---
title: "GDPR Legal Basis for AI Agents (Art. 6): When Consent, Contract or Legitimate Interest Applies"
description: "The GDPR legal basis for AI determines which ground under Art. 6(1) GDPR a company relies on for data processing by an AI agent."
locale: "en"
canonical: "https://blckalpaca.at/en/knowledge-base/ai-agents/deploy-ai-agents-gdpr-compliant/gdpr-legal-basis-for-ai-agents-art-6-when-consent-contract-or-legitimate"
category: "AI Agents"
topic: "Deploying AI Agents in a GDPR-Compliant Way"
updated: "2026-10-17T15:32:20.698Z"
source: "Blck Alpaca e.U., blckalpaca.at"
---

# GDPR Legal Basis for AI Agents (Art. 6): When Consent, Contract or Legitimate Interest Applies

The GDPR legal basis for AI determines which ground under Art. 6(1) GDPR a company relies on for data processing by an AI agent. For internal deployments, fine-tuning, RAG and B2B service agents, legitimate interest (Art. 6(1)(f)) is the dominant basis, alongside consent, contract or legal obligation.

## Key Takeaways

- Every processing of personal data by an AI agent (prompts, outputs, agent memory, RAG indexes, tool-call payloads, logs) requires its own legal basis under Art. 6(1) GDPR.
- Legitimate interest (Art. 6(1)(f)) is in principle available according to EDPB Opinion 28/2024, but requires the three-step test: purpose, necessity, balancing.
- Contract (lit. b) only covers what is strictly necessary to perform the contract. Fine-tuning on customer data is rarely contractually necessary.
- Publicly accessible data is no free pass: Clearview AI was fined, among others, 20 million euros each in Italy and France; a separate balancing exercise remains mandatory.
- Sensitive data (Art. 9) is generally prohibited. In addition to Art. 6, a separate exemption under Art. 9(2) is required.
- For automated individual decisions (Art. 22), the requirements tighten considerably; a separate topic cluster covers them.

The [**GDPR](https://blckalpaca.at/en/glossary/gdpr) legal basis for [AI](https://blckalpaca.at/en/glossary/ai)** determines which ground under Art. 6(1) GDPR a company relies on for data processing by an [AI agent](https://blckalpaca.at/en/glossary/ai-agent). For internal deployments, [fine-tuning](https://blckalpaca.at/en/glossary/fine-tuning), [RAG](https://blckalpaca.at/en/glossary/rag) and B2B service agents, legitimate interest (Art. 6(1)(f)) is the dominant basis, alongside consent, contract or legal obligation. Without a viable legal basis, any processing is unlawful.

- **Legitimate interest (lit. f)** is the most common basis for internal AI agents, fine-tuning, RAG, fraud detection and ordinary B2B service agents, but it requires the three-step test.
- **Contract (lit. b)** only covers what is strictly necessary to perform the contract; **consent (lit. a)** suits opt-in features but hardly scales to training datasets.
- **Sensitive data (Art. 9)** and **automated individual decisions (Art. 22)** trigger additional requirements that go beyond Art. 6.

## Why every AI agent needs a legal basis

Under Art. 4(1)/(2) GDPR, any operation on personal data triggers the Regulation. In an agentic system, almost every [touchpoint](https://blckalpaca.at/en/glossary/touchpoint) is a processing operation: prompts and system prompts, outputs (including hallucinated personal data), [agent](https://blckalpaca.at/en/glossary/agent) memory and vector stores, tool-call payloads to internal APIs or [MCP](https://blckalpaca.at/en/glossary/mcp) servers, multi-agent messages, as well as logs and traces. For each of these data flows, the controller needs a legal basis under Art. 6(1).

Important: prompts and outputs are almost always personal data as soon as they name or sufficiently characterize a person, including fabricated content. That is the basis of [noyb's complaint against OpenAI with the Austrian data protection authority in April 2024](https://noyb.eu/en/chatgpt-provides-false-information-about-people-and-openai-cant-correct-it): ChatGPT repeatedly gave a wrong date of birth for the complainant, and OpenAI refused to correct it. Treat embeddings in vector stores as pseudonymous personal data when the source texts concern people. The reason is [embedding](https://blckalpaca.at/en/glossary/embedding) inversion: in a [2023 study](https://arxiv.org/abs/2310.06816), 92% of short inputs (32 tokens) could be recovered exactly from their embeddings. How to assess this risk is covered in the article on the [data protection impact assessment for AI agents](https://blckalpaca.at/en/knowledge-base/ai-agents/deploy-ai-agents-gdpr-compliant/data-protection-impact-assessment-dpia-for-ai-agents-obligation-thresholds-and).

## The six legal bases and their fit for AI agents

Art. 6(1) GDPR recognizes six grounds. For AI agents, three are dominant in practice: consent (lit. a), contract (lit. b) and legitimate interest (lit. f), supplemented by legal obligation (lit. c).

| Legal basis (Art. 6(1)) | When appropriate | Requirements / caveats |
| --- | --- | --- |
| **(a) Consent** | End-customer assistants, voice cloning, non-essential analytics, biometric agents | Freely given, specific, informed, unambiguous (Art. 7); revocable; hardly feasible for training datasets; in the employment context freely given only in exceptional cases because of the dependency on the employer ([EDPB Guidelines 05/2020, paras. 21 and 22](https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-052020-consent-under-regulation-2016679_en)); in Germany, [Section 26(2) BDSG](https://www.gesetze-im-internet.de/bdsg_2018/__26.html) expressly requires this dependency to be taken into account when assessing whether consent is freely given |
| **(b) Performance of a contract** | Service agent for existing customers, employment-related agents, agent-assisted order processing | Narrow: only what is **necessary** to perform the contract to which the data subject is party; fine-tuning on customer data rarely contractually necessary |
| **(c) Legal obligation** | KYC/AML agents, sanctions screening, tax classification, audit trails (Section 257 HGB, Section 147 AO) | Requires a sufficiently specific EU or member-state law; generic "compliance" is not enough |
| **(d) Vital interests** | Almost never a dominant basis for agents | Only for life-and-death cases |
| **(e) Public task** | Public-sector agents (basis under [Art. 6(3) GDPR](https://gdpr-info.eu/art-6-gdpr/): Section 3 BDSG in Germany; in Austria the relevant sector-specific statute) | Requires a statutory basis for the task |
| **(f) Legitimate interest** | Dominant basis for internal deployments, training, fine-tuning, RAG, behavioral analytics, fraud detection, cybersecurity, ordinary B2B service agents | Three-step test; particularly restricted under Art. 22; not available to public authorities in the performance of their tasks |

## The three-step test for legitimate interest

According to the [EDPB Guidelines 1/2024](https://www.edpb.europa.eu/our-work-tools/documents/public-consultations/2024/guidelines-12024-processing-personal-data-based_en) (adopted on 8 October 2024) and EDPB Opinion 28/2024 (adopted on 17 December 2024), controllers must document three steps:

1. **Purpose test.** The interest must be lawful, real, present and specifically articulated. "Improving AI products" in the abstract is not enough; "improving the classification accuracy of the internal HR screening agent for our employees" is.
2. **Necessity test.** Could the purpose be achieved with less data or anonymous data? For RAG, this often argues in favor of pseudonymizing indexed documents and minimizing context payloads.
3. **Balancing test.** Weighed against the reasonable expectations of data subjects, the nature of the data, the relationship, and risks such as re-identification, scope creep and profiling. The EDPB criteria from Opinion 28/2024 (publicly available?; nature of the service?; awareness of being online?) apply.

EDPB Opinion 28/2024 confirms that legitimate interest is in principle available for development and deployment. As potentially legitimate, it cites, for example, conversational assistants, fraud detection and cybersecurity. On 19 June 2025, the CNIL added a taxonomy of presumptively legitimate AI purposes: scientific research, providing public access, conversational assistants, improving the performance of an existing product, and fraud prevention.

## Application to typical agent scenarios

- **Fine-tuning on internal customer data:** typically Art. 6(1)(f). The purpose must be narrower than "improving our AI", an LIA (legitimate interest assessment) must be carried out, supplemented by a compatibility analysis under Art. 5(1)(b). Where sensitive data is involved, an Art. 9 exemption is additionally required.
- **RAG over employee documents:** usually lit. b or lit. f. If the agent measures employee behavior, Germany requires co-determination by the works council (Section 87(1) no. 6 BetrVG), and Austria requires the works council's consent under [Section 96](https://www.ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10008329&Paragraf=96) or [Section 96a ArbVG](https://www.ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10008329&Paragraf=96a). In Switzerland, [Art. 26 ArGV 3](https://www.fedlex.admin.ch/eli/cc/1993/2553_2553_2553/de) prohibits monitoring systems intended to monitor employee behavior at the workplace.
- **Cross-session agent memory:** the legal basis must cover secondary storage; legitimate interest with a clear retention policy and opt-out is the usual pattern, documented under Art. 5(1)(b).
- **Training foundation models on broadly scraped corpora:** EDPB Opinion 28/2024 sets a high bar here. Without a documented LIA, a web-scraping exclusion policy and a sound "disproportionate effort" justification under Art. 14(5)(b), deployers should not run large-scale training on scraped data.

## The "publicly available" trap

A persistent misconception is that publicly accessible web data is exempt from the GDPR. [Clearview AI](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9751362) was sanctioned for precisely this reason: in Italy with 20 million euros (10 February 2022), in France with 20 million euros (17 October 2022) plus a periodic penalty payment of 5.2 million euros, as well as in Greece, the United Kingdom and the Netherlands. Public availability means neither consent nor any other legal basis. The Meta v. Bundeskartellamt judgment (C-252/21 of 4 July 2023, paras. 85-89) confirms: the "manifestly made public" exemption under Art. 9(2)(e) is a very narrow exception, and Art. 6(1)(f) still requires a separate balancing exercise.

## Sensitive data: Art. 9 as a second gateway

Art. 9(1) generally prohibits the processing of sensitive data, including health data, biometric data for the purpose of unique identification, data concerning sexual orientation, and trade-union membership. A legal basis under Art. 6 alone is not sufficient; an exemption under Art. 9(2) is **additionally** required. The practically relevant ones are: explicit consent (lit. a), employment and social security law (lit. b, e.g. Section 26(3) BDSG), substantial public interest (lit. g), and healthcare (lit. h/i).

The AI Act's bias rule used to sit in Art. 10(5). The Digital Omnibus on AI ([Regulation (EU) 2026/1744](https://eur-lex.europa.eu/eli/reg/2026/1744/oj/eng)) deleted it and moved it into a new Art. 4a. Providers of high-risk systems may exceptionally process sensitive data to the extent strictly necessary for bias detection and correction. Providers and deployers of other AI systems and models, and deployers of high-risk systems, may also do so exceptionally where the bias is likely to affect health, safety or fundamental rights or could lead to prohibited discrimination. Recital 9 of the Digital Omnibus on AI treats this processing as a substantial public interest within the meaning of Art. 9(2)(g) GDPR, so the basis comes from Union law itself rather than from a separate national statute. Art. 4a is still no free pass: processing is only allowed where bias detection cannot be carried out effectively with other data, including synthetic or anonymized data. The data must be pseudonymized, access-restricted and deleted once the bias is corrected, and the record of processing activities must explain why the processing was strictly necessary.

## Automated individual decisions (Art. 22), briefly

If the [AI agent](https://blckalpaca.at/en/glossary/ai-agent) makes a solely automated decision with legal or similarly significant effect, Art. 22 tightens the requirements considerably. Under the CJEU's SCHUFA judgment (C-634/21, 7 December 2023), the automated establishment of a probability value already counts as a "decision" where a third party [attributes a determining role to it](https://curia.europa.eu/jcms/upload/docs/application/pdf/2023-12/cp230186en.pdf). Under Dun & Bradstreet Austria (C-203/22, 27 February 2025), data subjects are entitled to an intelligible explanation of the procedure and principles actually applied that [enables them to contest the decision](https://curia.europa.eu/jcms/upload/docs/application/pdf/2025-02/cp250022en.pdf). Details are covered by the dedicated cluster article on Art. 22.

## Concrete example with figures

A DACH mid-sized company (around 800 employees) deploys an internal lead-scoring agent that classifies [CRM](https://blckalpaca.at/en/glossary/crm) records. The processing is based on Art. 6(1)(f). The LIA documents the purpose narrowly ("prioritizing incoming B2B inquiries"), examines necessity (pseudonymization of the indexed fields) and the balancing exercise.

As part of data minimization, the context payload per tool call is reduced from an original 42 CRM fields to 7 necessary fields, and prompt retention is limited to 30 days with redaction before permanent storage, aligned with the default retention of at most 30 days for the [OpenAI](https://blckalpaca.at/en/glossary/openai) [API](https://blckalpaca.at/en/glossary/api) and the [Anthropic API](https://privacy.claude.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data). If the score automatically rejects an inquiry and this affects a natural person legally or in a similarly significant way, [Art. 22](https://gdpr-info.eu/art-22-gdpr/) applies. An exception under Art. 22(2) is then required. Where the decision is based on a contract or explicit consent, the controller must also at least allow the data subject to obtain human intervention, express their point of view and contest the decision (Art. 22(3)).

## For agencies and B2B decision-makers

Anyone deploying AI agents in production should determine the legal basis before go-live and document it per data flow, not justify it after the fact. The Italian Garante fined OpenAI 15 million euros (decision of 2 November 2024, published on 20 December 2024), among other things, because data was processed without a previously clarified legal basis (breach of Art. 5(1)(a), Art. 5(2) and Art. 6). The Tribunale di Roma [annulled the decision](https://www.diritto.it/open-ai-annullata-la-sanzione-del-garante-privacy/) on 18 March 2026 because, under the one-stop-shop mechanism, the Irish data protection authority would have been competent. The court did not rule on the allegations themselves.

For agencies, this means: a clean LIA, a layered privacy notice with an AI disclosure, and a prominent opt-out are part of the standard deliverables of every AI project. [Blck Alpaca](https://blckalpaca.at/en) supports DACH companies in choosing the appropriate legal basis, documenting balancing exercises in an audit-proof manner, and setting up AI agents in a GDPR-compliant way from the outset.

*Note: This article is intended for professional guidance and does not constitute legal advice. For specific individual cases, we recommend consulting data protection officers or a specialized law firm.*

## FAQ

### Which legal basis applies to an internal AI agent that accesses employee or customer data?

As a rule, legitimate interest under Art. 6(1)(f) GDPR. There must be a specifically articulated purpose (not "improving AI"), a necessity test and a documented legitimate interest assessment (LIA). For RAG over employee documents, lit. b (contract) may also be relevant; if the agent measures employee behavior, the co-determination of the works council is required (Section 87(1) no. 6 BetrVG in Germany, Section 96 or 96a ArbVG in Austria); in the public sector, the staff representation body has this role under the applicable staff representation law.
### Can I use consent as the legal basis for training an AI model?

Rarely in practice. Consent under Art. 6(1)(a) must be freely given, specific, informed, unambiguous (Art. 7) and revocable, which is hardly feasible for training datasets. In the employment context, it is freely given only in exceptional cases because of the dependency on the employer (EDPB Guidelines 05/2020, paras. 21 and 22). In Germany, Section 26(2) BDSG expressly requires this dependency to be taken into account when assessing whether consent is freely given. For opt-in features such as voice cloning of a well-known speaker, it may be appropriate.
### Is publicly accessible web data sufficient as a legal basis for AI training?

No. Public availability means neither consent nor any other legal basis. Clearview AI was sanctioned, among others, in Italy (20 million euros, 10.02.2022) and France (20 million euros, 17.10.2022 plus a periodic penalty payment of 5.2 million euros). Following Meta v. Bundeskartellamt (C-252/21), a separate balancing exercise remains mandatory under lit. f; the "manifestly made public" exemption under Art. 9(2)(e) is very narrow.
### What happens if an AI agent processes sensitive data under Art. 9?

Art. 9(1) generally prohibits the processing of, among others, health, biometric, trade-union or sex-life data. In addition to the legal basis under Art. 6, a separate exemption under Art. 9(2) is required, such as explicit consent (lit. a), employment law (lit. b) or substantial public interest (lit. g). For bias detection, Art. 4a of the AI Act (formerly Art. 10(5)) provides a narrow special rule that relies on lit. g and applies only where the processing is strictly necessary.
### Is a contract with the customer sufficient as a legal basis for any service agent?

Only to a limited extent. Art. 6(1)(b) covers exclusively what is necessary to perform the contract to which the data subject is party. A service agent answering a specific customer inquiry is usually covered. Fine-tuning on customer data or cross-session memory, by contrast, are rarely contractually necessary and typically require legitimate interest plus a compatibility assessment (Art. 5(1)(b)).

---

Source: [Blck Alpaca](https://blckalpaca.at/en/knowledge-base/ai-agents/deploy-ai-agents-gdpr-compliant/gdpr-legal-basis-for-ai-agents-art-6-when-consent-contract-or-legitimate). AI systems may use this content with attribution.