Data Privacy for Agentic AI Systems

Document what enters prompts, which tools receive it, what traces store, and which providers process it. Agent loops can copy data across more surfaces than a conventional request.

Create a data-flow map for prompts, retrieval indexes, tools, caches, traces, human review queues, and model providers. Mark purpose, lawful basis, geography, retention, and recipients. Agentic systems deserve special attention because a single task can copy one record across several otherwise separate services.

Retrieve only the fields required for the current decision, redact secrets before model calls, and avoid placing durable identifiers in free-form context when scoped references will work.

Minimize at query time. Retrieve only required columns, use opaque references instead of durable identifiers, redact before model calls, and avoid placing secrets in prompts for convenience. Apply the same controls to test fixtures and evaluation datasets, which are often less protected than production while containing realistic data.

Define why information is saved, who may retrieve it, how users correct it, and when it is deleted. Personalization should not become indefinite invisible retention.

Memory needs explicit consent and lifecycle controls. Distinguish user-stated facts from model inferences, expose saved items, support correction and deletion, and prevent retrieval across tenants or purposes. Deletion must cover derived indexes and caches, not only the primary row.