paper, TermScribe, or your lawyer's template). For healthcare customers, you need a Business Associate Agreement (BAA) - confirm your LLM provider offers one (OpenAI and Anthropic do for enterprise plans).
Maintain a subprocessor change notification process: email enterprise customers 30 days before adding a new subprocessor. This is a GDPR requirement and an enterprise expectation. A simple subprocessor page on your website prevents weeks of back-and-forth during security reviews.
4 more sections in this article
- Human oversight
- The processing agreement and what it commits you to
- Answering the security questionnaire
- Incident response before you need it
This is Pro content
Get Agent Factory Pro - a one-time payment for lifetime access to full articles, complete build prompts, and everything new.
Use it
The parts of the library that put this article to work.
16 more build prompts reference this article.
Published 27 July 2026. Last reviewed 17 August 2026. We re-read this library on a schedule and date every article, so you can see for yourself how current it is.