The AEPD registers the first data breach in Spain attributed to an attack carried out by an AI agent.

With the public information available up to September 14, 2026, there is no record that the AEPD has made public a specific and formalized file regarding “a data breach attributed to an AI agent” identified and singled out. What there is, above all, is a phase of preliminary analysis, alert, and European coordination around the risks of certain AI assistants and agents that could expose user conversations or data.

The most direct reference is the AEPD press release of May 27, 2026, in which the Agency reports that it has forwarded to the European Data Protection Board (EDPB) the preliminary study “Your AI assistant is leaking your conversations”, prepared by Imdea Networks, so that it can be disseminated and evaluated by all European data protection authorities, and so that the matter can be addressed in a plenary meeting of European authorities.

That document — accessible on the AEPD website: press release of 05/27/2026 — does not announce the opening of a sanctioning procedure or an individualized file for a specific breach, but rather:

• Reports on an external technical study suggesting that some AI systems could allow third parties (including large advertising platforms) to access information from user conversations and activity.
• Emphasizes the need for a coordinated approach at the European level, given the GDPR's one-stop-shop mechanism.
• Places the matter on a level of preliminary risk assessment and possible non-compliance, rather than a formalized investigation into a specific controller.

In parallel, the AEPD has been building a reference framework on agentic and generative AI:

• The guide “Agentic Artificial Intelligence from the Data Protection Perspective” (02/18/2026), available at guidance on agentic AI , which analyzes risks such as memory exfiltration, shadow leaks, or exposure of personal data by autonomous agents.
• The campaign and recommendations “Be Careful What You Trust It With” (January 2026), with advice to users on what information they should not enter into AI tools, accessible at AI recommendations guide .
• Its internal policy on the use of generative AI and its implementation annex (November and December 2025), where the Agency itself describes incident and threat management procedures related to generative AI in its administrative processes.
• The note of 07/15/2025 reminding that it can already act against prohibited AI systems processing personal data, even before the full application of the European AI Regulation, available at note on prohibited AI systems .

All this points to the AEPD being, regarding breaches attributable to AI agents or assistants, in a combination of:

• Preventive and guidance phase, through guides, campaigns, and recommendations.
• Enhanced monitoring phase of these systems, reminding that it can apply the GDPR and, if necessary, initiate investigative actions.
• European coordination phase based on the Imdea Networks study, to determine if there are operational patterns in certain AI assistants that constitute a data breach or unlawful processing of personal data.

It is also important to keep in mind that, according to the GDPR and the Organic Data Protection Law, prior investigative actions and many AEPD files are not publicly detailed while ongoing. Only when a resolution (sanctioning, dismissal, or warning) is issued is the type of breach, the responsible party, and the legal basis clearly known.

Based on the sources consulted, what can be stated today is:

• There is no public resolution or specific note identifying a concrete case of “data breach attributed to an AI agent” for which the AEPD has formally detailed the processing phase (prior actions, file opening, resolution proposal, etc.).
• There is an explicit recognition of real risks and possible breaches linked to the use of AI agents and assistants and a movement by the AEPD to place these risks on the European agenda and in ordinary supervisory practice.

Therefore, rather than being in an advanced phase of a specific public procedure, it can be said that the AEPD is in a phase of alert, study, and intensified supervision on this type of breaches, with the possibility of leading to formal investigations and sanctions when specific infringements are proven, but as of today, there is no emblematic and publicly identified file that exactly matches the description of your question.

The Spanish Data Protection Agency (AEPD) is the independent administrative authority responsible for ensuring compliance with data protection regulations in Spain. Its competencies are mainly defined by the Regulation (EU) 2016/679 (GDPR), the Organic Law 3/2018, on Personal Data Protection and Guarantee of Digital Rights (LOPDGDD), the Organic Law 7/2021 (criminal scope), and Royal Decree 389/2021, which approves its Statute.

In summary, the AEPD acts as the national supervisory authority of the GDPR, with functions of supervision, guidance, complaint resolution, sanctioning power, cooperation with other European authorities, and promotion of a privacy culture.

1. Supervision and control functions

Following the GDPR (particularly its Articles 57 and 58) and the LOPDGDD (Title VII), the AEPD must:

• Monitor and enforce data protection regulations, both the GDPR and the LOPDGDD and other applicable sectoral rules.
• Control the lawfulness of processing carried out by controllers and processors, public and private, within its competence.
• Promote proactive accountability, ensuring that measures such as impact assessments, privacy by design and by default, activity records, or adequate security measures are applied.
• Supervise key figures of the European model, such as data protection officers (DPOs), whose designation must be notified to the Agency and about whom it maintains a public register.

2. Investigative powers

The GDPR requires the supervisory authority to have effective investigative powers, which the AEPD exercises through:

• Prior investigative actions and formal procedures to verify possible breaches of the regulations.
• Requests for information from controllers and processors, including Public Administrations.
• Inspections and audits, including the possibility to access facilities, systems, and equipment under legally provided terms.
• Adoption of provisional measures, such as temporary data blocking, when necessary to prevent greater harm to individuals' rights.

3. Corrective and sanctioning powers

The AEPD exercises broad corrective and sanctioning powers, consistent with the GDPR and the LOPDGDD:

• Order adaptation or cessation of processing, impose specific corrective measures, and set deadlines for compliance.
• Issue warnings when appropriate, especially in less serious cases or when a formal warning suffices.
• Impose administrative sanctions (fines) under the terms established by the GDPR and developed by the LOPDGDD, graduated according to severity, nature of the infringement, and other criteria.
• Agree to dismiss proceedings or declare their expiration when legal requirements are met.

4. Handling complaints and defending rights

A central block of competencies relates to the protection of data subjects' rights:

• Process complaints from individuals who consider their requests to exercise rights (access, rectification, erasure, restriction, portability, or objection) have not been addressed or who report possible non-compliance.
• Resolve these procedures according to the regime provided in the GDPR and developed in Title VIII of the LOPDGDD, guaranteeing rights of defense and hearing.
• Establish mandatory complaint submission models, which must be published in the Official State Gazette and on the Agency's electronic headquarters.

5. Advisory, regulatory, and guidance functions

The AEPD also plays a role of guidance and advice:

• Issue reports mandatory or optional on regulatory projects and administrative actions affecting personal data processing.
• Approve circulars, instructions, and interpretative guides within the framework of its Statute (Royal Decree 389/2021), which guide the application of the regulations.
• Inform and advise Parliament, Government, other authorities, and controllers and processors about their obligations.
• Promote and supervise self-regulation mechanisms, codes of conduct, and certification schemes in data protection.

6. National and European cooperation

As a supervisory authority in the GDPR system, the AEPD:

• Acts as lead or concerned supervisory authority in cross-border processing, applying the consistency and one-stop-shop mechanisms provided in the GDPR.
• Represents Spanish data protection authorities before the European Data Protection Board, channeling communications and participating in binding decisions.
• Cooperates with regional data protection authorities and authorities of other Member States, exchanging information and providing mutual assistance.

7. Promotion, awareness, and specific areas

Finally, the regulations assign the AEPD functions of:

• Promoting a culture of data protection and social awareness, with special attention to vulnerable groups such as minors, through programs, awards, and dissemination initiatives.
• Participation in specific areas such as data processing for criminal purposes (Organic Law 7/2021) and electronic communications services, in connection with ePrivacy regulations.

Overall, these competencies position the AEPD as a key piece of the Spanish and European data protection system, combining functions of oversight, correction, rights protection, advice, and promotion to effectively guarantee this fundamental right.

In Spain, the obligations to notify personal data breaches are based on Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018, on Personal Data Protection and Guarantee of Digital Rights (LOPDGDD), complemented in certain sectors (telecommunications, essential service operators, public sector) by specific regulations.

General GDPR‑LOPDGDD framework

Although the text of the GDPR is not reproduced in the excerpts, the LOPDGDD expressly refers to its Articles 33 and 34 to define the notification and documentation obligations for security breaches. From the cited passages of the LOPDGDD, these basic requirements emerge:

• Notification to the supervisory authority: the LOPDGDD classifies as an infringement (sanctioning articles referring to Article 33 of the GDPR) the “incomplete, late, or defective notification to the data protection authority of information related to a personal data security breach”. This implies that the controller must:
  • Notify the security breach to the Spanish Data Protection Agency (AEPD) or, where appropriate, to the competent regional authority.
  • Do so promptly, without unjustified delays, and complying with the minimum content required by the GDPR.
• Communication to affected individuals when there is a high risk: the law considers it an infringement the “failure to communicate to the data subject a security breach that entails a high risk to the rights and freedoms of the data subjects”, referring to Article 34 of the GDPR. Therefore:
  • If the breach generates a high risk to the rights and freedoms of individuals, the controller must communicate it directly to the affected individuals, using clear and simple language.
  • The communication must explain the nature of the breach and the measures taken or proposed to mitigate its effects.
• Internal documentation of breaches: the LOPDGDD sanctions the “failure to document any security breach, as required by Article 33.5 of Regulation (EU) 2016/679”. This means that:
  • Every company must keep an internal record of security breaches, including data such as facts, effects, measures taken, and justification of whether notification was made to the AEPD and the affected individuals.
  • This record must be available to the supervisory authority in case of inspection.

Additionally, the LOPDGDD classifies various infringements of the GDPR, including those related to data breaches, as minor, serious, and very serious, and provides for a regime of economic sanctions and other corrective measures. The excerpts show that the law sets limitation periods for sanctions between one and three years, depending on their amount, reflecting the importance given to compliance with these obligations.

Requirements and exceptions in the telecommunications sector

For operators of publicly available electronic communications services, Law 11/2022, General Telecommunications Law, establishes specific additional obligations:

• Notification of personal data breach:
  • If there is a personal data breach, the operator must notify the AEPD without undue delay of the breach.
  • If the breach could negatively affect the privacy or personal data of a subscriber or individual, it must also notify the breach to the subscriber or individual, likewise without undue delay.
• Exception when robust technological measures exist:
  • It is not necessary to communicate to the subscriber or individual if the operator proves to the AEPD that it has applied appropriate technological protection measures on the affected data, making them unintelligible to unauthorized persons (e.g., strong encryption).
  • Nevertheless, the AEPD may require the operator to communicate the breach to the affected individuals if, after assessing possible adverse effects, it deems it necessary.
• Notification of network or service security incidents:
  • Operators supplying public networks or providing publicly available electronic communications services must notify the Ministry of Economic Affairs and Digital Transformation of security incidents that have a significant impact on supply.
  • To assess that impact, factors such as the number of users affected, incident duration, geographic area affected, degree of service impact, and impact on economic and social activities are considered.

Essential service operators and public sector

Royal Decree 43/2021, which develops Royal Decree-law 12/2018 on the security of networks and information systems, and Royal Decree 311/2022, regulating the National Security Framework (ENS), impose reinforced obligations on:

• Essential service operators and digital service providers: must notify relevant cyber incidents through the National Platform for Notification and Monitoring of Cyber Incidents, following impact and danger levels set in the National Instruction on notification and management of cyber incidents.
• Public administrations and their public sector: the ENS requires formalized incident management, integrating personal data protection and information gathering to assess the incident management system's behavior, in coordination with the Technical Security Instruction on Security Incident Notification.

In summary, any company processing personal data in Spain must (i) detect and assess the breach, (ii) notify it to the AEPD when appropriate, (iii) communicate it to affected individuals if it entails high risk, (iv) document it internally, and (v) comply, where applicable, with additional sectoral obligations (telecommunications, essential operators, public sector), under the threat of significant sanctions if these requirements are not met.