In Spain, artificial intelligence has become the main data protection topic of 2026. A new royal decree obliges employers to disclose algorithmic decisions, and the Spanish Data Protection Agency (AEPD) is setting out clear expectations for AI projects before they start.
1. Royal Decree 723/2026: Algorithmic Transparency in Employment
Royal Decree 723/2026, in force since 5 October 2026, implements Article 8.5 of the Workers' Statute and partly transposes Directive (EU) 2019/1152 on transparent working conditions. It replaces Royal Decree 1659/1998. Key points:
- Employers must inform workers about the existence of automated decision-making systems, and where these systems set or change working conditions, about their main rules and criteria
- This covers decisions on working time, task and shift allocation, pay, promotion, workplace and dismissal
- The concept of an algorithmic system is broader than an "AI system": shift-planning tools and scoring systems can be covered, as can tools that only recommend a decision if they significantly influence it
- Existing employees can request the information; according to commentary, the employer must answer within 30 working days
The decree works alongside the GDPR: where human involvement only rubber-stamps the algorithm's result, the decision is treated as fully automated under Article 22 GDPR.
2. AEPD Warnings on AI Video Surveillance
On 6 October 2026 the AEPD issued preventive warnings to two town councils planning video surveillance with AI-based image analysis — including facial detection or recognition, and searching for people by appearance. The processing had not yet started. The AEPD set out the safeguards it expects:
- data protection by design and by default from the procurement stage
- a necessity and proportionality check for each function — technical availability alone does not justify its use
- a clear definition of the data generated, retention periods and access for each function
- a DPIA before launch where the processing is likely to be high risk
- the stricter regime for biometric data where people can be uniquely identified
- clear and accessible information for the people affected
Although the warnings concerned public bodies, the same principles apply to companies using AI-supported cameras in shops, warehouses or offices.
3. The AEPD's Wider Focus on AI
The AEPD has also published technical guidance on accuracy and data minimisation in AI systems, and has warned an employer about an AI tool used to screen job applications, stressing human oversight and transparency. Its sanction practice shows that deploying biometric technology without a valid DPIA can be very costly — one of the largest recent Spanish fines, more than EUR 10 million against the airport operator Aena, concerned facial recognition deployed without a valid impact assessment.
4. EU Developments to Watch
- GDPR Procedural Regulation (EU) 2025/2518 applies from 2 April 2027
- EDPB fining guidelines: adopted on 21 September 2026, in public consultation until 13 November 2026
- Digital Omnibus: the proposed GDPR changes have stalled in the Council; the current rules continue to apply
Your Checklist
- Inventory algorithmic HR tools and prepare the information required by Royal Decree 723/2026
- Update employment contracts and privacy notices for employees
- Carry out DPIAs before deploying AI video analytics or biometric systems
- Ensure meaningful human review of automated decisions
How ResGuard Can Help
The ResGuard Data Protection Manager includes a DPIA module, records of processing and policy management, and our outsourced DPO service for Spain helps you assess AI projects.
This article provides general information as of 20 October 2026 and does not constitute legal advice. Sources: AEPD press release of 6 October 2026, published commentary on Royal Decree 723/2026, and EU publications.