The General Data Protection Regulation. A regulation applies directly in every member state.
GDPR · Regulation (EU) 2016/679
GDPR says record what you do with personal data and prove it. Quox is the record of what your agents did.
The GDPR is EU law, not a certificate. Quox is not GDPR certified: it is the witnessed evidence layer for the articles an agent platform touches.
What it isEU lawCertificatenone requiredQuoxevidence layerStart here
A law about people’s data, not a badge you can buy
If you handle personal data of people in the EU, the GDPR applies, wherever you are. It is built on principles, lawful reasons to process, and rights people hold over their data. Two duties bite hardest for an engineer: keep a record of what you process, and secure it.
Adopted 27 April 2016, in force 24 May 2016. It replaced Directive 95/46/EC.
National data protection authorities investigate and fine. Nobody is "GDPR certified" as a whole; the Art. 42 seals are voluntary and specific to one processing operation.
Where certification does appear. Article 42 lets member states and authorities encourage voluntary certification mechanisms and seals. They can help demonstrate compliance for a specific processing operation. They are optional, they do not reduce your responsibility, and they are not what this page is about.
Controller
Decides why and how personal data is processed. Most organisations running their own AI agents are controllers for the data those agents handle.
Processor
Processes personal data on a controller’s behalf, under a written contract. An AI model provider that receives personal data from your agent is often a processor you need a contract with.
Article 5: the six principles, plus accountability
5(1)(a)Lawfulness, fairness and transparencyHave a lawful basis, be fair, and tell people what you do.5(1)(b)Purpose limitationUse data only for the purpose you collected it for.5(1)(c)Data minimisationCollect and use only what you need.5(1)(d)AccuracyKeep it correct and up to date.5(1)(e)Storage limitationKeep it no longer than the purpose needs.5(1)(f)Integrity and confidentialityProtect it against loss, damage and unauthorised access.5(2)AccountabilityBe able to demonstrate that you comply with all of the above.
Article 6: the six lawful bases
You need at least one for every purpose. No basis is more legitimate than another, and consent is only one of the six.
6(1)(a)Consent6(1)(b)Contract6(1)(c)Legal obligation6(1)(d)Vital interests6(1)(e)Public task6(1)(f)Legitimate interests
Special category data, such as health data (Art. 9), needs an extra condition on top of a basis.
The data lifecycle
Follow one piece of personal data from collection to erasure
Every article on this page sits at one of six gates. Data enters, is used, is secured, is recorded, can be asked about, and eventually ends. Quox is strongest at the record, a slice of three other gates, and absent from the rest.
- Quox evidences it
- A slice is Quox
- Yours
1Art. 5(1)(a), 6Yours
Collect
Personal data comes in. Before you use it you need a lawful basis for each purpose, and people have to be told what happens to it.
Where Quox fitsNone. Quox does not choose or record your lawful basis and is not a consent manager.
Where it stopsThe lawful basis for each purpose, privacy notices and consent are yours.
2Art. 5(1)(b) to (d), Art. 25Quox evidences a slice
Use
Use it only for the stated purpose, only as much as needed, and keep it accurate. Art. 25 asks for data protection by design and by default.
Where Quox fitsA policy gate can stop an agent sending personal data to an external model, and the block is recorded with a receipt. That is a by-design control you can show.
Where it stopsThe gate enforces rules you write. Deciding what counts as personal data in your estate, and what the purpose is, is yours.
3Art. 32(1)(a) to (d)Quox evidences a slice
Secure
Protect it with measures that fit the risk: pseudonymisation and encryption, ongoing integrity and confidentiality, the ability to restore, and regular testing.
Where Quox fitsHash-chaining protects the integrity of the record of what agents did, and that record is evidence your testing and assessment can draw on.
Where it stopsEncryption, database access, availability and restore are your infrastructure.
4Art. 30 and Art. 5(2)Quox evidences it
Record
Write down what you process, why, who receives it, how long you keep it and how it is secured. Art. 5(2) adds that you must be able to demonstrate compliance.
Where Quox fitsThe witnessed, timestamped record of what governed agents actually did with data is a real input to the record of processing, and an authority can verify it offline.
Where it stopsThe organisation-wide record of processing is yours. Quox covers agent activity only.
5Art. 12 to 23Yours
Honour rights
People can ask what you hold (Art. 15), have it corrected (16), erased (17), restricted (18), moved (20) or stop you using it (21). You generally have one month to reply.
Where Quox fitsNone as a workflow. Quox is not a data subject request tool.
Where it stopsReceiving, verifying, finding the data and answering each request is yours.
6Art. 5(1)(e), Art. 17Quox evidences a slice
Erase
Keep personal data no longer than needed and erase it when the basis ends or a person successfully asks. It is the end of the lifecycle, and the one place it meets an append-only record.
Where Quox fitsThe evidence record can note that an erasure was requested and actioned. The erasure box below says exactly what is and is not erased.
Where it stopsDeleting the personal data from your databases, backups and other systems is yours.
Read the colours honestly. Of six gates, Quox is the strongest fit at one (record), evidences a slice of three more (use, secure, erase) and has no part in two (collect, honour rights). That is the normal shape of a GDPR programme with an agent platform inside it.
Article 30
The record of processing, field by field
Controllers and processors must keep a record of processing activities, and show it to the authority on request. Art. 30(1) lists seven things a controller’s record must contain. Here is each one, and who fills it in.
(a)Controller name and contact detailsIncludes any joint controller, representative and data protection officer.
Yours(b)Purposes of the processingWhy each activity exists.
Yours(c)Categories of data subjects and of personal dataCustomers, staff, patients; names, emails, health data.
Yours(d)Categories of recipientsIncluding recipients in third countries. The record of agent actions shows which external services a governed agent actually called.
Quox feeds this(e)Transfers to third countries, and the safeguardsChecked against what agents actually sent where.
Quox feeds this(f)Time limits for erasure, where possibleYour retention schedule, and a reason to read the retention guide.
Yours(g)General description of the Art. 32(1) security measuresPolicy gates, approvals and a hash-chained record can be described here as measures, with evidence.
Quox feeds thisProcessors keep one too
Art. 30(2) asks a processor to record the categories of processing it carries out for each controller, any transfers, and a general description of its security measures.
The under-250 exemption is narrow
Art. 30(5) lifts the duty for organisations with fewer than 250 people, unless the processing is likely to risk people’s rights, is not occasional, or includes special category (Art. 9) or criminal convictions (Art. 10) data. Any one of the three switches it back on.
Regular processing is not occasional, so assume you keep one.
Where Quox helps, and where it stops
An agent platform adds activity that a hand-written spreadsheet misses. Quox’s record of governed agent actions lets you check recipients and transfers against what actually happened. The record across your whole organisation is still yours to write.
Article 32
Four measures, and the one that asks you to prove it
Art. 32 asks for appropriate technical and organisational measures for the risk. Art. 32(1) names four. Quox is strong on one, partial on one, and absent from two, which is typical for any single tool.
32(1)(a)YoursPseudonymisation and encryption of personal data
Mostly your infrastructure: database and disk encryption, key management, and pseudonymising data before it reaches an agent.
32(1)(b)Quox evidences a sliceOngoing confidentiality, integrity, availability and resilience
Hash-chaining gives integrity to the record of agent actions, and the chain verifies offline. Confidentiality, availability and resilience of your systems are yours.
32(1)(c)YoursAbility to restore availability and access after an incident
Backups, disaster recovery and tested restores. Quox does not do this for you.
32(1)(d)Quox evidences a sliceA process for regularly testing, assessing and evaluating effectiveness
Running the testing and assessment is your process. The witnessed trail is evidence it can draw on: policy blocks, approvals and denials, recorded as they happen.
Clocks and consequences
Four numbers worth knowing by heart
Breach, rights, the record and fines each come with a number. A breach or a missed request is where most organisations first meet the regulator.
Art. 33To notify the supervisory authority after becoming aware of a personal data breach, unless it is unlikely to risk people’s rights.
Art. 12(3)The usual time to answer a data subject request, extendable by two further months where necessary.
Art. 30(5)The employee threshold below which the record duty can fall away, with three conditions that switch it back on.
Art. 83(5)The top fine tier, whichever is higher, of total worldwide annual turnover. The lower tier is EUR 10m or 2%.
A DPIA, Art. 35, is the assessment you run before high-risk processing starts, for instance automated decisions about people. A breach under Art. 33 goes to the authority, and under Art. 34 to the people affected when the risk is high. Fines in the upper tier cover the principles, lawful basis and data subject rights. Records and security, Art. 25 to 39, sit in the lower tier.
The honest tension
Erasure against an append-only record: what is and is not erased
Art. 17 gives people the right to have their personal data erased. Quox’s evidence chain is append-only and tamper-evident, which means entries are never rewritten or removed. Both are true, and they only fit together if you are clear about what each one holds.
The personal data itself
- Customer records, messages, files and database rows
- The raw content an agent read or wrote
- Backups, caches and copies you made
You erase it here, under Art. 17, in every place it lives.
The record of what happened
- Operational metadata: when, which agent, which action, which policy decided
- Hash links that make the history tamper evident
- A note that an erasure was requested and actioned
Not erased. It is evidence, so it is never rewritten.
What we are not saying
We are not saying an append-only chain is itself erased when you erase a person’s data. It is not. Removing entries would destroy the tamper evidence that makes the record useful to an authority. The separation is the answer: the data is erased where it lives, and the record of the event is kept.
The record is built to hold operational metadata, not raw personal data payloads, but we cannot promise a personal identifier never appears in it. An agent’s name or a free-text field could carry one. Treat that as something to design out, and ask your data protection officer or counsel how Art. 17(3), which covers legal obligations and legal claims, applies to a given entry.
The honest map
Four questions an authority asks, and where the answer stops
GDPR tells you to record what you do with personal data and to prove your measures work. Quox is the witnessed record of what your AI agents did, and evidence a regulator can verify offline. Each card says what the record shows and where it stops.
Art. 30Records of processing activitiesStrongest fit
Show me the record of what you process, and show me it is true.
The record showsA witnessed, timestamped, hash-chained account of what governed AI agents actually did with data, including which external services they called. It lets you check the written record against reality.
Where it stopsIt covers governed agent activity only. The organisation-wide record, with purposes, categories and retention, is yours to write.
Art. 5(2)Accountability
Demonstrate that you comply, do not just say so.
The record showsAn offline-verifiable trail an authority or auditor can check with no Quox account, so the demonstration does not rest on trusting you.
Where it stopsIt demonstrates what the agents did and which controls fired. It does not demonstrate the rest of your programme.
Art. 32(1)(b) and (d)Security of processing
Can you show your measures work, and that the record was not changed?
The record showsIntegrity by hash-chaining, and a standing record of policy checks, blocks and approvals that evidences regular testing and assessment.
Where it stopsEncryption, pseudonymisation, availability and restore, 32(1)(a) and (c), are your infrastructure.
Art. 25Data protection by design and by default
Is protection built in, or promised in a policy document?
The record showsA policy gate enforced at execution can stop personal data reaching an external model, and the block is recorded with a receipt. Self-hosting keeps the data on your servers.
Where it stopsThe gate enforces rules you write, so it only catches what you define. Self-hosting is not encryption.
Self-hosted, and your model provider is still a processor
Quox runs on your own servers, so the record and the personal data around it can stay in your estate. That is an architectural plus, not a safeguard in its own right.
If an agent sends personal data to an external model provider, that provider is a processor, and you need a contract (Art. 28) and a view on transfers outside the EU. The policy gate helps stop that happening by accident.
Keep the record, and no longer than you need it
Storage limitation, Art. 5(1)(e), pulls against accountability, Art. 5(2). Keep enough to demonstrate compliance and no more than the purpose needs, and write the period into your record at Art. 30(1)(f). Our guide walks through how to choose.
The auditor page shows what the other side of the table can verify without a Quox account, and the compliance suite covers report exports. Related frameworks: EU AI Act, ISO 27001, SOC 2, NIST AI RMF and ISO 42001.
Honest maturity
What ships today, what does not, and what is yours
Quox is one layer. The record of processing, the lawful-basis decisions and the rights process are human work. Here is the line, drawn plainly.
Ships today
- Witnessed, hash-chained, tamper-evident record of every governed agent action (WARD and VOLT, the evidence protocols), timestamped and ordered as the work happens.
- Policy gate enforced at execution, with blocks and denials recorded in the same chain.
- Human approval for risky actions and two-person approval for audit-required policy changes, with an append-only history.
- Self-hosted deployment, so the record and the personal data around it stay on your own servers.
- Exportable evidence bundles an auditor verifies offline.
- In the compliance suite, a GDPR report format with data processing records, security measures and breach documentation sections, and a DPIA form for Art. 35 (6 sections, 5 by 5 risk matrix) that helps you structure your own assessment.
Not shipped
- A policy simulator, so you can test a policy before it goes live. Planned, not shipped.
- A data subject request workflow, a consent manager and a cookie tool. Quox does not have these, and this page does not claim them.
Still your job
- The organisation-wide record of processing, Art. 30. Quox feeds it with agent activity, and you write it.
- Lawful-basis decisions, privacy notices and consent, Art. 6 and 7.
- Handling data subject requests within the deadline, including the erasure itself.
- Breach decisions and the 72-hour notification, Art. 33 and 34, and the DPIA decision under Art. 35.
- Encryption, pseudonymisation, backups and restore, Art. 32(1)(a) and (c).
- Processor contracts under Art. 28, transfer safeguards, a data protection officer where one is required, and any voluntary Art. 42 certification.
The path
Your first GDPR programme for AI agents, in six moves
Timelines vary with size and how much personal data you hold. The order is the useful part.
Map your personal data
Find where personal data is created, stored and sent, including every place an AI agent can reach it or send it. You cannot record or secure what you have not found.
Pick a lawful basis for each purpose
One of the six in Art. 6(1), for each thing you do with the data. Tell people in plain words. This is a decision, and it is yours.
Write the record of processing
Art. 30. Check whether the under-250 exemption genuinely applies, and assume it does not if you process data regularly. Feed it with what your agents actually did.
Secure it, and test that it holds
Art. 32(1): encryption, integrity, restore and regular testing. Keep the evidence of the testing, because you will be asked for it.
Stand up rights and breach handling
Know who answers a request within one month and who decides within 72 hours whether a breach goes to the authority. Rehearse both once.
Assess the high-risk work, and keep the evidence
Run a DPIA under Art. 35 for high-risk processing, such as automated decisions about people. Keep the record that shows you did what you wrote down.
Questions people actually ask
GDPR and AI agents: the FAQ
What is the GDPR?
The General Data Protection Regulation, Regulation (EU) 2016/679, is EU law. It was adopted on 27 April 2016 and has applied since 25 May 2018. It sets how personal data of people in the EU may be collected, used, kept and erased, and it is enforced by national data protection authorities.
Is GDPR a certification?
No. The GDPR is a law, not a certifiable standard, so nobody can be GDPR certified in the way an organisation can be ISO 27001 certified. Article 42 does provide for voluntary certification mechanisms that can help demonstrate compliance, but they are optional, specific to a processing operation and not a substitute for compliance. Quox is not GDPR certified.
Does the GDPR apply if my company is outside the EU?
It can. Article 3 applies it to organisations outside the EU that offer goods or services to people in the EU, or monitor their behaviour there. Where you are based is not the test. Whether your AI agents handle personal data of people in the EU is closer to it.
What is the difference between a controller and a processor?
A controller decides why and how personal data is processed (Art. 4(7)). A processor processes it on the controller’s behalf (Art. 4(8)) under a contract required by Art. 28. If an agent of yours sends personal data to an external model provider, that provider is often a processor, and you need a contract and a view on transfers.
What is Article 30, and do I have to keep a record?
Article 30 requires controllers and processors to keep a record of processing activities: purposes, categories of data and people, recipients, transfers, erasure time limits and a general description of security measures. Organisations under 250 employees are exempt only if processing is unlikely to risk people’s rights, is occasional, and includes no special category (Art. 9) or criminal (Art. 10) data. Few meet all three.
What does Article 32 require?
Appropriate technical and organisational measures for the risk. Article 32(1) lists: (a) pseudonymisation and encryption, (b) ongoing confidentiality, integrity, availability and resilience, (c) the ability to restore availability and access after an incident, and (d) a process for regularly testing, assessing and evaluating the effectiveness of the measures.
The right to erasure and an append-only record: how do those fit together?
Quox’s record holds operational metadata and evidence, not the raw personal data payloads, by design. The personal data lives in your systems and you erase it there under Art. 17. The evidence record can note that an erasure was requested and actioned. Quox does not erase entries from the chain, because that would remove the tamper evidence.
Is Quox GDPR certified, and does it make me compliant?
No to both. There is no GDPR certificate to hold, and no tool delivers compliance. Quox is not a privacy suite: no data subject request workflow, no consent manager, no cookie tool. It is the evidence layer for the articles an AI agent platform touches, above all the record of processing, Art. 30, and accountability, Art. 5(2).
When do I have to tell the authority about a breach?
Article 33 requires the controller to notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach, unless it is unlikely to result in a risk to people’s rights. Article 34 adds telling the people affected when the risk is high. Processors must tell the controller without undue delay.
When do I need a DPIA?
Article 35 requires a data protection impact assessment before processing that is likely to result in a high risk to people’s rights and freedoms. It names systematic and extensive automated evaluation with significant effects, large-scale special category data, and large-scale monitoring of public areas. AI agents making decisions about people are a common trigger. Quox’s compliance suite includes a DPIA form. See the DPIA form.
How big are the fines?
Article 83 sets two tiers. The upper tier, for breaches of the principles, lawful basis and data subject rights, is up to EUR 20 million or 4% of total worldwide annual turnover, whichever is higher. The lower tier, which includes the Art. 25 to 39 obligations such as records and security, is up to EUR 10 million or 2%.
How long should I keep AI agent logs under the GDPR?
The GDPR has no fixed log retention period. Storage limitation, Art. 5(1)(e), says no longer than the purpose needs, and Art. 30(1)(f) wants erasure time limits in your record where possible. Our guide to AI agent log retention walks through how to choose, so you keep enough for accountability without keeping more than you need. How long to keep AI agent logs.
How does the GDPR relate to the EU AI Act?
They are separate laws that apply side by side. The GDPR governs personal data. The EU AI Act, Regulation (EU) 2024/1689, governs AI systems by risk. An agent that processes personal data can be in scope of both, and the evidence for each overlaps heavily. Read the EU AI Act page.
Does an ISO 27001 certificate satisfy the GDPR?
No. ISO 27001 is a certifiable management system for information security. It can supply strong evidence for Art. 32, but it does not cover lawful basis, data subject rights or the record of processing. The work overlaps and neither replaces the other. Read the ISO 27001 page.
What about the UK GDPR?
The UK has its own regime, the UK GDPR with the Data Protection Act 2018, which is close to the EU text in substance. This page covers the EU regulation, Regulation (EU) 2016/679, and article numbers here refer to it.
Self-hosted · free · governed
Have the record running before the authority asks
Your Art. 30 record needs to say what your agents did with personal data. Keep a witnessed record a regulator can verify offline, on your own servers.