On 12 November 2026, the Ibero-American Data Protection Network (RIPD) unanimously adopted the Ibero-American Standards on the Use of Personal Data in AI Systems, announced the same day by the Spanish Data Protection Agency (AEPD). The document covers more than 600 million people across Latin America, Spain and Portugal, and is the first international instrument to systematically govern personal data protection in AI. It creates no new law, but it turns the shared position of the region's data protection authorities on AI into a text that can be checked point by point.
Public data is not free training material
The most direct rule is this: personal data that is public online is not automatically available for training AI. Anyone who wants to use it needs a legal basis, and must consider what the person could reasonably have expected when publishing it. Posts, CVs and photos visible on the web do not automatically become training data. Data inferred by AI counts as personal data too: when a system infers health status, political views or sexual orientation from apparently neutral information, it must receive the reinforced protection given to sensitive data; inferences carry uncertainty and must not be treated as established conclusions.
Using client data to train models? Ask first whether you are allowed
The standards split the chain of responsibility in fine detail: a vendor that uses client data to train or improve its own models must first have an adequate legal authorisation; a company that uses a third-party AI system cannot shift the blame to the vendor — whoever decides the purposes and essential means bears the responsibility. Transparency is tightened too: a single line in a page corner saying "we use AI" does not discharge the duty to inform; companies must explain in language ordinary people can understand what the system is used for and what its consequences are, and trade secrecy is no excuse for staying silent. For models that are already trained, individuals have the right to know whether their data was used, to challenge automated decisions and to demand real human intervention — a review that merely rubber-stamps the AI's suggestion is not effective intervention. When personal data cannot be fully deleted, the organisation must explain why, inform the person concerned, and exclude that data from future training.
Doing AI business in Latin America? Check these four things first
First, take stock of training data sources: which data came from the public web, whether there is a legal basis, and what the person could reasonably have expected when publishing it. Second, go through vendor contracts to confirm whether client data may be used to train the vendor's own models; without clear authorisation, stop the use first and renegotiate. Third, check automated decision-making processes: in credit, hiring and customer-service triage, can human review genuinely overturn the AI's conclusion, or is it just a formality? Fourth, update privacy policies and product notices so that what the AI is used for and what its consequences are is written where users can understand it.
The standards themselves are not directly binding and create no obligations parallel to national laws; their role is to state the shared interpretation of the region's regulators. That is precisely where the risk lies: when Latin American data protection authorities enforce the law and legislate, they will use these standards as a reference — today's "recommendation" may be tomorrow's basis for a penalty. The scope is also limited: it covers only the Ibero-American member states and cannot be applied to the EU or the US, where the GDPR and the AI Act still govern. Enforcement in Europe has already moved ahead: Scale AI was reported by noyb for allegedly breaching the GDPR. Companies building AI products for Latin America should use these standards as their compliance baseline, rather than waiting for national legislation to arrive.
