Businesses in Spain could face €100,000 fines for copying your ID

Checking into a hotel, hiring a car or signing up for a service often comes with the same request: ‘Can we take a copy of your ID?’ Many people hand it over without a second thought. But Spain’s data protection watchdog says that, in many everyday situations, businesses should not be photocopying or photographing your identity card simply because it is convenient.

The warning is a timely reminder for residents, expats and holidaymakers alike. Under European data protection rules, organisations are expected to collect only the personal information they genuinely need. Holding a full image of someone’s identity document without a valid legal reason could leave businesses facing hefty penalties and expose customers to unnecessary privacy risks.

Why copying your ID could put your personal data at risk

An identity card contains far more information than is usually needed to confirm who you are.

A full copy may reveal your signature, the document’s issue date and other personal details that are irrelevant for routine transactions. According to Spain’s Data Protection Agency (AEPD), keeping complete images of identity documents can breach the data minimisation principle set out in the General Data Protection Regulation (GDPR).

That principle requires organisations to collect only the information that is strictly necessary for a specific purpose.

The concern is not simply about paperwork. If a company storing copies of identity documents suffers a cyberattack or data breach, those images could end up in the wrong hands, increasing the risk of identity theft or fraud.

For many customers, that risk is largely invisible. A quick snapshot taken during check in may seem harmless, but once it is stored digitally, it becomes another piece of sensitive personal information that must be protected.

When can a business ask for your ID?

Businesses can still ask to see your identity document when they need to verify who you are. In many cases, visually checking the document or recording only the essential details is enough to meet legal requirements.

The AEPD says companies should choose the least intrusive method available rather than automatically making or storing a complete copy of the document.

There are, however, situations where Spanish law specifically requires organisations to retain identity information. Those legal obligations remain unchanged. The agency’s warning is aimed at cases where businesses routinely copy identity documents without a clear legal basis.

Importantly, the watchdog also points out that a customer’s consent alone does not automatically make the practice lawful. If there is no legal justification for storing a copy of the document, asking the customer for permission does not remove the company’s responsibilities under data protection law.

What are your rights if you’re asked for a copy of your ID?

If a business asks to photocopy or photograph your identity document, you are entitled to ask why the copy is needed, what legal basis the company is relying on and how your information will be stored.

If there is no legal obligation requiring the business to keep a copy, the AEPD says customers have the right to refuse and can suggest alternative ways of confirming their identity, such as allowing staff to inspect the document without retaining an image.

The watchdog is also reminding businesses that failing to comply with data protection rules can be expensive. In the most serious cases, sanctions can reach €100,000, reflecting the importance of handling personal data responsibly.

As concerns over online privacy and identity fraud continue to grow, the message from Spain’s data protection authority is straightforward: businesses should only collect the information they genuinely need, and customers should not feel obliged to surrender more personal data than the law requires.