The Red Iberoamericana de Protección de Datos (RIPD), the network of data protection authorities across Spain, Portugal and Latin America, has published a 29-page set of standards on how personal data rules apply to AI, PPC Land reports. The document says it was published in November 2026 but gives no day.
The central provision for commerce says that when an AI provider or processor uses a client's personal data to develop, train, evaluate or improve its own models, that use is, as a general rule, a different purpose outside the client's mandate unless there is express authorization and a legal basis. Anonymizing the data first does not change that, according to the text. Brands that plug third-party models into customer service or audience tools remain responsible for verifying the processing complies.
The standards also say inferences that let health, beliefs, ideology or sexual orientation be attributed to a person fall under the sensitive-data regime, however accurate the inference. Simply saying AI or algorithms are used does not meet the duty to inform, and public availability of data does not by itself justify AI training. For AI agents, controllers must limit autonomy, data and tools, keep action logs and provide a way to interrupt them independently of the system.
The document is guidance with no enforcement mechanism of its own and applies without prejudice to national law. PPC Land notes it does not list the authorities that approved it, and its weight will depend on whether national regulators cite it.