AEPD 2026 DPO Award: €3,000 for Data Protection Officers

Key data

Data Protection Officers from public and private entities have until October 15, 2026 to submit their application for the DPO Award, which is called annually by the Spanish Data Protection Authority (AEPD). The call, published in the BOE on July 20, 2026 through the Resolution of July 8, 2026, establishes a total economic allocation of up to €9,000, distributed among awards and runner-up prizes in the two categories.

This is not merely an honorary recognition: the award has real economic allocation, evaluates specific projects, and is resolved in competitive concurrence. For any organization with an active DPO, this call is an opportunity for visibility and institutional recognition.

What does this regulation establish?

The resolution approves the regulatory bases and calls the Award for the work of the Data Protection Officer for the year 2026. It is structured in two independent categories:

Applications must be submitted with the following documents:

• Project description report: maximum 20 pages.
• Executive summary: maximum 3 pages.

Projects must be innovative and have been executed or be in the implementation phase during 2026. Selection is made under competitive concurrence.

The jury has two additional options:

• Declare the award void in any of the categories if no applications of sufficient quality are submitted.
• Award the prize ex aequo, in which case the allocation is divided: €2,250 per winning application.

The maximum budget for the call is €9,000, charged to budget application 13.301.135M.48.

Economic and operational impact

For organizations, the direct impact is limited: it generates no additional cost or obligation. However, it has relevant operational and reputation implications:

• Institutional recognition: winning or being a finalist in this award means visibility before the AEPD and the sector, which can strengthen the DPO's position within the organization.
• Real economic allocation: €3,000 for the winner or €2,250 in case of ex aequo. The runner-up award provides an additional €1,500.
• Cost of participation: the preparation of the report (max. 20 pages) and executive summary (max. 3 pages) requires internal dedication, but does not involve fees or payments.
• Tight deadline: from July 21 to October 15, 2026, which leaves approximately 12 weeks to prepare the application.

Who does it affect?

This call directly affects:

• Data Protection Officers registered in the official AEPD Register, from both public and private entities.
• Organizations in the public sector (administrations, bodies, public entities) that have a designated and registered DPO.
• Companies and entities in the private sector with a DPO registered in the AEPD Register.
• Compliance Officers and executives who manage the data protection function in their organizations.

Essential requirement: the candidate DPO must be registered in the official AEPD Register at the time of submitting the application.

Practical example

A DPO from a technology company in the private sector, registered in the AEPD Register, has led during 2026 the implementation of an automated system for managing data subjects' rights (access, rectification, deletion) that has reduced response time from 30 days to 48 hours.

This professional can submit their application to the private sector category with:

• A report of up to 20 pages describing the project, its innovative nature, the results obtained, and the impact on GDPR compliance.
• An executive summary of up to 3 pages with the key points of the project.

If they win as sole winner, they will receive €3,000. If the jury decides to award the prize ex aequo with another candidate, they will receive €2,250. If they are a finalist with runner-up award, the allocation is €1,500. The deadline for submitting this application ends on October 15, 2026.

What should companies do now?

1. Verify the DPO's registration in the official AEPD Register: it is the prior and essential requirement to be able to participate. Without registration, the application is not valid.
2. Identify candidate projects: review what data protection initiatives have been executed or are being implemented in 2026 and have a demonstrable innovative component.
3. Allocate resources for preparing the application: the report (max. 20 pages) and executive summary (max. 3 pages) require writing time and internal review.
4. Plan the calendar: the deadline closes on October 15, 2026. With 12 weeks available from publication, it is advisable to start preparation in August to have a margin for review.
5. Determine the correct category: public or private sector, depending on the legal nature of the candidate DPO's entity.
6. Consult the complete regulatory bases in the BOE (BOE-A-2026-15848) to verify the evaluation criteria and submission procedure.

Official source

Check complete regulation in official source

Notice: This article is for informational purposes only and does not constitute legal advice. For specific decisions, consult a qualified professional. Source: https://www.boe.es/diario_boe/txt.php?id=BOE-A-2026-15848