Rights and liability
Personal data, minors, deepfakes, reputation and civil liability.
10 articles, in Spanish.
When an AI system processes personal data, the GDPR applies. Its Article 22 gives everyone the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them, subject to the exceptions in paragraph 2.
The AI Act defines a «deep fake» as AI-generated or manipulated image, audio or video content that resembles existing persons, objects, places, entities or events and would falsely appear to a person to be authentic or truthful (Article 3, point 60). Deployers of a system that generates or manipulates such content must disclose that it has been artificially generated or manipulated (Article 50(4)). From 2 December 2026 it is prohibited to place on the market, put into service or use AI systems that generate or manipulate realistic images, video or audio of the intimate parts of an identifiable person, or of an identifiable person engaged in sexually explicit activities, without their consent (Article 5(1)(ba), added by Regulation (EU) 2026/1744, under the terms of its paragraph 1a).
The articles in this section, written in Spanish, cover data protection, minors, deep fakes, the right to reputation and civil liability for harm caused by AI systems.
In the guide to the safe use of AI in companies (in Spanish): RGPD e inteligencia artificial: datos personales en sistemas de IA · Etiquetar contenido generado con IA: artículo 50 y deepfakes
Sources: Reglamento (UE) 2016/679 (RGPD); Reglamento (UE) 2024/1689; Reglamento (UE) 2026/1744. Checked on 20 October 2026.