AEAT-Barcelona 2026 Agreement: New Security Obligations for Tax Data Access

Key data

The Barcelona City Council has had direct access to AEAT tax information since 2022. Now, the amendment signed on September 22, 2026 and published in the Official Gazette on September 29, 2026 renews that access with significantly more stringent security conditions. The agreement is extended for up to four additional years, but in exchange the City Council assumes new internal control obligations that must be operational from September 18, 2026.

The change is significant: the data control and security clause has been completely rewritten to comply with GDPR, LOPDGDD, and the National Security Scheme. This transforms what was an information exchange agreement into a regulatory compliance framework with periodic and verifiable obligations.

What does this regulation establish?

The amendment modifies the original 2022 agreement on one central point: the data control and security clause. Below are the specific changes it introduces:

The legal basis for data exchange remains Article 95 of the General Tax Law, which allows the transfer of tax information between public administrations for the exercise of their competencies.

Economic and operational impact

For the Barcelona City Council, this amendment represents a direct increase in operational burden in the tax management and data protection area:

• Biweekly audits: the responsible team must review and document all access to AEAT data every two weeks. This requires dedicated human resources on a periodic and systematic basis.
• Continuous training: all municipal officials with authorized access must receive specific training. The cost and logistics will depend on the number of enabled users, a figure not specified in the amendment.
• Complete traceability: the City Council must implement or strengthen query logging systems that allow identification of who accessed, when, and what information. This may require technological adaptations in municipal systems.
• Suspension risk: if the AEAT detects anomalies, it can unilaterally cut off access. Losing this direct access to tax data could paralyze municipal tax management procedures that depend on that information.

From the perspective of citizens and companies operating in Barcelona, the amendment strengthens guarantees on how the City Council handles their tax data, reducing the risk of unauthorized access or misuse.

Who does it affect?

• Barcelona City Council: is the main obligated party. It must adapt its internal processes, technological systems, and staff training to the new requirements.
• Municipal officials with access to tax data: are subject to new traceability controls, mandatory training, and anti-fraud mechanisms.
• AEAT: assumes the role of compliance supervisor, with authority to suspend access upon detection of any anomaly.
• Taxpayers with activity in Barcelona: their tax data shared with the City Council falls under a more robust protection framework.
• Other city councils with similar agreements with the AEAT: this amendment may be the model that the AEAT replicates in future agreements or renewals with other municipalities.

Practical example

A tax management technician from the Barcelona City Council accesses the AEAT platform to consult income data of a taxpayer within the framework of a municipal capital gains proceeding. With the amendment in force, that access is automatically recorded in the municipal traceability system. Every two weeks, the City Council's security officer reviews the access log in the mandatory biweekly audit.

If that audit detects that the technician consulted data of a taxpayer without an open proceeding to justify it, the City Council must activate the conflict of interest control mechanism provided for in the amendment. If the AEAT detects on its part a pattern of anomalous queries before the City Council notifies it, it can suspend access immediately, blocking all municipal procedures that depend on that information.

What should companies do now?

This regulation directly affects the Barcelona City Council and its officials, not private companies. However, if you are a tax advisor, manager, or company with activity in Barcelona, it is worth knowing the framework. For the City Council, priority actions are:

1. Review and update the data security clause in internal systems to align it with GDPR, LOPDGDD, and the National Security Scheme, effective from September 18, 2026.
2. Implement the biweekly audit system for access to AEAT data: define responsible party, registration format, and review procedure every two weeks.
3. Identify all authorized users with access to AEAT tax data and organize the mandatory training provided for in the amendment.
4. Activate or strengthen the query traceability system: each access must be recorded with user identification, date, time, and linked proceeding.
5. Establish the conflict of interest protocol: define what situations trigger the control mechanism and who is responsible for managing alerts.
6. Communicate to the AEAT the implementation of the new measures if required by the extension activation procedure, to ensure continuity of access.

Official source

Consult complete regulation at official source

Disclaimer: This article is for informational purposes only and does not constitute legal advice. For specific decisions, consult a qualified professional. Source: https://www.boe.es/diario_boe/txt.php?id=BOE-A-2026-20242