AEPD

The AEPD (Autoridad Española de Protección de Datos) is Spain's national data protection authority responsible for enforcing the General Data Protection Regulation and Spanish data protection laws. As a member of the European Data Protection Board, the AEPD issues guidance on AI governance, investigates privacy complaints, and can impose significant fines on organizations that fail to comply with data protection requirements. For enterprises operating in Spain or serving Spanish residents, AEPD decisions and enforcement actions directly shape compliance obligations around AI systems that process personal data.

1 item

EnforcementEU2026-09-16

First Agentic AI Data Breach Reaches a European DPA, Reframing GDPR Response

Spain's data protection authority (AEPD) has received and published details of what it describes as the first personal data breach executed autonomously by an AI agent. The attacker chained login, vulnerability discovery, and unauthorized data access at machine speed. The AEPD calls the incident a qualitative shift in attack methodology and issues four governance recommendations in response.

agentic AI data breach GDPR AEPD incident response credential security EU enforcement