AI Agents and the DPDP Act: What Spain's First AI-Agent Breach Notification Teaches Indian SMEs

On 14 September 2026, Spain's data protection authority, the AEPD, published an account of something it had not seen before: a personal data breach that the notifying organisation attributed to an attack carried out by an AI agent. For anyone thinking about AI agents and the DPDP Act, this is a useful early warning. India's core DPDP obligations on security and breach reporting start on 13 May 2027, and the tools attackers use are changing faster than most compliance plans.

Here is what the AEPD reported, what it means under the DPDP Act, 2023 and the DPDP Rules, 2025, and what an Indian SME can do in the next six months.

What Spain's AEPD reported

The details are thin, and that is worth saying up front. The AEPD did not name the organisation, its sector, the AI model involved, or how many people were affected. No fine has been reported.

What the notification did describe, according to the AEPD's account as relayed by commentators at DLA Piper's GamingTechLaw blog and AlpacaX, is a chain of steps. An AI agent searched generic files for weaknesses, achieved a valid login, then looked for and found vulnerabilities in the application on its own. With that access it modified personal data and accessed invoices.

The AEPD drew a few lessons from it. Risk analyses should expressly consider AI-assisted or AI-executed attacks. Response times need a fresh look, because an agent works faster than a person. And credentials matter more than ever: an over-permissioned account, API key or token lets an agent move across services before anyone spots unusual behaviour. The Agency was also careful to say that one notification is not a trend.

Fair enough. But the mechanics are not exotic: a valid login, an unpatched app, and nobody watching the logs closely enough.

AI agents and the DPDP Act: where the obligations bite

The DPDP Act does not have a separate chapter on artificial intelligence. If personal data is processed digitally, the Act applies, whoever or whatever does the processing. India Briefing made the same point in a 6 November 2026 analysis of AI use under the DPDP Act and the IT Act.

Section 8(5): reasonable security safeguards. A Data Fiduciary must protect personal data in its possession or control, including data handled by its Data Processors, by taking reasonable security safeguards to prevent a breach. Rule 6 of the DPDP Rules spells out the minimum: encryption, obfuscation or masking where appropriate; access controls over computer resources; visibility through logs and monitoring so unauthorised access can be detected and investigated; backups and measures to keep processing going after an incident; and keeping relevant logs for at least one year.

Section 8(6) and Rule 7: breach intimation. If a breach happens, you must inform each affected Data Principal and the Data Protection Board without delay. Rule 7 then asks for a detailed report to the Board within 72 hours of becoming aware of the breach, covering what happened, the likely impact, the steps taken and the measures to stop it happening again.

The penalty schedule. Failure to take reasonable security safeguards can attract a penalty of up to ₹250 crore. Failure to notify the Board or affected individuals of a breach can attract up to ₹200 crore. The Board decides the actual figure based on factors in Section 33, including gravity, duration and mitigation.

There is no "the attacker used AI" defence. If AI-assisted attacks are a known risk, the Board can fairly ask whether your safeguards accounted for them.

Your own AI tools are part of the picture

Many Indian businesses now plug AI tools into their own systems: website chatbots, assistants connected to the CRM, coding agents with database access, or staff pasting customer records into a public chatbot. An AI integration usually runs on an API key or a service account. If that key has read and write access to your whole customer table, it is exactly the kind of over-permissioned credential an attacker would want, and the kind an AI tool could misuse through a bug or a prompt-injection trick.

Under the DPDP Act, an outside AI provider processing personal data on your behalf is generally a Data Processor. You remain responsible for that data. You need a valid contract with the provider under Section 8(2), and you still answer for security under Section 8(5). If you are unsure how your vendor contracts measure up, a privacy impact assessment is a sensible place to start.

Six practical steps before May 2027

1. Make an inventory of AI tools that touch personal data. Include the free tools staff use informally.
2. Cut credentials down to size. Give every AI integration its own key, scoped to the minimum data it needs, with read-only access where possible. Rotate keys on a schedule and revoke them when a pilot ends.
3. Turn on logging, and actually read it. Rule 6 expects logs that let you detect and investigate unauthorised access. Set alerts for unusual volumes, such as a single account pulling thousands of records at 3 a.m.
4. Add AI-assisted attacks to your risk register. Patch internet-facing applications quickly and put multi-factor authentication on every admin login.
5. Rehearse your 72-hour breach response. Run a tabletop exercise where the scenario is an automated intrusion. Who decides it is a breach? Who drafts the notice to the Board and to customers? Write the answers down.
6. Write a short AI use policy for staff. Say which tools are approved, what data may never be entered into them, and who to ask.

If you want a structured way to check where you stand, our free DPDP compliance checklist covers security safeguards and breach readiness alongside notice and consent. For a deeper review, see our DPDP Act compliance services.

Where this leaves Indian businesses

The timeline is clear. Consent Manager registration opened on 13 November 2026. The obligations that matter here, security safeguards and breach intimation, apply from 13 May 2027. That leaves about six months.

Spain's case is one notification with few public details. But regulators are already asking how AI changes breach risk, and fixing credentials, logging and response plans protects you against AI-driven attacks and ordinary ones alike.

This article is general guidance for Indian businesses and is not legal advice. Please consult a qualified professional about your specific situation.

Want to know how ready your business is? Start with our DPDP compliance checklist, or talk to the Primitra team about an AI and data security review.