The Spanish Data Protection Agency (AEPD) has published new guidance on the use of algorithmic systems in the workplace, addressing the interaction between recently introduced employment-law transparency requirements and existing obligations under the General Data Protection Regulation (GDPR).
The guidance, “Algorithmic Systems in the Workplace: Transparency and Data Protection Safeguards”, follows the entry into force on 5 October 2026 of Spanish Royal Decree 723/2026, which introduces new information requirements concerning automated decision-making systems in employment relationships.
The central message is clear: transparency about the use of an algorithm does not, by itself, make its use lawful. Employment-law information duties and data protection requirements operate alongside one another, and organisations using algorithmic systems involving personal data must continue to comply with the GDPR requirements on lawfulness, transparency, data minimisation, accuracy, data protection by design, risk management and automated decision-making.
New transparency obligations under Royal Decree 723/2026
Royal Decree 723/2026 introduces new transparency requirements concerning employment conditions and partially transposes Directive (EU) 2019/1152 on transparent and predictable working conditions. Of particular relevance, it introduces specific information obligations concerning algorithmic and automated decision-making systems in the workplace.
Under the new rules, employers must inform each worker in writing of the existence of algorithmic or automated decision-making systems. Where such systems are used to make decisions concerning working conditions, employers must also provide information about their guidelines, criteria and operating rules.
The obligation can cover systems involved in decisions concerning matters such as working time, allocation of tasks, remuneration, professional progression, place of work and termination of employment.
For new employment relationships, the relevant information must be provided before the relationship begins. For existing employment relationships, workers may request information not already available to them following the entry into force of the Royal Decree. Employers then have 30 working days from receipt of the request to provide it. Importantly, the information concerning algorithmic systems must be provided specifically and cannot simply be satisfied through a general reference to legislation or a collective agreement.
The AEPD’s warning concerning AI in recruitment
The guidance also examines the AEPD’s preventive warning AI-00009-2026, issued in relation to the planned deployment of an AI system for recruitment and internal mobility. A warning of this kind is a preventive supervisory measure under Article 58(2)(a) GDPR, which allows a data protection authority to warn a controller or processor where intended processing operations are likely to infringe the GDPR. It therefore concerns planned processing rather than an infringement that has already occurred.
The case concerned an AI tool that had not yet been deployed in Spain and was intended to analyse CVs, assign candidates scores according to their suitability for a position and prioritise candidates in recruitment and internal mobility processes. The company had informed workers’ representatives of the intended deployment and stated that final screening or rejection decisions would remain with a human reviewer. It also indicated that sensitive attributes would not be analysed and that the system would undergo periodic audits.
The warning nevertheless provides important indications of the safeguards the AEPD expects organisations to consider before deploying comparable systems.
Risk assessment and data protection by design
The AEPD emphasises the principle of accountability. Organisations must assess risks to candidates and employees and determine whether the processing is likely to result in a high risk requiring a data protection impact assessment (DPIA) under Article 35 GDPR.
Data protection safeguards should also be incorporated when the system is selected, configured, tested and implemented, rather than added after deployment. Appropriate security measures must similarly be determined according to the risks involved.
Human oversight must be real
One particularly important aspect of the guidance concerns human intervention.
The fact that a human formally makes the final decision does not necessarily mean that Article 22 GDPR on automated individual decision-making is inapplicable. The AEPD stresses that the person reviewing an algorithmic recommendation must be capable of critically assessing the result and departing from it rather than being effectively conditioned by the automated score.
The guidance develops this point further by stating that reviewers should understand the system’s limitations, have access to the relevant factors, possess sufficient time and authority to modify the result and be able to consider additional information. Organisations should also consider recording cases in which reviewers depart from automated recommendations. A systematic absence of such departures may indicate practical dependence on the algorithmic output and justify a review of the process.
This approach is consistent with recent CJEU case law referenced by the AEPD. In SCHUFA, the Court recognised that automated scoring may itself constitute automated decision-making where a subsequent decision-maker relies heavily on the score. In Dun & Bradstreet Austria, the Court further clarified the requirement to provide meaningful information enabling the individual to understand the procedure and principles actually applied, including the data used and their influence on the result.
Personal data includes algorithmic inferences
The guidance also stresses that GDPR protection is not confined to information originally entered into an AI system.
Scores, classifications, profiles, predictions and inferences relating to an identified or identifiable individual may themselves constitute personal data. Organisations must therefore consider data minimisation and accuracy not only in relation to source data, but also in relation to outdated information, proxy variables and outputs capable of producing discriminatory effects.
Similarly, stating that a system does not directly process sensitive attributes is not necessarily sufficient. Organisations should assess whether other variables may permit sensitive characteristics to be inferred or operate as proxies for them. Where special categories of personal data are processed, the requirements of Article 9 GDPR must also be satisfied.
Responsibility remains with the organisation deploying the system
Another important point concerns systems developed or managed at group level or supplied by third parties.
According to the guidance, the fact that an AI tool has been developed or assessed centrally within a corporate group does not relieve the Spanish entity deciding to use it of its own responsibilities.
The entity must determine and document its data protection role, the effective allocation of decision-making responsibilities, contractual safeguards, the location of personal data and any international transfers, as well as reaching its own conclusions concerning the lawfulness, necessity and proportionality of the processing.
Auditing must be meaningful and verifiable
A general statement that an AI system will undergo periodic audits is likewise insufficient.
The AEPD indicates that meaningful auditing should document matters including the purpose and scope of the audit, the version of the system examined, the data and variables tested, error rates, differentiated impacts, the effectiveness of human oversight, incidents and complaints, and any corrective measures adopted.
Organisations should also determine when reassessment will be necessary following changes to the model, the underlying data or the purposes for which the system is used.
What should organisations do before deployment?
The AEPD concludes with a practical set of measures organisations should consider before implementing algorithmic systems in the workplace. These include:
- identifying systems that support or make decisions concerning candidates, working time, tasks, performance, remuneration, promotion, internal mobility, workplace or termination, including third-party systems;
- documenting the relevant processing operations and the lifecycle of the data;
- identifying purposes, controllers, input data and their sources, generated inferences, principal variables, decision rules, recipients, retention periods, transfers and the actual role of human reviewers;
- determining the legal basis for each processing operation, whether Article 22 GDPR applies, the level of risk, whether a DPIA is required and the relevant classification under the EU AI Act;
- preparing appropriate and coordinated information for employees, candidates and employee representatives;
- testing whether explanations are genuinely comprehensible and enable individuals to understand the factors that may influence outcomes;
- designing demonstrable human oversight with sufficient competence, authority, time and access to information; and
- retaining evidence of information provided, testing, audits, model changes, incidents, complaints and corrective measures.
Three overlapping transparency frameworks
The AEPD ultimately distinguishes between three different layers of transparency, each with different recipients and purposes.
At individual employment level, workers must receive information about the existence of relevant algorithmic systems and, where they determine working conditions, their guidelines, criteria and operating rules.
At collective employment level, workers’ representatives have information rights concerning the parameters, rules and instructions underlying algorithms or AI systems affecting working conditions, access to or continuation in employment, and profiling.
Separately, under the GDPR, affected candidates and employees must receive the applicable data protection information and, where relevant automated decision-making is involved, meaningful information about the logic involved and the significance and envisaged consequences of the processing.
Conclusion
The AEPD’s new guidance makes clear that the introduction of specific algorithmic transparency requirements into Spanish employment law should not be viewed as an authorisation to deploy algorithmic systems in the workplace.
Rather, employers using such systems must consider employment law, data protection and AI regulation together. Providing information about an algorithm is only one part of that framework. Organisations must also be able to demonstrate that the underlying processing is lawful, necessary and proportionate, that risks have been appropriately assessed, that explanations are meaningful and that purported human oversight operates effectively in practice.
For companies deploying AI in recruitment, employee management or other workplace decision-making processes, the guidance therefore sets out a practical framework for assessing existing and planned systems against the increasingly interconnected requirements of the GDPR, Spanish employment law and the EU AI Act.
