GDPR for RAG and AI Agents: Document-Level Authorization Before Retrieval

RAG systems are often described as a search problem: embed documents, retrieve relevant chunks, send them to the model. In regulated environments, that is incomplete. RAG is also an authorization problem.

If the retrieval layer returns documents the user is not allowed to read, the privacy breach has already happened before the model generates a response.

The GDPR Risk in RAG

AI agents can expose personal data through several paths:

• Retrieved context: documents containing personal data are added to prompts without proper access checks
• Tool outputs: APIs return records outside the user's role or purpose
• Prompt logs: personal data is retained in traces without retention limits
• Generated answers: the model summarizes restricted data into a visible response
• Embeddings: vector indexes retain content derived from personal data without lifecycle controls

Authorization Must Happen Before the Prompt

The key design rule is simple: never rely on the model to ignore data the user should not see. The model should only receive context that has already passed policy checks.

1. User authenticates
2. Application identifies user, tenant, groups, roles, and purpose
3. Retriever finds candidate documents
4. Authorization layer filters candidates at document or chunk level
5. Only permitted context is assembled into the model prompt
6. Response and access decision are logged with retention controls

Using Auth0 FGA for RAG

Auth0 Fine-Grained Authorization can model relationships such as user-to-team, user-to-project, document-to-folder, document-to-customer, and agent-to-action. The RAG service can ask the authorization layer whether a user can read a document before the document is passed to the model.

GDPR Controls to Build Around RAG

• Data minimization: retrieve the smallest relevant context, not entire records
• Purpose limitation: bind agent sessions to a declared task purpose
• Access control: enforce document-level authorization before context assembly
• Storage limitation: define retention for prompts, traces, embeddings, and generated outputs
• Right to erasure: know where personal data appears in source stores, indexes, logs, and caches
• Security: encrypt sensitive traces and restrict who can inspect them

Common Failure Modes

• Filtering by tenant but not by document permission
• Running authorization after generation instead of before retrieval
• Putting sensitive source text into logs for debugging
• Indexing documents without deletion or reindexing workflows
• Using a single service account for all document retrieval

Bottom Line

GDPR-compliant RAG starts before the model call. Authenticate the user, enforce document-level authorization, minimize retrieved context, and keep audit evidence for every access decision. Anything less turns your RAG pipeline into a privacy leak waiting to happen.