Authorised Agent

What an authorised agent is in privacy operations

An authorised agent is a delegate who may submit a privacy request for another person, so the organisation must treat the request as both an access issue and an accountability issue. The key question is not whether the request is convenient, but whether the delegate can be shown to act under valid authority and with the right scope.

That makes the term operational rather than purely definitional. It sits at the point where privacy rights, delegated representation, and evidence handling intersect, because the organisation must be able to explain why it accepted the request and who remains accountable for the outcome.

Why delegated authority matters

Delegated privacy requests are risky when authority is assumed instead of verified. A legitimate helper may be a family member, legal representative, caregiver, or other permitted delegate, but the organisation still needs a consistent basis for deciding whether the person can act on the data subject’s behalf.

This is why policy language, identity checks, and request intake rules need to work together. If the organisation cannot distinguish a valid delegate from an unauthorised third party, it may disclose personal data, refuse a valid request, or create a later dispute about whether the request was properly handled.

How the request should be tracked

A privacy request made by an authorised agent should be traceable from intake to completion, with the delegate relationship preserved alongside the request itself. That record should show what authority was claimed, what evidence was reviewed, what action was taken, and whether the request was fulfilled, denied, or escalated.

Tracking matters because the authority to act can be narrower than the right to receive information or manage an account. The organisation needs to preserve the request context so reviewers can see whether the delegate acted within the permitted scope and whether the handling process stayed consistent across channels and teams.

Evidence, accountability, and record retention

The value of the authorised agent concept is ultimately evidential. Organisations need a defensible record that supports the decision to accept or reject the request, especially when the request later becomes the subject of an audit, complaint, or access dispute. A clear evidentiary trail also helps show that the organisation applied the same standard consistently.

Authorisation Models Guide is useful here because delegated privacy handling is fundamentally about what a person is allowed to do on another person’s behalf. For organisations that manage broader delegated access and approval flows, Privileged Access Management Guide provides the wider control context for authority, scope, and session accountability. RFC 8693: OAuth 2.0 Token Exchange is relevant as a delegation model reference, because it shows how systems can represent on-behalf-of authority without confusing the delegate with the principal.

Risk and Threat Considerations

Authorised-agent workflows are exposed to impersonation, overreach, and poor evidence handling. If an organisation accepts a delegated privacy request without checking authority carefully, an attacker or opportunistic third party can obtain sensitive personal data, change records, or trigger actions that should never have been approved.

Failure mechanism: Weak verification, vague delegation rules, or incomplete recordkeeping lets an unauthorised person appear legitimate, or lets a legitimate delegate exceed the authority actually granted.

Impact: The organisation can disclose protected information, undermine the data subject’s rights, lose auditability, and be unable to prove that it handled the request lawfully and consistently.

Practitioner Guidance

Why practitioners should care: The practical problem is not just accepting a request, but proving that the delegate had the right to make it and that the organisation handled the case defensibly. That means the intake process should force a clear decision on principal, delegate, scope, and evidence before fulfilment begins.

Practitioner takeaway: Treat authorised-agent handling as a controlled delegation process, not as a customer-service convenience, because the evidentiary record is part of the control.

Related resources from NHI Mgmt Group

• Who is accountable when an authorised AI agent causes a breach?
• How do teams know whether an AI agent action is suspicious or just authorised?
• Why do authorised AI agent tool calls still create exfiltration risk in practice?
• What happens when an AI agent exceeds its authorised scope in production?