AEPD reports over 3,000 personal data breach notifications in first half of 2026

What happened

The Spanish Data Protection Agency recorded 3,027 breach notifications between January and June 2026, a 138% increase over the same period in 2025. The rise is linked to ransomware attacks, hotel reservation software providers and incidents involving a single processor affecting multiple controllers. The agency reiterates the obligations under Art. 33 GDPR to notify the authority and, where high risk, the affected individuals.

Why it matters for trust and compliance

• Its status is published. It is enacted but may not be in force yet. Check the effective date before planning around it.
• The surge in breach reports highlights growing cyber risk and reinforces the need for robust notification and preventive measures under GDPR.

Who is affected

Recommended actions

1. Revisit retention schedules and data minimisation for the data involved.
2. Map the security requirements to existing controls and close gaps.
3. Check breach-notification procedures and timelines against the requirement.