Key data
| Regulation | Resolution of July 15, 2026, from the AEPD, publishing the Collaboration Agreement with the University of A Coruña for the celebration of the course "Data protection in companies and organizations" |
|---|---|
| Publication | July 21, 2026 |
| Entry into force | July 21, 2026 |
| Affected parties | Companies, DPOs, compliance officers and privacy professionals |
| Category | Data Protection |
| Year | 2026 |
| Maximum AEPD contribution | 5,000 euros |
| Maximum payment deadline | December 31, 2026 |
| Agreement duration | Maximum 6 months |
| Academic organizing entity | Universidade da Coruña (UDC) / Fundación UDC (FUAC) |
| Official source | BOE-A-2026-15933 |
Privacy is no longer a bureaucratic formality: it is a strategic asset. That is the central message of the agreement formalized between the Spanish Data Protection Authority (AEPD) and the Universidade da Coruña (UDC), published in the BOE on July 21, 2026 (reference BOE-A-2026-15933). The agreement launches a high-level course aimed at companies and organizations that need to raise their maturity in data protection beyond minimum GDPR compliance.
What does this regulation establish?
The agreement precisely defines the roles of each party and the economic conditions of the agreement:
| Element | Detail |
|---|---|
| Full course name | "Data protection in companies and organizations: corporate governance, risk management and compliance in complex technological environments" |
| UDC role | Academic organizing entity: provides facilities and manages the economic part through its Foundation (FUAC) |
| AEPD role | Assumes academic direction of the course |
| AEPD financing | Up to 5,000 euros to cover speaker fees, travel and accommodation not financed by tuition |
| Economic management | In charge of the Foundation of the Universidade da Coruña (FUAC) |
| Agreement deadline | Maximum 6 months from signature |
| Payment deadline | Before December 31, 2026 |
| Strategic objective | Transform the perception of privacy: from bureaucratic formality to strategic asset of corporate governance |
The structure of the agreement is clear: UDC provides the space and economic logistics; AEPD provides the content and part of the financing. Tuition income is first used to cover course costs, and only the excess not covered by tuition is financed by the AEPD, with a limit of 5,000 euros.
Economic and operational impact
For companies, the impact of this agreement is not direct in the form of imposed obligation or cost, but in the form of access to high-level training with institutional backing from the AEPD. These are the most relevant operational effects:
- Access to specialized training: The course covers corporate governance, risk management and compliance in complex technological environments, critical areas for any company handling personal data at scale.
- Partially subsidized cost: The AEPD finances up to 5,000 euros of course costs (speaker fees, travel and accommodation), which reduces the final tuition price for attendees.
- Short time window: The agreement has a maximum duration of 6 months and payment must be made before December 31, 2026, indicating that the course will likely be held in the second half of 2026.
- Regulatory signal: The fact that the AEPD directs the course academically is an unequivocal signal of where regulatory requirements are heading: integration of privacy in corporate governance, not just in the legal department.
Who does it affect?
- Data Protection Officers (DPOs) who need to update their training with AEPD backing.
- Compliance officers in companies with intensive personal data processing.
- Executives and CFOs who want to understand privacy as a lever for corporate governance and risk management.
- Information security officers (CISOs) in complex technological environments.
- Legal advisors and consultants specialized in privacy and data protection.
- Companies of any size that process personal data and want to raise their maturity level beyond minimum GDPR compliance.
Practical example
A mid-sized technology company with an internal DPO and a three-person compliance team decides to enroll its DPO and security officer in the course. Since it is co-financed by the AEPD with up to 5,000 euros to cover speaker costs, the tuition price is lower than an equivalent program in the private market.
Furthermore, the fact that academic direction falls to the AEPD guarantees that the content reflects exactly what the regulator expects from companies: not only formal GDPR compliance, but the integration of privacy in corporate governance and risk management. For the DPO, it means training with direct backing from the regulator, which strengthens their internal position and credibility with clients and auditors.
The timeline is tight: given that the agreement lasts a maximum of 6 months from signature (July 2026) and payment must be executed before December 31, 2026, the course will likely be held between September and November 2026.
What should companies do now?
- Identify if your DPO or compliance officer needs updated training in privacy corporate governance and risk management in complex technological environments.
- Follow communications from the AEPD and UDC to learn the exact dates, tuition price and course registration process, which will be published soon given the maximum 6-month agreement deadline.
- Evaluate the training opportunity considering that the AEPD assumes academic direction, making this course a direct reference for the regulator's expectations.
- Review your data protection training budget for the second half of 2026 and include this option as a priority over alternatives without institutional backing.
- Take advantage of the regulatory signal: if your company still treats privacy as a legal formality and not as a strategic asset, this is the time to initiate that change in approach internally.
Frequently asked questions
How much does the AEPD finance in this data protection course?
The AEPD contributes a maximum of 5,000 euros to cover speaker fees, travel and accommodation not covered by tuition income. That is, tuition is applied first and the AEPD covers the deficit up to that limit.
When will the AEPD-UDC data protection course for companies be held?
The agreement has a maximum duration of 6 months from its signature (July 2026) and payment must be made before December 31, 2026. This places the course likely between September and November 2026. The exact dates will be published by the AEPD and UDC on their official channels.
Who directs the course academically and what guarantee does that offer?
Academic direction falls to the AEPD, which means the content directly reflects the expectations of the Spanish regulator in data protection. The Universidade da Coruña acts as the organizing entity, providing facilities and managing the economic part through its Foundation (FUAC).
What professional profile is this course aimed at?
The course is aimed at DPOs, compliance officers, executives, CISOs and legal advisors of companies and organizations that process personal data. The objective is to raise privacy maturity beyond minimum GDPR compliance, integrating it into corporate governance and risk management.
Where will the AEPD-UDC data protection course be held?
The Universidade da Coruña acts as the academic organizing entity and provides its facilities for the course, so it is expected to take place in A Coruña. Economic management is handled by the Foundation of the Universidade da Coruña (FUAC).
Official source
Consult complete regulation at official source
Disclaimer: This article is for informational purposes only and does not constitute legal advice. For specific decisions, consult a qualified professional. Source: https://www.boe.es/diario_boe/txt.php?id=BOE-A-2026-15933