Agentic AI and data protection: the risks and measures the Spanish Data Protection Agency points to
Artificial intelligence agents do not just answer: they break down tasks, connect to other services and act. In February 2026 the Spanish Data Protection Agency published a guide on their risks for personal data. We summarise what matters to a firm considering using them.
After the assistants that draft and summarise comes a new generation of tools: artificial intelligence agents, able to carry out tasks by themselves. On 18 February 2026 the Spanish Data Protection Agency devoted guidance to them, set out in the document "Agentic artificial intelligence from the data protection perspective", whose version 1.2 is dated February 2026.
We have already summarised the Agency's guidance on generative AI in the article on generative AI and data protection. This guide goes a step further.
What an AI agent is
The document defines the AI agent as an artificial intelligence system that uses language models to achieve a goal. According to the Agency, these agents can:
- Break complex tasks down into steps.
- Perceive their environment through programming interfaces and other channels.
- Act on external services.
- Keep short- and long-term memory.
At a firm, an agent could, for example, review email, search documentation in the case management system and prepare a reply. That is its usefulness and also its risk.
The risks the Agency identifies
Among the risks to data protection, the document points to:
- The involvement of more actors than the original controllers and processors.
- The widening of data categories and profiling.
- The processing of data of more people, including unforeseen third parties.
- Less transparency of the processing.
- Data retention in more systems and parties.
- The emergence of new purposes.
- Automated actions with effects on people.
- The risk of breaching the principles of minimisation, limitation and accuracy.
For a firm, point 3 is especially sensitive: case files contain data of opposing parties, witnesses and third parties who have never had any relationship with the firm.
The vulnerabilities
The document groups the vulnerabilities into four areas: interaction with the environment, because of data access and communications with external services; service integration, because of dependence on providers and the ease of deployment by unqualified users; memory, because of poor compartmentalisation and logs that can become a source of excessive surveillance; and autonomy, because of lack of transparency, automation bias, chained errors and excessive permissions.
Among the threats it expressly cites prompt injection and unlawful access to the agent's memory.
The measures it proposes
| Area | Measures, according to the AEPD |
|---|---|
| Governance | Assume the possibility of failure, involve the data protection officer and integrate the agent into the organisation's governance |
| Continuous assessment | Metrics, benchmark tests, contract review, caution, explainability and human intervention |
| Minimisation | Access policies, data cataloguing, filtering of flows and control of profiling |
| Memory | Compartmentalise, purge, limit logs and set strict retention periods, or switch it off |
| Automation | Decide the degree of autonomy, limit tools, whitelists of services, checkpoints, reversibility and the four-eyes principle |
| Design | Documentation, traceability, testing, identity and privilege management, isolated environments and cut-off mechanisms |
What it means for a firm
Start with minimum autonomy. The Agency proposes deciding the degree of autonomy. For a firm, the prudent course is that no agent sends anything to a client or a court without prior review by a lawyer.
Limit access. An agent with access to every case file multiplies the risk. Access policies and memory compartmentalisation are the practical translation of professional secrecy.
Review contracts. The Agency includes contract review among the continuous assessment measures. With an agent, more providers and services are involved, and each must be covered.
Train. Among the other measures, the document mentions literacy. It fits with the continuous training principle of the Spanish Legal Profession's AI decalogue.
For the lawyer who practises alone, these measures add to the basic data protection obligations we review in the guide to data protection for the self-employed lawyer. More analysis in Legal AI.
Fuentes
- AEPD. Inteligencia artificial agéntica desde la perspectiva de protección de datos, versión 1.2, febrero de 2026 (PDF). Accessed 18 October 2026.
- AEPD. La Agencia publica unas orientaciones sobre Inteligencia Artificial agéntica desde la perspectiva de protección de datos (18 de febrero de 2026). Accessed 18 October 2026.
The specific data in this article come from the official sources cited.
