Digital Trust PractitionersAssociation of Digital Trust Practitioners · TrustPractitioners.org
JoinJoin
REGULATORY WATCH BRIEF Moderate 46 ⚖️ Enforcement Action published

Spanish Data Protection Agency issues warning to company over AI-driven resume screening

The AEPD’s warning highlights GDPR compliance requirements for AI use in recruitment, emphasizing transparency, human control, and risk assessment.

ADTP Regulatory Watch · September 23, 2026 · Agencia Española de Protección de Datos (AEPD)
ImpactModerate 46
Type⚖️ Enforcement Action
Statuspublished enacted, check the effective date
JurisdictionEU-ES

What happened

On 23 September 2026 the AEPD sent a formal warning to a company planning to use an AI tool for analysing CVs and assigning scores. The agency stresses that data protection must be built in from the start, including DPIA for high‑risk processing, transparency to candidates, and effective human oversight. The warning cites GDPR provisions on automated decision‑making and the right to not be subject to solely automated decisions.

Why it matters for trust and compliance

  • Its status is published. It is enacted but may not be in force yet. Check the effective date before planning around it.
  • The AEPD’s warning highlights GDPR compliance requirements for AI use in recruitment, emphasizing transparency, human control, and risk assessment.

Who is affected

technology controller

Recommended actions

  1. Check that privacy notices describe the practices this addresses.
  2. Revisit retention schedules and data minimisation for the data involved.
  3. Inventory AI or automated decision systems in scope and their assessments.