All news
Tech & AI May 18, 2026 7 min

Spain: AEPD publishes Europe's first guidance on agentic AI and data protection

February 2026 - first EU Authority to clarify the intersection of agentic AI and GDPR. Prompt injection, access management, human oversight risks

TL;DR for the DPO

February 2026: Spain's AEPD is the first European Authority to publish detailed guidance on agentic AI. It explains autonomous AI agents, their vulnerabilities in processing personal data (inadequate access management, poor human oversight, prompt injection) and mitigation measures controllers and processors can adopt.

What agentic AI is

Unlike a chatbot responding to single prompts, an AI agent can autonomously perform complex tasks: plan actions, use external tools, access databases, make sequential decisions to reach a goal. This dramatically increases the risk surface for personal data.

Feb 2026
Guidance published
Official source:IAPP - European privacy regulators February 2026

Looking for a workspace for your DPO work?

DPO Workspace is built by a certified DPO. 30-day free trial.

Start free

Related articles

Tech & AI
0passwords stolen, and that is the problem

French tax data stolen, and no passwords: that is what makes this one dangerous

On 14 August the French finance ministry announced that the tax administration's information system had been breached: a third party was able to consult and extract data on individuals and businesses. Identifiers and passwords appear untouched — which is precisely why the risk is not account takeover but phishing built on genuine tax data.

Aug 18, 2026New 5 min
Tech & AI
4i momenti in cui si decide

The Dutch authority publishes a self-assessment for generative AI

Something was needed to hand the client who says "we switched on the AI in our software". The Dutch authority has published a self-assessment on generative AI systems: four moments, and in each one a decision that has to be documented.

Aug 18, 2026New 4 min
Tech & AI
1 su 4le violazioni con IA

Breach notices have already passed the whole of 2025

The first-half 2026 figures say two different things. The first is that the number of people notified is dominated by very few enormous incidents. The second, less comfortable for anyone assessing risk, is that AI appears in one breach in four.

Aug 14, 2026New 4 min