SPDP Norma General guaranteeing personal-data protection in the use of AI systems
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
Commencement not set.
A data subject rights rule binding public and private bodies.
As of 5 September 2026.
What it requires
- Guarantee, at all times, a data subject's right not to be the object of a decision based solely or partly on automated valuations reached by an AI system processing their personal data, along with the right to information and the right to object.
- Inform the data subject clearly, specifically, and transparently about personal-data processing carried out through an AI system, including its purposes.
- Before developing an AI system that will process personal data, carry out a risk-management process and an impact assessment.
- Maintain a record of processing activities and audit the AI system's operation in proportion to its level of risk.
Who enforces it
Enforcement body
Superintendencia de Protección de Datos Personales
What it reaches
Obligation class
DPIA, Disclosure, Data subject rights, Governance
Who checks it
Audit expectation
continuous
Who audits it
Self
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
This resolution binds any controller or processor that develops, trains, implements, deploys, or provides an artificial-intelligence system that processes personal data, whenever that system falls within the LOPDP's material and territorial scope. Article 4 guarantees, at all times, the data subject's right not to be the object of a decision based solely or partly on automated valuations, together with the right to information and the right to object.
Article 5 requires the controller or processor to inform the data subject clearly and specifically about the AI-based processing, and article 6 requires a prior risk-management process and impact assessment before developing an AI system that will process personal data. The resolution states that it takes effect upon its publication in the Registro Oficial; the signed text itself does not independently confirm that publication has occurred.
When LexLint raises it
high_risk_decisionsdeploys_chatbotgenerates_contentprocesses_biometrics
Read the law
Official text of Resolución No. SPDP-SPD-2026-0009-R
Superintendencia de Protección de Datos Personales, reproduced by Fielweb legal database