AI Agents · Lesson

Regulatory Compliance: GDPR and SOC2

Data minimization, consent tracking, and access control for compliant agents.

Regulatory Compliance: GDPR and SOC2 is a free AI Agents lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the AI Agents learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Why Regulations Apply to AI Agents

AI agents process user data, make decisions, and take actions. This puts them directly in scope for data protection regulations (GDPR) and security frameworks (SOC 2).

Compliance is not optional — violations carry fines up to 4% of global annual revenue under GDPR.

GDPR: Data Minimization

GDPR's data minimization principle requires collecting only the personal data strictly necessary for the stated purpose. An agent should not store full conversation transcripts if only the outcome (resolved/unresolved) is needed for analytics.

def minimized_log_entry(conversation: list[dict], user_id: str) -> dict:
    '''Store only what is needed — not the full transcript.'''
    return {
        'user_id':       user_id,
        'timestamp':     conversation[-1].get('timestamp'),
        'turns':         len(conversation),
        'resolved':      conversation[-1].get('resolved', False),
        'intent':        conversation[-1].get('intent'),
        'satisfaction':  conversation[-1].get('csat_score'),
        # NOT stored: full message text, PII mentioned in conversation
    }

# WRONG — stores raw messages which may contain PII
# {'messages': conversation, 'user_id': user_id}

if __name__ == '__main__':
    conversation = [
        {'timestamp': 1717000000, 'resolved': True, 'intent': 'reset_password', 'csat_score': 5}
    ]
    print('Minimized log entry:', minimized_log_entry(conversation, user_id='u42'))

GDPR: Consent Tracking

Before the agent processes personal data, you must have a legal basis — usually user consent. Track when consent was given, what it covers, and honor withdrawals.

from datetime import datetime, timezone

consent_store: dict[str, dict] = {}  # user_id -> consent record

def record_consent(user_id: str, purpose: str, version: str = '1.0'):
    if user_id not in consent_store:
        consent_store[user_id] = {'purposes': {}}
    consent_store[user_id]['purposes'][purpose] = {
        'granted':     True,
        'timestamp':   datetime.now(timezone.utc).isoformat(),
        'version':     version
    }

def withdraw_consent(user_id: str, purpose: str):
    if user_id in consent_store:
        consent_store[user_id]['purposes'].pop(purpose, None)

def has_consent(user_id: str, purpose: str) -> bool:
    return bool(
        consent_store.get(user_id, {}).get('purposes', {}).get(purpose, {}).get('granted')
    )

if __name__ == '__main__':
    record_consent('u42', 'marketing_emails')
    print('Has consent:', has_consent('u42', 'marketing_emails'))
    withdraw_consent('u42', 'marketing_emails')
    print('Has consent after withdrawal:', has_consent('u42', 'marketing_emails'))

GDPR: Right to Erasure (Right to Be Forgotten)

When a user requests deletion, the agent must erase all personal data associated with them — including agent logs, conversation history, and cached profiles. This must happen within 30 days of the request.

import os

def erase_user_data(user_id: str, conn) -> dict:
    '''Delete all personal data for a user across all storage systems.'''
    deleted = {}

    # 1. Delete from audit log (if not using WORM storage)
    with conn.cursor() as cur:
        cur.execute('DELETE FROM agent_audit_log WHERE user_id = %s', (user_id,))
        deleted['audit_log_rows'] = cur.rowcount

    # 2. Delete conversation history
    with conn.cursor() as cur:
        cur.execute('DELETE FROM conversation_history WHERE user_id = %s', (user_id,))
        deleted['conversations'] = cur.rowcount

    # 3. Remove consent record
    consent_store.pop(user_id, None)
    deleted['consent_record'] = 1

    # 4. Clear cached profile
    profile_cache = {}  # reference to your cache
    profile_cache.pop(user_id, None)
    deleted['profile_cache'] = 1

    conn.commit()
    return {'user_id': user_id, 'erased': deleted}

GDPR: Data Portability

Users have the right to receive their data in a machine-readable format (e.g., JSON or CSV). Build an export function that collects all data stored about a user across the agent's systems.

import json

def export_user_data(user_id: str, conn) -> str:
    export = {'user_id': user_id, 'data': {}}

    with conn.cursor() as cur:
        cur.execute(
            'SELECT timestamp, action_type, result FROM agent_audit_log '
            'WHERE user_id = %s ORDER BY timestamp',
            (user_id,)
        )
        rows = cur.fetchall()
        export['data']['audit_log'] = [
            {'timestamp': r[0], 'action': r[1], 'result': r[2]}
            for r in rows
        ]

    export['data']['consent'] = consent_store.get(user_id, {})
    return json.dumps(export, indent=2)

SOC 2: Access Control

SOC 2 Type II requires demonstrating that access to systems and data is restricted to authorized individuals. For an agent, this means: role-based access to agent tools, MFA for admin access, and regular access reviews.

ROLE_PERMISSIONS = {
    'agent_basic':    {'web_search', 'read_file', 'query_database'},
    'agent_email':    {'web_search', 'read_file', 'query_database', 'send_email'},
    'agent_admin':    {'web_search', 'read_file', 'write_file', 'query_database',
                       'send_email', 'create_ticket', 'execute_python_sandbox'},
    'human_admin':    {'*'}  # all permissions
}

def get_permitted_actions(role: str) -> set:
    perms = ROLE_PERMISSIONS.get(role, set())
    if '*' in perms:
        return ALLOWED_ACTIONS  # reference to full allowlist
    return perms

def check_role_permission(role: str, action: str) -> bool:
    return action in get_permitted_actions(role)

SOC 2: Encryption at Rest and in Transit

SOC 2 requires encrypting sensitive data at rest (database encryption, encrypted disks) and in transit (TLS 1.2+). For agents, this means: encrypted conversation storage, TLS on all API calls, and no plaintext secrets in logs.

from cryptography.fernet import Fernet
import os

# Key stored in environment variable, never in code
ENCRYPTION_KEY = os.environ.get('LOG_ENCRYPTION_KEY', Fernet.generate_key())
cipher = Fernet(ENCRYPTION_KEY)

def encrypt_sensitive_field(value: str) -> str:
    return cipher.encrypt(value.encode()).decode()

def decrypt_sensitive_field(encrypted: str) -> str:
    return cipher.decrypt(encrypted.encode()).decode()

# Usage: encrypt PII before storing in audit log
encrypted_email = encrypt_sensitive_field('user@example.com')
print(encrypted_email[:30], '...')  # starts with gAAAA...

SOC 2: Audit Logs for Security Events

SOC 2 auditors want to see logs of security events: login attempts, access to sensitive data, configuration changes, and policy violations. These must be stored securely and retained for at least 1 year.

import logging, json, time

security_logger = logging.getLogger('agent.security')

SECURITY_EVENTS = {
    'auth_success', 'auth_failure', 'policy_violation',
    'data_access_pii', 'admin_action', 'config_change'
}

def log_security_event(event_type: str, agent_id: str,
                       user_id: str, details: dict):
    assert event_type in SECURITY_EVENTS, f'Unknown security event: {event_type}'
    entry = {
        'timestamp':  time.time(),
        'event_type': event_type,
        'agent_id':   agent_id,
        'user_id':    user_id,
        'details':    details
    }
    security_logger.warning(json.dumps(entry))

if __name__ == '__main__':
    import sys
    security_logger.addHandler(logging.StreamHandler(sys.stdout))
    log_security_event('auth_failure', 'agent-1', 'user-42', {'reason': 'bad_token'})

Tracking PII in Agent Outputs

Agents should not include PII in outputs that are logged or sent to third-party services (analytics, monitoring). Scan outgoing content for PII patterns before transmission.

import re

PII_PATTERNS = [
    (r'\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b', 'email'),
    (r'\b\d{3}[-.]?\d{3}[-.]?\d{4}\b',                         'phone'),
    (r'\b\d{4}[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}\b',           'credit_card'),
    (r'\b\d{3}-\d{2}-\d{4}\b',                                   'ssn')
]

def redact_pii(text: str) -> tuple[str, list[str]]:
    redacted = text
    found_types = []
    for pattern, pii_type in PII_PATTERNS:
        if re.search(pattern, redacted):
            found_types.append(pii_type)
            redacted = re.sub(pattern, f'[{pii_type.upper()}_REDACTED]', redacted)
    return redacted, found_types

text, types = redact_pii('Contact john@example.com or call 555-867-5309')
print(text)
print('PII found:', types)

Building a Compliance Checklist

Before deploying an agent that handles personal data, verify these controls are in place.

COMPLIANCE_CHECKLIST = [
    ('GDPR',  'Consent captured before processing personal data'),
    ('GDPR',  'Data minimization: only necessary data is collected'),
    ('GDPR',  'Right-to-erasure endpoint implemented and tested'),
    ('GDPR',  'Data portability export available'),
    ('GDPR',  'Data retention policy enforced (auto-delete after N days)'),
    ('SOC2',  'Role-based access control implemented for all agent tools'),
    ('SOC2',  'All data encrypted at rest and in transit (TLS 1.2+)'),
    ('SOC2',  'Security events logged and retained for 12+ months'),
    ('SOC2',  'Access reviews scheduled quarterly'),
    ('SOC2',  'Incident response plan documented'),
    ('BOTH',  'PII redaction applied to logs and analytics exports'),
    ('BOTH',  'Vendor DPAs signed for all third-party APIs used'),
]

for framework, control in COMPLIANCE_CHECKLIST:
    print(f'[ ] [{framework}] {control}')

Data Retention Automation

GDPR requires data to be deleted when it is no longer needed for its original purpose. Automate this with a retention policy job that purges old records based on configurable retention periods.

from datetime import datetime, timedelta, timezone

RETENTION_POLICIES = {
    'conversation_history': 90,    # days
    'agent_audit_log':      365,
    'cached_profiles':      1,
    'session_data':         30
}

def purge_expired_data(conn):
    purged = {}
    for table, retention_days in RETENTION_POLICIES.items():
        cutoff = datetime.now(timezone.utc) - timedelta(days=retention_days)
        try:
            with conn.cursor() as cur:
                cur.execute(
                    f'DELETE FROM {table} WHERE timestamp < %s',
                    (cutoff.timestamp(),)
                )
                purged[table] = cur.rowcount
        except Exception as e:
            purged[table] = f'Error: {e}'
    conn.commit()
    return purged

if __name__ == '__main__':
    class FakeCursor:
        def __enter__(self):
            return self
        def __exit__(self, *exc):
            return False
        def execute(self, sql, params):
            self.rowcount = 3

    class FakeConn:
        def cursor(self):
            return FakeCursor()
        def commit(self):
            pass

    result = purge_expired_data(FakeConn())
    print('Rows purged per table:')
    for table, count in result.items():
        print(f'  {table}: {count}')

What is GDPR's data minimization principle?

Data minimization is one of the core principles of GDPR and directly impacts how agent systems should be designed from the ground up.

GDPR and SOC 2 Compliance Recap

GDPR compliance requires: consent tracking, data minimization, right-to-erasure implementation, portability exports, and PII redaction in logs.

SOC 2 requires: role-based access control, encryption at rest and in transit, security event logging, and access reviews. Automate retention policies to purge expired data.

Frequently asked questions

Is the “Regulatory Compliance: GDPR and SOC2” lesson free?

Yes — the full text of “Regulatory Compliance: GDPR and SOC2” is free to read here on the web, and the AI Agents course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the AI Agents course, upgrade to CoddyKit PRO.

What will I learn in “Regulatory Compliance: GDPR and SOC2”?

Data minimization, consent tracking, and access control for compliant agents. You practise AI Agents with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start AI Agents?

No prior experience is required. AI Agents on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Regulatory Compliance: GDPR and SOC2” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this AI Agents lesson?

Yes. Every AI Agents lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to AI Agents