The Spanish DPA more than doubled its breach proceedings — and put the spotlight on companies' controls

What the 2025 Annual Report teaches organisations that connect CRM, ERP, AI agents and automations — read carefully, number by number.

From 30 to 77

On 6 May 2026 the Spanish Data Protection Agency (AEPD) presented its Annual Report for 2025. One table on page 93 deserves to be read slowly: sanctioning or warning proceedings related to personal data breaches went from 30 to 77 in a single year. The fines attached to that set reached €19.84 million — more than 40% of everything the Agency imposed in 2025.

For a company that connects its CRM, its ERP and its customer-service tools through automations, the practical question is not whether these numbers are alarming. It is what the company could prove, today, about the accesses and operations that run against its data — and who, or what, performs them.

Reading the numbers correctly

A number this striking invites shortcuts, and most of them are wrong. The 77 are proceedings, not 77 fines and not 77 companies: the table groups sanctions and warnings. €48.1 million is the amount of fines imposed in final resolutions, not money collected. And the year of resolution is not the year of the incident — the two cases examined below concern events from 2022 and 2023, so 2025's figures also reflect investigative work started long before.

Two more things the Report does not say. It does not show that breaches themselves grew 157% — it shows that supervisory activity around them did. And it does not attribute the increase to AI: the causal link between agents and sanctions is not quantified anywhere in the document. What can be defended is narrower and more useful: in 2025 the Agency multiplied by 2.57 the number of proceedings in which it examined how a company protected personal data and how it reacted when that protection failed.

The problem lives in ordinary systems

The most useful page of the Report for a CTO is not the fines table. It is page 30, where the Agency describes the kind of incident it saw: breaches at processors and CRM platforms, accesses with compromised credentials, wrong recipients and exposed data. None of that is exotic. It is what happens in the seams between the systems a mid-sized company already runs.

Each integration widens two things at once: the routes personal data can travel, and the number of identities able to act on it. A service account created to sync contacts ends up used by four other processes. A change of vendor leaves a token alive. A correctly built automation starts sending data to the wrong destination the day someone edits its configuration. These mechanisms deserve control whether or not an AI model is involved — and multi-factor authentication on the console, useful as it is for humans, does nothing to turn a static API key into a credential restricted by operation.

An inspection that starts with one complaint can end up examining the design of a whole process. An approved policy and an applied policy are two different pieces of evidence.

Two resolutions, two lessons

Two published resolutions give the numbers a face. Neither company is described here as using AI agents; the lessons are about controls, not about technology.

• PS/00128/2024 · Carrefour · €3.2M

  Authenticating a request is not the same as knowing the access is legitimate.

  Several incidents in 2022 and 2023; 118,895 unique accounts considered compromised, most likely through credential stuffing with leaked username-password pairs. The Agency imposed €2M under Art. 5.1.f (confidentiality), €1M under Art. 32 (security) and €200,000 under Art. 34 (communication to those affected), and ordered proof that the affected people had been informed. The technical lesson: a valid login told the system nothing about who was really behind it — and reconstructing the scope of the incident, then communicating it properly, was judged as harshly as the breach itself.

• PS/00373/2025 · Sprinter · €2.6M → €1.56M

  Knowing your current configuration does not prove which one was in force when it mattered.

  A breach notified in October 2023. Among the documents the company submitted were spreadsheets with no date and no signature; the resolution states it could not determine whether certain controls had been put in place before or after the incident. The fine was set at €2.6M and reduced by 40% for acknowledgement of responsibility and voluntary payment, to €1.56M. The lesson: the control may well have existed — but a control you cannot date is a control you cannot prove. A policy history with activation date, approver and deployment evidence would have been worth more than any reconstruction after the fact.

What the 72 hours really mean

A breach under Art. 4.12 GDPR does not require a public leak. Sending payroll to the wrong list, mixing two clients' records, deleting data needed to deliver a service, or exposing files through a link all qualify. Once the controller becomes aware, Art. 33 asks for notification to the authority without undue delay and, where feasible, within 72 hours — unless the risk to people is unlikely. Art. 34 adds communication to those affected when the risk is high. And a processor that learns of a breach must tell the controller without undue delay, not after finishing its own investigation.

Three misreadings are worth killing. The 72 hours are not a waiting period, nor a deadline to restore every system: they run from awareness, and the notification can be completed in stages. Notifying does not trigger a sanction — the 2,765 notifications received in 2025 and the 77 proceedings are different populations, and dividing one by the other tells you nothing. And the CJEU (C-340/21) has made clear that an unauthorised access does not by itself prove the measures were inadequate; what is examined is whether they were appropriate to the case. Which is precisely why the evidence of what you had in place, and when, decides so much.

The agentic AI guidance of 2026

The 2025 figures say nothing about AI. The explicit link arrives in a later document: on 18 February 2026 the AEPD published its guidance on agentic AI. It reads like a checklist for anyone running autonomous processes over personal data — identity and least privilege for agents, control over delegations, credential validity, keeping the record of processing activities up to date, and traceability, together with minimisation, pseudonymisation and expiry of the logs themselves.

Two cautions. The guidance is not a certification of any product, and it does not turn every technology it mentions into a universal obligation: the controller still selects measures appropriate to the processing. And the same controls apply to deterministic workflows — a scheduled sync that moves customer records needs identity, limits and traceability just as much. What agent autonomy adds is variability in the choice of tools and actions, which raises the bar rather than changing the subject.

We have read the guidance end to end and mapped it, measure by measure, against what a governance platform can and cannot do: The Spanish DPA's guidance on agentic AI: 76 pages that read like a specification for governing automations.

Where Kimetai fits — and where it does not

Kimetai is designed for the need this Report exposes: associate every agent and automation with an identity and an accountable owner, define which operations it may perform, decide before sensitive actions execute, and keep evidence of decisions and outcomes. Mapped onto the GDPR, that is where the contribution lies — and where its limits are.

One condition matters more than the rest. Deciding and executing are different functions. If an automation asks Kimetai whether it may export a dataset, receives a deny, and still holds a credential that lets it call the destination directly, the organisation has obtained a correct decision but not a barrier. Prevention exists only where the policy is applied at the effective point of execution — by the target system, by a controlled executor, or by an in-line gateway that holds the credentials — and where the alternative routes are closed. Every integration should say plainly which actions it controls before, which it observes after, and which fall outside.

And the audit trail is itself a processing activity. When it lets you identify an employee, a customer or a user, it needs minimisation, restricted access and a retention period tied to a purpose — a hash is not automatically anonymous, and there is no universal GDPR rule that logs must be kept for seven years. Cryptographic integrity tells you the record was not altered; it does not tell you the record was complete or the policy adequate.

Three questions to start with

1. 01Which automated processes — agents and workflows — access personal data in your company, and who answers for each one?
2. 02What, concretely, prevents any of them from acting outside its authorised scope — not what policy says, what component enforces it?
3. 03If the Agency asked tomorrow, what evidence would let you reconstruct one specific execution: identity, policy version, parameters, approval, result?

Answering them takes technology, security, operations and data protection working on the same inventory. The Report does not say a governance platform is mandatory. It says, in 77 different ways, that the companies who could not show their controls paid for it.