Skip to content
Roles and authorities

AEPD (Spanish Data Protection Agency)

In a nutshell

The independent authority that enforces the GDPR in Spain, including the use of personal data in AI systems.

The AEPD is Spain's data protection supervisory authority. It enforces the GDPR and Organic Law 3/2018 (LOPDGDD), handles complaints, investigates and imposes penalties, and publishes guidance.

Its role in AI is key even though the AI Act has its own authority: any AI system processing personal data (training, use with customers or employees, automated decisions) is subject to the GDPR and therefore to the AEPD. It has published guidance on AI, on data protection impact assessments (DPIA) and on agentic AI.

In practice, a company using AI in Spain faces two fronts: AESIA for the AI Act and the AEPD for personal data. Preparing for one helps with the other.

Reference: RGPD; LOPDGDD (LO 3/2018)

Related terms

AESIA (Spanish AI Supervisory Agency)DPIA (Data Protection Impact Assessment)Automated decision-making (GDPR Art. 22)
What applies to you?

Take the free assessment and find out in a few minutes which obligations your company has and where to start.

Take the free assessment

← Back to the glossaryUpdated: October 2026 · Informational content, not legal advice.