The AEPD received more than 3,000 data breach notifications in the first half of 2026

The Spanish Data Protection Agency (AEPD) received more than 3,000 data breach notifications in the first half of 2026, a figure that exceeds those filed in the whole of 2025 and reflects the rise in cyber incidents and other events with possible risk to people's rights and freedoms, according to the Agency's Newsletter no. 50, for November 2026.

The figure confirms a sustained trend: the duty to notify breaches under the GDPR has become a privileged window into the real state of cybersecurity in Spanish organisations, and the volume of notifications keeps growing year after year.

The context of the figure

That first-half 2026 notifications already exceed those of all of 2025 does not necessarily mean Spanish organisations suffer twice as many incidents. The sustained growth in notifications reflects a combination of factors: greater awareness among controllers of their duty to notify, a real multiplication of cyber incidents - with ransomware and impersonation as the dominant vectors in recent years - and the gradual internalisation that failing to notify a notifiable breach aggravates the controller's liability.

For professionals advising on data protection, the aggregate figure carries a compliance lesson: the security breach has ceased to be an exceptional scenario and become a statistically expectable event, shifting the focus from "whether it will happen" to "how it will be handled when it happens". Incident response plans, drills and the pre-assignment of internal responsibilities are becoming as standard as the impact assessment.

What managing a breach requires

The procedure the GDPR imposes when a breach occurs is well known, but executing it in real time remains the weak point of many organisations. The first decision is the assessment of risk to the rights and freedoms of those affected: only where risk exists must the supervisory authority be notified, in principle within 72 hours of becoming aware, and only where the risk is high must the data subjects also be informed. The second is documentation: even where the conclusion is that the breach is not notifiable, the controller must keep a record of the incident and its analysis, because the burden of proving that decision before an inspection rests with it.

The Agency has repeatedly stressed that a late or incomplete notification does not close the file: the authority may request supplementary information, and deficient handling of a breach is in itself an aggravating factor. The growing volume of notifications therefore also suggests a growing supervisory and enforcement workload for the Agency and the regional data protection authorities.

Other contents of the newsletter

Issue no. 50 of the newsletter highlights several of the Agency's work fronts. On the doctrinal side, a new legal criterion on the processing of biometric data, with which the AEPD answers a high-level strategic consultation on the use of a facial verification biometric system - an analysis we develop in this piece on facial verification and consent. On the awareness side, the ten-point guide "AI assistants and agents: let AI act for you, not without you", with advice on delegating tasks to artificial intelligence assistants without losing control over personal data, which we also analyse in detail in this article.

The newsletter also covers the second issue of the scientific journal "Privacidad, Innovacion y Tecnologia", devoted to the tenth anniversary of the GDPR and the challenges of its coexistence with rules on AI, digital services, cybersecurity and health; the call for the data protection and cybersecurity conference of 24 November, within the XX STIC Conference; the warnings issued to two local councils over video surveillance projects with automated image analysis; and the new episode of the "Las claves de..." series, devoted to neurotechnologies and neurodata.

Video surveillance with automated analysis: the warning to councils

The reference to warnings addressed to two local councils over video surveillance projects with automated image analysis deserves specific attention from municipal legal services. Adding automated analysis layers - number plate recognition, behaviour detection, counting or identification - raises the risk of the processing and requires a rigorous impact assessment, a sufficient legal basis and reinforced safeguards. That the AEPD resolves with warnings rather than financial penalties does not diminish the precedent: it sets the level of diligence the Agency expects from local administrations in these projects.

Reading for data protection officers

Three operational conclusions. First, the volume of notified breaches turns the preparation of the incident management procedure - detection, risk assessment, notification within 72 hours and communication to those affected where appropriate - into a minimum standard of diligence, not an option. Second, the criteria on biometric data and the video surveillance warnings draw a clear line: processing based on automated capture of personal data requires reinforced justification of its necessity and proportionality. Third, the ten-point guide on AI assistants shifts responsibility to corporate deployment: delegating tasks to agents does not exempt organisations from control over the data processed.

For firms advising local entities or companies with smart video surveillance systems, the newsletter offers up-to-date arguments for recommending impact assessments before procurement, not after the fact.

The Agency's institutional agenda

The newsletter also confirms the AEPD's public calendar for the coming weeks. The data protection and cybersecurity conference on 24 November, part of the XX STIC Conference, will bring together the two professional ecosystems - privacy and security - that breach management precisely connects. And the publication of the second issue of the scientific journal "Privacidad, Innovacion y Tecnologia", devoted to the tenth anniversary of the GDPR, offers up-to-date doctrine on the Regulation's coexistence with rules on artificial intelligence, digital services, cybersecurity and health, a regulatory map no adviser in the sector can handle piecemeal any longer.

The episode of the "Las claves de..." series devoted to neurotechnologies and neurodata, for its part, anticipates one of the emerging fronts of data protection: data derived from brain activity and the devices that capture it, a field in which the Agency is beginning to stake out an awareness-raising position before the regulatory debate matures.

The edition devotes space, finally, to two open awareness initiatives: the call for contributions to the third issue of the journal Privacidad, Innovacion y Tecnologia, which will focus on the relationship between the GDPR and the growing body of rules on artificial intelligence, digital services, cybersecurity and health; and the availability of the episode "Las claves de... Neurotecnologias y neurodatos", the audiovisual format with which the Agency brings emerging personal data processing to the public.

The Agency's recent activity on AI and data protection also includes its decalogue for AI assistants and agents, whose recommendations the newsletter echoes.

Frequently asked questions

How many breaches has the AEPD received in 2026?

More than 3,000 notifications in the first half, a figure exceeding those received in all of 2025, according to the Agency's Newsletter no. 50 (November 2026).

What is a personal data security breach?

Any incident causing destruction, loss, alteration, unauthorised disclosure of or access to personal data. If it entails a risk to people's rights and freedoms, it must be notified to the supervisory authority, generally within 72 hours of becoming aware.

What has the AEPD said about AI video surveillance?

It has issued warnings to two local councils over video surveillance projects with automated image analysis, according to the newsletter.

What else does the November newsletter contain?

A legal criterion on facial verification biometric data, the ten-point guide on AI assistants and agents, the second issue of the Privacidad, Innovacion y Tecnologia journal, the data protection and cybersecurity conference of 24 November (XX STIC Conference) and the neurotechnologies episode of the "Las claves de..." series.

Sources

• AEPD Newsletter no. 50, November 2026 (official document), consulted on 10 November 2026.