Drones and Privacy in Spain: The Rules for Filming People from the Air (2026)

A drone with a camera raises two separate legal questions: is the flight itself allowed, and is what it records allowed. This page covers the second question, which is the one most people actually run into, and points to the right authority for the first.

Information last verified on 23 July 2026. This page provides general legal information about Spanish law and does not constitute legal advice in an individual case.

The aviation rule changed in 2024

For years, the reference point for Spanish drone rules was RD 1036/2017. That is no longer the case. The BOE's own consolidated text of RD 1036/2017 now carries a notice that it was repealed, with effect from 25 June 2024, by the derogatory provision of Real Decreto 517/2024. It remains useful only as background on how the older domestic regime worked, not as current law.

RD 517/2024 is now the operative national instrument, and its own art. 1 states plainly what it is for: completing the legal regime of the EU's Reglamento Delegado (UE) 2019/945 on unmanned aircraft systems, its Reglamento de Ejecución (UE) 2019/947 on the rules and procedures for operating unmanned aircraft, and the Reglamento de Ejecución (UE) 2021/664 on the U-Space regulatory framework. Because EU regulations apply directly in Spain without needing to be transposed, the operative flight rules already exist at EU level; RD 517/2024 fills in what is left to each member state, things like national registration, the treatment of public-safety drones outside the EASA rules, and how U-Space is organised domestically.

Where the current operational rules actually live

The specific categories a drone flight falls into, the weight thresholds, and the requirements that come with each category are set by the EU regulations RD 517/2024 implements, and administered day to day in Spain by AESA, the Agencia Estatal de Seguridad Aérea. Because those figures sit in a regulatory framework that AESA applies and updates directly, this page intentionally does not repeat specific weight or altitude numbers. Anyone planning to fly should go to AESA's own drone pages for the current, authoritative version of those requirements rather than relying on a number that may have shifted. This page's focus is the privacy layer that applies on top of whatever the aviation rules allow.

When a drone becomes a data-protection matter

The AEPD's own legal analysis of drones is direct on this point: when a drone captures images for videovigilancia purposes affecting private locations, the RGPD applies in full. That means the operator has to meet the information duty in RGPD art. 13, keep a record of the processing activity under art. 30, and adopt security measures proportionate to a risk analysis under art. 32, the same obligations that would apply to a fixed camera doing the same job.

The AEPD's own guidance distils this into a short list of practical steps for anyone operating a drone that captures people: make sure the flight itself complies with the applicable rules; clarify, through a proper contract, who is the data controller and who is a processor if more than one party is involved; carry out a data protection impact assessment where the operation is likely to create real risk; avoid capturing or keeping data that is not needed for the purpose; find the most workable way to inform people who may be affected beforehand; put in place appropriate security measures; and delete or anonymise unnecessary data as soon as possible. That report predates the 2019 EU drone rules and RD 517/2024, so its own aviation-law citations are outdated, but its reasoning about the RGPD still applies, since the RGPD itself has not changed.

Public space, and why a private operator cannot survey it freely

The AEPD's reasoning for fixed cameras also reaches drones by extension: installing cameras to monitor public space is treated as falling within the exclusive competence of the Fuerzas y Cuerpos de Seguridad, under Ley Orgánica 4/1997, and the AEPD applies the same logic to a drone capturing images of people in public places. In practice, that means a private individual or business cannot treat general aerial surveillance of a public street or plaza as an ordinary activity in the way they might, say, film their own property. The equivalent limits for a fixed camera, including how little of the vía pública it may capture, are covered on the security-cameras page.

Filming a neighbour, and what happens after you land

Once a drone has captured footage of an identifiable person, the same RGPD and LOPDGDD principles that apply to any other camera apply to that footage, information duties, retention limits and security among them. Publishing or sharing that footage is a separate question again, governed by the right to one's own image rather than by data-protection law alone; the recording laws page covers that distinct set of rules for recording and sharing people generally.

The scenario that comes up most often in practice is a drone flying over a neighbour's garden or pool. That raises exactly the same privacy concerns as a fixed camera pointed over the fence: capturing identifiable people in what is meant to be a private space, without a clear purpose and without informing them, is the kind of unnecessary capture the AEPD's own guidance tells operators to avoid.

This page is general legal information about Spanish law and does not constitute legal advice in an individual case. The controlling texts are the current versions in the BOE.