Training or fine-tuning models on own data in Spain: related rules
Training, fine-tuning or grounding models on customer, employee or public data. It requires a legal basis to reuse personal data, dataset documentation and, when developing a general-purpose model, provider duties.
GDPR and EDPB Opinion 28/2024: models are not presumed anonymous and legitimate interest needs a documented test; developing a general-purpose model triggers technical documentation, copyright policy and training-data summary duties since Aug 2, 2025.
Seven base documents for hosting in-house or open-weight models: provenance, security baseline, adversarial testing, architecture, model card, life cycle and rollback.