When a courier or shop, including a private company, asks to photocopy or photograph your Documento Nacional de Identidad (DNI), the request may be more than an inconvenience: it can raise questions under data-protection law. Spain’s data protection watchdog, the Agencia Española de Protección de Datos (AEPD), applies the GDPR principle of data minimisation to identity documents. Organisations should collect only data that is relevant to a clearly stated purpose and no more than necessary.
The DNI is a basic means of proving identity in Spain. It is mandatory for residents over 14 and must be shown to authorities when requested. But showing an ID for verification is legally distinct from allowing a company to keep a photocopy or photograph. Under Article 5(1)(c) of the GDPR, routinely retaining a full copy without a specific legal obligation or a demonstrably necessary and proportionate justification can breach the requirement to limit personal data collection. Spain’s Organic Law 3/2018 also forms part of the national data-protection structure overseen by the AEPD.
Legal Boundaries
There is no blanket ban on every request for a DNI copy. A company needs a valid legal basis and a defined purpose for retaining the document, and the processing must be proportionate. For many identity checks, inspecting the document may be sufficient; keeping an image adds data that must be stored securely, with access controlled, and raises the risks of unauthorised access or a data breach.
When people exercise rights such as accessing or correcting personal data, or ask to have it deleted, their identity must be verified where necessary, but retaining a copy of the DNI is not automatically required. The AEPD’s approach is to limit collection to what is needed for the particular procedure, rather than treating a full document image as routine proof of identity. Unnecessary retention can increase the amount of personal information exposed if records are accessed improperly or compromised.
High-Profile Fines
Enforcement over identity-document processing turns on the purpose and proportionality of the collection, including whether a company needed to retain an image of the DNI or could verify identity by less intrusive means. Article 5(1)(c) of the GDPR requires personal data to be relevant and limited to what is necessary. The amount of any penalty depends on the circumstances of the case; a fine is not automatic or identical for every request to inspect or copy an identity document.
For companies, the distinction between checking an identity and keeping a document image matters in day-to-day operations. A retained copy brings extra duties: companies must control access and protect the stored image, then delete it when appropriate. A request based only on habit or convenience does not by itself establish that retaining the full document is necessary for the stated purpose.
What to Do If Asked for a Copy
If a business requests a photocopy or photo of your DNI, you can ask why it is needed, how long it will be kept, and what legal basis supports the processing. You can also ask whether the identity check can be completed by showing the document or verifying only the details needed for the transaction. The answer depends on the particular purpose and legal requirements, not on a general rule that every company may retain a copy.
The AEPD is Spain’s supervisory authority for data protection and issues guidance and enforcement decisions under the GDPR and Organic Law 3/2018. Its data-minimisation approach focuses on collecting only what is necessary and distinguishing identity verification from document retention. The need for strong systems to protect personal information also arises in other areas, including coastal alert systems in Spain, as discussed in recent coverage of Mediterranean tsunami risks.
