Spanish DPA to Host Data Protection Session at XX STIC Cybersecurity Conference in Madrid

Key Takeaways

• The AEPD announced it will run a dedicated data protection room on November 24, 2026, on the first day of the XX STIC Conference in Madrid.
• The announcement is not a new rule, but it signals that the regulator wants privacy integrated into cybersecurity, AI, and quantum risk management from the earliest design stages.
• Compliance teams should treat it as a supervisory-priority indicator and an opportunity to engage.

Deep Dive

This press release is informational and creates no new legal obligations. It does show where the AEPD is focusing its attention. The Agency's participation places personal data protection and individual rights within the debate on technological transformation and cybersecurity, at a forum that brings together public administrations, the Armed Forces, Security Forces and Corps, industry, universities, and researchers. The conference is organized by the National Cryptologic Centre (CCN-CNI), the Joint Cyberspace Command (MCCE), and RootedCON, and this year carries the slogan "Offensive AI and Quantum Threat: Towards a New Cybersecurity."

The substantive message is the AEPD's stated position that increasingly intensive processing of personal data, combined with new technological capabilities, makes it necessary to integrate privacy and data protection into risk analysis and management from the earliest stages of designing products, services, and systems. This is consistent with the data protection by design and by default principle (GDPR Article 25) and with security-of-processing and risk-based requirements (GDPR Article 32). The release does not introduce new requirements, but it indicates that the AEPD views offensive AI use and quantum threats as emerging risks to personal data. Institutions should expect these themes to inform future guidance, inspections, and enforcement priorities.

Key dates: the XX STIC Conference runs from November 24 to 27, 2026, at Kinépolis Ciudad de la Imagen in Madrid. The AEPD-led data protection session takes place on November 24. No compliance deadlines are attached. The agenda and any materials published by the AEPD afterward are the items to monitor.

Recommended actions: - Assign a privacy or compliance representative to attend, or monitor, the November 24 session and capture any statements on regulatory expectations. - Confirm that DPIAs and security risk assessments explicitly address AI-enabled attacks and the use of AI in processing. - Check that privacy-by-design checkpoints are embedded in product, service, and system development lifecycles. - Begin assessing the quantum threat to encryption and long-lived personal data, including the "harvest now, decrypt later" risk, and coordinate with information security teams. - Monitor AEPD publications after the event for guidance or position papers.

Risk implications are low in the near term because there is no binding change. Over the medium term, there is moderate strategic relevance. Organizations that cannot demonstrate integrated privacy and cybersecurity risk management for AI and emerging technologies may face greater supervisory scrutiny in Spain, especially after any security incident or personal data breach.

Source: Spanish Data Protection Agency (Agencia Española de Protección de Datos)