All news
Tech & AI May 18, 2026 7 min

Spain: AEPD publishes Europe's first guidance on agentic AI and data protection

February 2026 - first EU Authority to clarify the intersection of agentic AI and GDPR. Prompt injection, access management, human oversight risks

TL;DR for the DPO

February 2026: Spain's AEPD is the first European Authority to publish detailed guidance on agentic AI. It explains autonomous AI agents, their vulnerabilities in processing personal data (inadequate access management, poor human oversight, prompt injection) and mitigation measures controllers and processors can adopt.

What agentic AI is

Unlike a chatbot responding to single prompts, an AI agent can autonomously perform complex tasks: plan actions, use external tools, access databases, make sequential decisions to reach a goal. This dramatically increases the risk surface for personal data.

Feb 2026
Guidance published
Official source:IAPP - European privacy regulators February 2026

Looking for a workspace for your DPO work?

DPO Workspace is built by a certified DPO. 30-day free trial.

Start free

Related articles

Tech & AI
art. 9a face that pays is biometric data, not a password

Paying with your face: what changes when the key is you

From 24 to 26 September 2026 Revolut trialled a payment system in three London coffee shops that recognises a customer's face at the till and matches it against the selfie uploaded when the account was opened. Enrolment is opt-in, payments above £200 need a second check, and the company states it complies with UK GDPR. For a DPO the interesting part lies elsewhere: a face used to identify someone is biometric data under Article 9, and the privacy notice holds two distinct data — the biometric template and the photo taken at the till — with different deletion rules.

Sep 24, 2026New 7 min
Tech & AI
180AI products supervised over five years

180 AI products in five years: what the regulator asked

On 25 September 2026 the Irish Data Protection Commission published its report on the supervision of artificial intelligence products and services between 2021 and 2025. Around 180 products engaged on, thousands of pages of assessments read, and two points recurring in almost every file: legitimate interest as the basis for training, and the transparency of processing nobody manages to explain simply.

Sep 25, 2026 6 min
Tech & AI
680customers contacted, and no intrusion into the systems

The request came from a real government domain

On 12 September 2026 Revolut confirmed it had disclosed customer data in response to fraudulent requests sent from a legitimate government agency email domain. The data included dates of birth, addresses, phone numbers, copies of passports and driving licences, verification selfies, account statements and transaction histories. Around 680 customers were contacted. This is not an intrusion into the systems: it is a personal data breach by unauthorised disclosure, and it turns on a procedure almost nobody has written down.

Sep 23, 2026 6 min