AI Tracker
Spain

Spain is subject to EU General Data Protection Regulation (GDPR). It has passed Organic Law 3/2018 Protection of Personal Data and guarantee of digital rights (LOPDGDD) adapting the Spanish legal system to GDPR requirements on personal data, as required. The legislation regulates the use of personal data in AI systems and grants the right to avoid being subject to automated decisions that significantly impact individuals.

The Spanish Data Protection Agency (AEDP) provides various guidelines on the AI-data interaction, including by way of compliance with the GDPR:

• Guidelines on adaptation to the GDPR for processing activities involving Artificial Intelligence from the Spanish data protection agency (AEPD) (2020), which seeks to address concerns raised within the framework of personal data protection and highlight the most relevant aspects of the AI-GDPR relationship that must be considered from the design phase and when implementing processing activities involving AI.
• Guidelines on requirements for Audits of Processing Activities Involving AI from the Spanish Data Protection Agency (AEPD) (2021), which provides an initial approach to a set of controls that could be incorporated into audits of personal data processing activities utilising components based on AI, within the framework of the Guidelines on Adaptation to the GDPR for Processing Activities Involving AI. 
• Guidelines on biometric attendance control systems from the Spanish Data Protection Agency (AEPD) (2023), which establishes the requirements and measures that must be met for the processing of personal data using biometric technology that uses AI techniques, ensuring biometric systems adequately comply with the GDPR.
• Guidance on the risks of third-party images in artificial intelligence systems (AEPD) (2026), calling for careful risk assessment and considerations of data protection obligations by AI system users and providers.
• Guidance on key data protection responsibilities for companies adopting AI-based voice transcription tools (AEPD) (2026), addressing regulatory requirements under GDPR and the EU AI Act for controllers. 
• Guidance on recommendations to protect privacy using AI tools safely, responsibly, and consciously (AEPD) (2026). 
• Guidelines on agentic AI from a data protection perspective (AEPD) (2026), providing professionals and organisations with practical guidance for their implementation. 

In addition, on 15 July 2025 the AEPD has clarified that it is already empowered to take action against artificial intelligence systems that unlawfully process personal data, even before Spain enacts its national AI law. 

The AEDP as also been active in enforcing non-compliance with Spain's data regulations:

• In December 2024, the AEPD sanctioned (AEPD (resolution no. PS-00484/2023) on 20 December 2024, La Liga Nacional de Fútbol Profesional) the National Professional Football League with a fine of €1,000,000 for infringements related to the processing of personal data at the entrances to football stadiums due to the implementation of a biometric recognition system without complying with GDPR requirements.
• GSMA Ltd, which organized the 2021 Mobile World Congress in Barcelona, was fined €200,000 in April 2023 by the AEPD for using a facial recognition system without complying with GDPR requirements. The fine was due to the company's failure to conduct the required impact assessment before processing data. It is unclear whether GSMA challenged the AEPD resolution in court. 
• Similarly, on 3 December 2024, the football club Osasuna was fined €200,000 by the Spanish Data Protection Agency (AEPD) for using a facial recognition system at the El Sadar stadium during the 2022-2023 season. The AI system allowed club members who opted in to access the stadium using AI-based facial recognition technology, while traditional access methods remained available. Osasuna plans to appeal the fine to Spain's National Court, arguing that the AEPD's decision was based on outdated facial recognition technologies and not the specific system implemented by the club. Osasuna noted that the Spanish National Intelligence Agency´s National Cryptologic Center (CCN-CNI) recommended using access control systems based on RBR biometric templates for high-security settings (also in December 2024).

In addition, the AEPD has launched an initiative on the responsible use of AI, focusing on deepfakes, and providing practical guidance for the public on the use of AI. In particular, the AEPD emphasizes the need to take into account the following aspects: (i) becoming informed about how AI works and its legal implications, bearing in mind the potential negative effects that deepfakes may have on the personal, professional, or social lives of the individuals concerned; (ii) obtaining consent whenever images or personal data of third parties are to be used; and (iii) verifying information before disseminating content that may be false or manipulated.

Copyright

• According to Spain's Intellectual Property Law (Royal Legislative Decree 1/1996), only natural persons can be reputed authors of a work, meaning works created entirely by AI are not protected unless significant creative intervention from a human concurs.
• Training of AI systems is one of the key areas where copyrights may be affected by AI systems. AI developers often intend to be covered by text and data mining exemptions. In line with the relevant EU directives, Spain’s Intellectual Property Law (Royal Legislative Decree 1/1996) allows text and data mining without authorisation for scientific research purposes by public or non-profit entities, provided copies are securely stored and not used for other purposes. It also permits text and data mining of publicly accessible content for commercial or non-commercial purposes, except where rights holders explicitly opted out by clearly indicating exclusions.
• Albeit a non-regulatory initiative, the Guidelines on Best Practices in the Use of AI (2024) issued by the Ministry of Culture aim to ensure that AI is used as a support tool for creators and cultural professionals while respecting copyrights. The guidelines stipulate that, in the hiring of creative services, human work should be prioritized, with AI only being used as a complementary tool. Additionally, for national awards on culture, it promotes the inclusion of clauses preventing the recognition of works created entirely by generative AI, and for subsidies it recommends including clauses to ensure compliance with current regulations on AI and intellectual property. In this regard, the Minister of Culture (Ernest Urtasan) has submitted to the European Commission a letter for the reviewing of the Guidelines on Best Practices in the Use of AI to protect the copyright of creators on which the Commission has been working in recent months.

Patents

• The Spanish Patent and Trademark Office (OEPM) Law 24/2015 on Patents stipulates that the right to a patent belongs to the inventor or their successors, being a natural person. This means that even AI significantly contributes to the invention process, it cannot be legally recognised as an inventor itself. The Spanish Patent and Trademark Office (OEPM) has stated that no changes to current legislation are needed, as a natural person can always be identified as the inventor in cases of AI-assisted inventions.

Actors and actresses

• On 28 July 2025, the Second Vice-President of the Government and Minister of Labour and Social Economy, Yolanda Díaz, together with the Minister of Culture Ernest Urtasun, presented the proposal to regulate the employment relationship of artists, technicians, auxiliaries in the field of the performing, audiovisual and musical arts. The proposal includes the provision of intellectual property rights for artists against AI, the first of its kind in labour legislation.

• Spain prohibits algorithmic discrimination in labour and social contexts under Organic Law 3/2007 for Effective Equality Between Women and Men (as amended in 2022) and requires audits in order to detect biases in algorithms which could lead to discrimination.
• The Statute of Workers' Rights (Royal Legislative Decree 2/2015) further establishes that the legal representatives of employees are entitled to be informed about the parameters, rules, and instructions on which algorithms or artificial intelligence systems are based, that may impact working conditions, access to and retention of employment, including the creation of worker profiles.

Several cases are being brought in criminal courts involving counts of child pornography or moral integrity as result of the use of AI applications to manipulate images of persons and sharing such images in social media groups, including in the context of deepfake technologies.

In November 2025, the Madrid Bar Association announced it has commenced work on a legislative initiative to promote the creation of a State Registry of Algorithms with an impact on consumer protection. The initiative seeks to ensure automated systems that influence prices, business decisions and contractual conditions are transparent, controlled and accountable. The proposal is still in the drafting phase.

In addition, the Community of Madrid has initiated the procedure of its first Digital Administration and Artificial Intelligence Law to ensure the ethical and safe use of this technology. The deadline for submitting allegations is until 19 December 2025. The purpose of this regulation is to establish rules for the use of artificial intelligence within the Administration of the Community of Madrid, governing procedures as well as guaranteeing citizens’ rights in their interactions with the Administration when it employs AI systems in the delivery of public services.