A tool, not legal permission

AI can organise records, summarise information and flag possible inconsistencies. Technical access does not establish a right to process personal data. Each check needs a defined purpose, a valid legal basis and a necessity assessment.

GDPR and Spanish safeguards

The GDPR requires lawful, transparent, accurate and proportionate processing, with data minimisation and retention limits. Spain’s LOPDGDD adds national safeguards. Information published online remains personal data and cannot automatically be reused for recruitment.

Criminal records require specific authorisation

Article 10 of the LOPDGDD restricts processing of criminal-offence information. Employers generally cannot demand criminal-record certificates for every role: a specific legal authorisation is required. Candidate consent alone does not remove this restriction.

Verify before relying on AI

AI may suggest name variants, translate documents or flag possible matches. Qualified analysts must check original sources, establish identity and assess whether a finding is relevant to the role. Similar names are not proof of identity.

The EU AI Act matters too

Certain recruitment and employment AI systems may qualify as high-risk. Following the 2026 amendment, Annex III high-risk obligations apply from 2 December 2027, while relevant prohibitions already apply. Human oversight cannot replace compliance with data-protection and other legal duties.


In the next article (part 2 of 5), we explore: “Where AI adds real value to screening in Spain”.

Discuss responsible screening

Validato helps organisations design proportionate, documented, role-specific background checks. Contact our team to discuss your requirements.