In short
The AEPD has just published a ten-point guide for delegating tasks to AI assistants and agents. We summarise its five questions, why permissions matter more than instructions and what whoever gives you the agent should offer.
In this article
In short
Before letting an AI assistant or agent act for you, the Spanish Data Protection Agency (AEPD) suggests asking yourself five questions: what it can see, what it can remember, what it can do on your behalf, where it sends your data and whether it affects anyone else. The idea: the agent prepares and you approve.
What has the AEPD published?
On 27 October 2026 the AEPD published “Asistentes y agentes de IA: Decálogo para personas usuarias” (AI assistants and agents: a ten-point guide for users), with this motto: let AI act for you, not without you. As it explains in its press release, when an assistant only answers, a mistake is a wrong answer; when it acts, it is an email sent or a purchase made in your name.
It cites a real case: someone clicked “always allow” when asking their agent to sell an item. The agent closed the sale and gave their address to the buyer, who turned up at their home.
What are the five questions?
- What can it see? Reading is not the same as sending or deleting. Give it a folder or a calendar, not your whole account.
- What can it remember? Memory builds a profile of your routines. To delete it, use the service's controls; asking it in the chat isn't enough.
- What can it do on your behalf? Turn on prior confirmation for sending, paying, sharing or deleting, and actually read what you approve.
- Where does it send your data? Choose services where you know who provides them, that let you exercise your rights in the EU and that say whether they train on your data.
- Does it affect anyone else? Your email contains data about clients and colleagues who didn't choose to talk to that AI.
Why isn't telling the agent what not to do enough?
Because a website, an email or a PDF can carry hidden instructions, even in white text on a white background. Since nothing removes that risk, the best defence according to the AEPD is to limit what the agent can do if it is tricked. “Summarise my new emails and reply to all” combines exactly what it advises against: content from strangers, access to private material and the ability to act.
What if you use it at work?
The AEPD asks you to use only the assistants your organisation authorises and not to connect your work email to a personal AI account. Client data remains the company's responsibility.
In a PagerDuty survey of 1,250 office employees at large companies, 88% had shared work information with public tools such as ChatGPT, Claude or Gemini, and 34% had entered client data. For an AI First company, the answer is not to ban it, but to provide an authorised tool with clear permissions.
What does the AEPD ask of whoever offers the agent?
That responsibility doesn't fall only on the user: the provider should offer permissions that distinguish querying from acting, confirmation for important actions, a history of what the agent has done, an immediate way to stop it, memory management and deletion, clear information about whether your data is used for training and a simple way to exercise your rights.
At Traiker we treat that list as a roadmap. Each person or company has their own encrypted database. Your data is yours: we don't train models on it or process it. Your assistants query it through MCP only when you connect them, and we're opening access gradually in the beta. To go further, read who owns your agent's memory and why you shouldn't leave MCP keys in a file.
Frequently asked questions
Is the AEPD's ten-point guide mandatory?
No. They are recommendations, not a new regulation. But the GDPR does apply to the data the agent handles.
What do I do if my agent has already done something I didn't want?
Stop it, disconnect the affected applications, change passwords, review what has been sent and notify anyone who could be affected.
Does deleting a chat delete what the assistant remembers?
Not necessarily. According to the AEPD, deleting a chat, deleting a memory and disconnecting an application don't have the same effect.
If you want your assistants to work with your data without giving them a blank cheque, sign up for the Traiker beta.
