The AEPD acknowledges an innovative project by CaixaBank that implements an advanced model of privacy governance aimed at meeting the challenges of artificial intelligence

• Pablo Díaz Ortiz, Data Protection Officer at CaixaBank, has been recognised for implementing an advanced model of privacy culture, supervision and advice
• The awarded work consolidates an advanced model of supervision, risk management and protection of fundamental rights

The AEPD (Spanish Data Protection Authority) has awarded a prize to CaixaBank for an innovative project in privacy governance aimed at meeting the challenges of artificial intelligence. The project was submitted by Pablo Díaz Ortiz, Data Protection Officer at the financial institution.

The bank has been recognised in the private category of the Award for the work of Data Protection Officers within the framework of the 2025 Data Protection Awards. These awards acknowledge work that fosters the dissemination and awareness of the fundamental right of personal data protection and its practical application in different areas.

The acknowledgement highlights the project Evolution of the supervision and governance of data protection aimed at meeting the new challenges of artificial intelligence and the threats to information security, which is an initiative that addresses the transformation of the CaixaBank Group's privacy model in view of the increasing use of AI systems and the rise of risks associated with information security.

The awarded work revolves around three major strategic axes: privacy risk management in the development and use of AI systems, the comprehensive modernisation of the corporate model for managing personal data breaches and the consolidation of a supervision model based on dynamic and homogenous risk, all of which is completely aligned with the General Data Protection Regulation (GDPR) and the guidelines issued by the AEPD.

Early identification and assessment

Among the most noteworthy advances is the evolution of the corporate process for the early identification and assessment of artificial intelligence initiatives, which allows anticipating the analysis of risks to fundamental rights from the very early stages of the design. 

Furthermore, the project has reinforced privacy governance by integrating the head of artificial intelligence in key data protection processes and bodies, and it has developed advanced methodologies to assess the impact of IA on fundamental rights.

Within the scope of personal data breaches, a corporate tool has been implemented that guarantees complete traceability of incidents, substantiated decision-making, immediate mitigation of risks and a reinforced monitoring of action plans throughout its entire life cycle. All of this is completed with a risk-based corporate supervision model that relies on an advanced methodology geared towards improving proactive accountability.

According to the AEPD, the set of actions carried out are an example of an innovative contribution in the prevention, proactivity and promotion of the protection of fundamental rights in the digital age, allowing for an effective implementation of regulatory compliance in data protection, the promotion of a culture of privacy in organisations and the training of staff.

This acknowledgement strengthens CaixaBank's commitment to fundamental rights, personal data protection, responsible innovation and the consolidation of a culture of advanced privacy across the entire organisation.