First-Party Data and Consent in Agentic Buying: Where the Governance Chain BreaksUnder GDPR, data processing requires a lawful basis established by a legal person. A software agent has no legal standing to establish one. First-party data cannot enter agent negotiation without prior explicit authorisation from a human data controller.