Ibero-American Regulators Agree on How Privacy Law Applies to AI: Inside the RIPD Standards

Data protection authorities from Spain, Portugal and across Latin America now have a shared reference for how privacy law applies to artificial intelligence. On November 12, 2026, the Ibero-American Data Protection Network (Red Iberoamericana de Protección de Datos, or RIPD) announced that it had unanimously approved the Estándares iberoamericanos sobre el uso de datos personales en sistemas de inteligencia artificial, the Ibero-American Standards on the use of personal data in AI systems. The document does not create a new AI law. It explains, in a structured set of numbered provisions, how existing data protection principles should work when a company or public body trains, buys or deploys AI.

What the RIPD approved

The RIPD brings together data protection authorities from Ibero-American countries, with Spain’s data protection agency, the AEPD, holding its permanent secretariat. According to the network’s announcement (in Spanish; translations here are ours), the Standards are the first international instrument to address, in a systematic body of provisions, how data protection applies to AI processing. The network says the text is relevant to the rights of more than 600 million people.

Some summaries called the document a “framework.” Its formal title is “Standards,” and the text describes itself as an “orientating” instrument that is “complementary” to the general data protection regime. Section 1.1.2 states that its provisions apply without prejudice to national legal systems, and the preamble says it neither creates a parallel ethical-legal regime nor replaces the network’s 2017 Data Protection Standards for Ibero-American States. In other words, it is not binding in itself. Its weight comes from the fact that the regulators who enforce national laws agreed on it together.

The Standards apply to any processing of personal data that incorporates an AI system or is needed to develop one, including inferred or derived data. Section 1.2.1 builds in proportionality: the Standards should not impose unnecessary obligations where risks are limited, and should not weaken safeguards where risks are high. They do not apply where no personal data is processed, for example properly anonymised data or synthetic data that cannot identify anyone.

The text was drafted from an initial version by an outside expert, then consulted on and debated by member authorities. The European Union funded the work through the FIAP foundation as part of the EU-Latin America and Caribbean Digital Alliance.

Seven positions privacy teams should note

The Standards run to nine chapters, covering principles, sensitive inferences, automated decisions, individual rights, the AI value chain, governance, security and specific technologies. These are the points most likely to change how organisations operate.

1. Inferences are personal data. Predictions, profiles and classifications can be personal data when they relate to an identifiable person. When a system infers health, ideology or sexual orientation from seemingly neutral data, the stronger protection for sensitive data applies. Organisations must also account for the uncertainty in an inference and not treat it as more certain than it is.
2. Public does not mean free to train on. Section 2.2.3 states that the public availability of personal data does not, by itself, legitimise its use to develop or train AI. Organisations need a proper legal basis and must consider what people could reasonably expect when they published the information.
3. Legitimate interest is possible but never presumed. Where national law allows it, legitimate interest may support training or improving AI, but only after a balancing test and with safeguards such as minimisation or pseudonymisation.
4. Vendors cannot quietly train on customer data. When a provider or processor uses data it handles for a client to train its own models, that is generally a different purpose. It needs express authorisation and its own legal basis, and anonymising the data first does not get around the rule.
5. Human review has to be real. Under section 4.2.1, a decision stops being solely automated only if a person with the ability to understand the output and the authority to change it actually intervenes. Someone who simply rubber-stamps the system’s result does not count.
6. Transparency means explaining, not labelling. Saying “we use AI” is not enough. Organisations must explain in plain language what the system is for, what role it plays and what consequences it can have, and trade secrets do not excuse skipping that explanation.
7. Some uses are off limits. Section 2.2.4 declares AI processing designed to deceptively manipulate behaviour, exploit vulnerabilities linked to age, disability or socioeconomic situation, or run discriminatory social scoring incompatible with data protection principles.

Rights against trained models

Chapter V deals with a hard practical problem: what happens to individual rights once data is inside a trained model. Under the access right, people may learn, where national law provides, whether their data was used in an AI system, whether profiles or inferences were generated about them, and whether those influenced decisions affecting them. Where an inference cannot be corrected directly, a person can ask for the input data to be corrected, add information, contest the inference or request review.

The Standards accept that erasure is sometimes not technically possible. Where deletion, restriction or objection cannot be fully honoured for an already trained model, section 5.5 requires the controller to justify and document that limitation, tell the person, and take reasonable steps such as excluding the data from future training. Portability generally covers data a person provided and structured observed data, not inferences.

This is close to the approach European regulators have taken under the GDPR, and the emphasis on contestable automated decisions mirrors the theme the EDPB picked for its 2027 enforcement action on automated hiring decisions.

Accountability along the AI supply chain

Chapter VI is aimed squarely at companies that buy rather than build. Section 6.1 says the controller is whoever decides the purposes and essential means of a specific processing operation, even if it does not train or technically control the model. Using a third-party model does not excuse a deployer from checking that the use is lawful and assessing the provider’s safeguards. Contracts must spell out who may use personal data for anonymisation, training or improvement. International transfers made while developing or running AI stay under the general transfer rules, with extra measures where the risk calls for them.

Chapter VII adds governance duties: privacy by design across the lifecycle, records that document AI-specific features, involvement of the data protection officer from the start, and an impact assessment before deployment where national law requires one. If high risk remains after mitigation, the controller must consult the regulator or not proceed. Chapter VIII lists AI-specific threats such as training data extraction, model inversion, membership inference and prompt leakage, and asks that incident procedures account for them.

Generative and agentic AI, biometrics and neurodata

Chapter IX adds rules for particular technologies. For generative AI, organisations should prevent unnecessary personal data from entering prompts and set retention rules for prompts and outputs, including whether they are used for training. For agentic AI, the controller must decide how much autonomy is acceptable, with less autonomy and more supervision as potential effects grow. It must limit the data and tools an agent can reach, control persistent memory, keep a trace of the agent’s actions and provide a way to suspend the agent that works independently of the agent itself. Separate provisions cover biometrics and emotion recognition, scoring and ranking of people, and neurodata.

Why it matters beyond the region

The region’s laws differ widely. Brazil’s LGPD has its own enforcement authority and a structure that parallels the GDPR in many ways, while Mexico has rebuilt its regime under a new federal data privacy law and countries such as Paraguay are modernising their frameworks. A common reading of how those laws apply to AI gives multinational companies a single baseline across many markets.

Practical steps for organisations with Ibero-American operations:

• Inventory AI uses that touch personal data and record whether each involves inferences, automated decisions or sensitive data.
• Review training data sources, especially scraped or public data, against the “reasonable expectations” test.
• Check vendor terms for any right to train on your data, and require express opt-in where you allow it.
• Test human review processes to confirm reviewers can and do overturn system outputs.
• Prepare a process to tell people when erasure from a trained model is not feasible and what you are doing instead.

The debate over training permissions is already reaching courts, as recent voiceprint lawsuits show, and the region has been building its own approach to AI governance across Latin America and the Caribbean. The full text is available as a PDF published by Peru’s government.

Frequently asked questions

Are the RIPD Standards legally binding?

No. They are guidance that complements national laws. National authorities may, however, use them to interpret their own laws, so they are a strong signal of enforcement thinking.

Does the document replace the EU AI Act or national AI bills?

No. It addresses data protection only, and leaves AI-specific product rules to other laws. A certification or AI-specific authorisation does not replace data protection accountability.

Can we still use legitimate interest to train models?

Where your national law permits it, yes, but only after a documented balancing test and with safeguards. The Standards say its suitability cannot be presumed.

What if we cannot delete someone’s data from a model?

Document why, tell the person and limit further processing, for example by excluding the data from future training runs.

A shared reading for a diverse region

The RIPD did not write a new AI law. It did something that may prove more useful in practice: it told companies how the regulators they already answer to intend to read the laws they already have. For any organisation running AI across Spanish- and Portuguese-speaking markets, that shared reading is now the baseline to design against.