Ibero-American network adopts personal data standards for AI

The Ibero-American Data Protection Network (RIPD) approved regional standards for the use of personal data in AI systems on September 25, 2026. The non-binding guidance explains how existing data protection principles, rights and obligations apply throughout the processing lifecycle, with an emphasis on risk and accountability. It complements rather than replaces national laws.

The standards identify deceptive behavioral manipulation, improper exploitation of vulnerability and discriminatory social scoring as incompatible with data protection principles. They also clarify that publicly available data is not automatically legitimate to use for model training. Sensitive information inferred from otherwise non-sensitive data must receive enhanced protection, while automated decisions must include effective human intervention.

The guidance addresses neurodata, impact assessments and prior consultation with authorities when high risks persist despite mitigation measures. It also includes specific provisions for generative AI, agentic AI, biometrics, emotion recognition and systems that score or select individuals.

The standards target regulators, legislators, data controllers and processors, AI providers, and public and private organizations. In Mexico, which does not yet have an approved General Law on Artificial Intelligence, they are expected to inform pending legislative discussions and organizational data governance.