Ibero-American data network approves AI and personal data standards

The Red Iberoamericana de Protección de Datos (RIPD) has unanimously approved standards on the use of personal data in artificial intelligence systems, as announced on 12 November 2026 by Spain’s Agencia Española de Protección de Datos (AEPD). They matter because they give authorities, legislators and businesses across Ibero-America a common language for applying data protection to AI.

What has been approved

The AEPD, which holds the RIPD’s permanent secretariat, explains in its press release that the Estándares iberoamericanos sobre el uso de datos personales en sistemas de inteligencia artificial (Ibero-American standards on the use of personal data in AI systems) are normative in format and international in scope. They do not create a parallel regime or new general obligations: they spell out how existing rules apply to AI, using a risk-based approach, proportionality and technological neutrality.

The text is the outcome of drafting and consultation among member authorities, starting from a draft by the consultant Marcos Sánchez Acevedo. It was funded by the European Union, with the Fundación para la Internacionalización de las Administraciones Públicas (FIAP), under the EU-LAC Digital Alliance. It complements the Estándares de Protección de Datos para los Estados Iberoamericanos.

Key content

• Inferred data: inferences, predictions and profiles can be personal data when they relate to identifiable people, and must not be treated as more certain than they are. If a system deduces health, ideology or sexual orientation, the enhanced protection for sensitive data applies.
• Public data: the mere fact that data is publicly accessible is not enough to train AI systems. A suitable legal basis is needed, along with the reasonable expectations of the person who published it.
• Transparency and rights: simply saying AI is used may not satisfy the duty to inform, and trade secrets are no excuse. People should be able to find out whether their data was used, challenge automated decisions and obtain real human intervention, which does not exist if the reviewer merely rubber-stamps the system’s output.
• Responsibility: whoever uses third-party AI remains responsible for processing whose essential purposes and means they determine. If a model cannot fully erase data, the organisation must justify this, inform the person and, for example, exclude the data from future training.
• Limits and special areas: systems designed to manipulate deceptively, exploit vulnerabilities or carry out discriminatory social scoring are declared incompatible. There is specific guidance on generative and agentic AI, biometrics, emotion recognition and neurodata.

Our view at CEA Digital Law

At the Euro-American Committee of Digital Law - CEA Digital Law, we welcome standards born of consensus that seek to reconcile innovation and rights. Their practical value lies in specificity: effective human intervention and the treatment of inferences are areas where the general wording of the GDPR and Latin American laws leaves room for interpretation, and a shared reference reduces fragmentation for those operating in several countries.

For Europe, this is a chance to engage with a region sharing a legal tradition. For Latin America and the Caribbean, it is a tool for updating laws and guidance without starting from scratch. For Africa, where several countries are developing their own data and AI frameworks, it could inspire regional standards drawn up by the authorities themselves.

Open questions remain: since the standards are not binding in themselves, their impact will depend on national authorities and legislators adopting them, and it is yet to be seen how they will translate into supervising models that are already trained. We suggest that authorities publish use cases and practical guidance, and that a dialogue space be opened between Ibero-America, Europe and Africa to share experience.

Sources

• AEPD: La Red Iberoamericana de Protección de Datos aprueba unos Estándares internacionales pioneros sobre IA y protección de datos personales
• RIPD: Estándares iberoamericanos sobre el uso de datos personales en sistemas de IA

CEA Digital Law