In April 2026, Spanish police broke up a ring in Granada that had defrauded around 300 people of more than 400,000 euros. It all started with an employee at a mobile phone shop who copied customers' identity cards. Two seized phones held more than 1,000 photos of identity documents, used to obtain prepaid SIM cards and then consumer loans. "Casi nadie es consciente de que con su DNI se pueden hacer este tipo de negocios", almost nobody realises that this kind of business can be done with their ID card, said the head of Granada's provincial police, Rafael Rodríguez (Vozpópuli).
Spain is probably the European country where photocopying the national identity card, the DNI, is most hotly debated. Its data protection authority has taken a position and handed out fines, and the country has rolled out a digital alternative. All against a contradictory backdrop: the state itself demands ever more data from travellers.
What does the Spanish data protection authority say?
The AEPD, Spain's counterpart to the UK's ICO or France's CNIL, is blunt: "No, generalmente no es necesario proporcionar una copia del DNI para realizar una contratación", as a rule, there is no need to provide a copy of the DNI to enter into a contract. Identity can be checked in other ways, for example with an electronic signature. The notable exception: sector-specific legislation may require the copy, such as anti-money laundering rules, which apply to banks among others (AEPD). The same goes for exercising your data rights (access, erasure and so on): as a rule, no copy of the DNI, unless there is reasonable doubt about who is making the request (AEPD).
Its legal department goes further. In a 2023 opinion on couriers who photograph the DNI when handing over a parcel, a SIM card or a phone, it concluded that asking for the DNI and copying it would be "en principio, un tratamiento excesivo", in principle excessive processing, which cannot be introduced as a matter of course but must be assessed case by case (AEPD, report 0048/2023). In June 2025, the AEPD made clear that tourist accommodation cannot demand a copy of an identity document: on the premises, "bastaría con una verificación visual del documento", a visual check of the document is enough; a copy "no permite verificar con certeza la identidad de la persona que lo remite", does not make it possible to verify with certainty the identity of the person sending it (AEPD). For online check-in, it suggests a digital certificate, matching against the payment method, or a code sent by text message or email.
Have companies been fined?
Yes. Among the cases recalled by the fact-checking site Maldita.es (Maldita.es) and the specialist press:
- the operator Orange, 100,000 euros in June 2022: a courier had photographed a customer's DNI during a delivery;
- a hotel, 30,000 euros in 2022, for scanning the whole identity page of a guest's passport (Andersen);
- a company, 20,000 euros in April 2023, which had refused to delete a customer's data because he would not provide the DNI copy it asked for;
- a breakdown and repair firm, 11,000 euros in March 2024: an employee had photographed a customer's DNI on his personal phone.
Beware of the headlines that, since summer 2026, have announced "new fines of up to 100,000 euros": according to Maldita.es, which asked the AEPD, no rule has changed, and the amount is not set by law, since the Agency assesses each case. The reasoning, though, is consistent: a copy of an identity document is lawful only if it is necessary, and a simple check is usually enough.
What is MiDNI?
It is the DNI on your phone. Royal Decree 255/2025 of 1 April 2025 created a digital version of the identity card, whose use "tendrá la misma eficacia jurídica a efectos de identificación", will have the same legal effect for identification purposes. Everyone, public or private, must recognise the DNI, and public- and private-sector bodies had twelve months to take the steps needed for the digital version to work properly (BOE, Real Decreto 255/2025).
Its value lies in data minimisation. The app lets you choose what you show, at three levels (Ministry of the Interior):
- DNI Edad (age): photo, name and confirmation that the holder is of age;
- DNI Simple: photo, first name and surnames, sex, validity of the document (the MiDNI portal adds the date of birth);
- DNI Completo: all the data on the physical document.
The person checking scans a QR code generated by the National Police, valid for a short time; the data appear for a few moments and are not stored on their phone. MiDNI only works in person and with a data connection: not for identifying yourself online or signing, not as a travel document, not outside Spain (MiDNI).
On paper, acceptance has been compulsory since 2 April 2026, which the Ministry of the Interior confirmed the day before. In practice, no specific penalty is provided for, and a few days before the deadline, 80% of hotels and shops were not ready to read it, according to a Logalty study quoted in the press (Xataka Móvil). For more on European digital identity, see The European digital identity wallet is coming.
Does the Spanish state collect any less?
No, and that is the paradox: the traveller register. Since 2 December 2024, Royal Decree 933/2021 has required accommodation providers (hotels, campsites, holiday lets, but also the platforms and operators acting as intermediaries) and vehicle hire firms to record far more data than before and send it to the Ministry of the Interior: up to 42 fields per guest according to the hotel industry, against 9 previously (the government counts only 13 as mandatory), including the payment method, and to keep it for three years (BOE, Real Decreto 933/2021, Economist & Jurist). Consumer groups, including the OCU, and tourism businesses have called for it to be suspended (OCU). On 4 June 2026, the European Commission opened infringement proceedings against Spain: it considers some categories of data excessive, payment details among them, and the three-year retention disproportionate (Xataka). The decree remains in force.
So the state that tells businesses not to photocopy the DNI is, at the same time, requiring them to collect data on a massive scale.
What about setting up a company in Spain?
Company formation is largely online: a single electronic file is passed by the CIRCE system to the bodies concerned and, with model articles of association, the law provides for a signing appointment with the notary within twelve business hours and registration with the companies register within six business hours (BOE, Law 14/2013). Since the 2022 "Crea y Crece" law, a limited liability company can be formed with share capital of 1 euro (BOE, Capital Companies Act, art. 4). Companies then deal with the authorities electronically, usually with a representative's digital certificate, which costs 14 euros excluding VAT for two years (FNMT). The French route is described in Setting up a company in France: the paperwork.
The Official Gazette of the Companies Register (BORME) publishes directors' appointments with their name alone. Yet the DNI number is not absent: in the Madrid edition of 16 October 2026, we found it in plain text in free-text entries, for instance when a director replaces their foreigner's identity number with a DNI number (BORME).
What can a French entrepreneur take from this?
A copy of an identity card is not harmless. The Granada case proves it: a thousand photos of identity documents were enough to take out loans in the names of 300 people. In France too, stolen identity documents are used to open accounts (see Opening a business bank account without sending everything).
Ask yourself whether a copy is really needed. Spanish doctrine applies the GDPR principle of data minimisation, which applies in France too. Showing the document in person, checking it through an app or using a single-use proof of identity is better than a photocopy.
When the copy cannot be avoided, mark it. A watermark stating the recipient, the purpose and the date makes the copy harder to reuse elsewhere. The French state recommends it (see Watermark your ID document); Watermark PDF adds one in your browser, without uploading the card. If you only have a photo, convert it first with JPG to PDF.
PDFKami does not verify identity and replaces neither MiDNI nor France Identité, the French state's ID app; it is for preparing and marking the copies you have to send.
Glossary
DNI (Documento Nacional de Identidad): the Spanish national identity card.
AEPD (Agencia Española de Protección de Datos): the Spanish data protection authority.
MiDNI: the National Police's official app for showing your DNI on your phone, sharing only the data needed.
Data minimisation: the GDPR principle that only strictly necessary data should be collected.
CIRCE: the Spanish electronic company formation system, which passes a single file to the bodies concerned.
BORME (Boletín Oficial del Registro Mercantil): the official gazette in which entries made in the companies register are published.
Watermark the copy of your ID that you cannot avoid sending: PDFKami, in your browser.