Key data
| Regulation | Royal Decree 807/2026, of October 7, regulating the State DNA Bank of Victims of War and Dictatorship |
|---|---|
| Publication | October 8, 2026 |
| Entry into force | October 8, 2026 |
| Affected parties | Families of missing persons from the Civil War, Dictatorship and victims of baby abduction; accredited forensic laboratories; autonomous communities with their own databases |
| Responsible body | National Institute of Toxicology and Forensic Sciences |
| Enabling legal framework | Democratic Memory Law of 2022 |
| Category | Regulatory Changes |
| Year | 2026 |
As of October 8, 2026, Spain has a centralized register of genetic profiles to identify missing persons from the Civil War and Dictatorship. The Royal Decree 807/2026 develops the mandate of the Democratic Memory Law of 2022, which ordered the creation of this database but had not been executed until now.
The direct impact is twofold: for families of victims, it means a unified channel with legal guarantees to provide DNA samples and receive results. For forensic laboratories and autonomous communities, it implies new accreditation and data integration obligations.
What does this regulation establish?
Royal Decree 807/2026 regulates four major areas: bank organization, technical operation, ethical guarantees and data protection, and laboratory accreditation. Below are the specific elements it establishes:
| Element | Regulated detail |
|---|---|
| Body responsible for data processing | National Institute of Toxicology and Forensic Sciences |
| Category of data under GDPR and LOPDGDD | Data of special protection (genetic data) |
| Access to the database | Exclusive to laboratories accredited by the National Commission for Forensic DNA Use |
| Stored data | Only genetic profiles. No direct identifying data (name, address or others) are stored |
| Integration of existing databases | Profiles already existing in autonomous communities and newborn abduction database |
| Main objective | Unify dispersed information and guarantee equal rights throughout the national territory |
The regulation is especially relevant in terms of data protection: as it involves genetic profiles, they fall under the strictest regime of the GDPR and LOPDGDD as special category data. The National Institute of Toxicology assumes responsibility for processing, which means that any access or transfer of data must be channeled through this body.
Economic and operational impact
This regulation does not generate direct costs for private companies in general, but it does have specific operational consequences for two types of actors:
- Private or public forensic laboratories: They may only analyze samples and access the database if they obtain and maintain accreditation from the National Commission for Forensic DNA Use. Laboratories that were already operating in autonomous communities without this specific accreditation must regularize their situation.
- Autonomous communities with their own databases: They have the obligation to integrate their existing genetic profiles into the state bank. This involves data migration processes, review of data protection protocols and coordination with the National Institute of Toxicology.
For families of victims, the impact is positive: the centralized system eliminates the territorial inequality that existed until now, where access to this type of identification depended on the resources and willingness of each autonomous community.
Who does it affect?
- Families of missing persons from the Civil War and Dictatorship who wish to provide DNA samples to identify their relatives.
- Victims of baby abduction and their biological families, whose database is integrated into the state bank.
- Forensic laboratories (public and private) that perform DNA analysis for the purpose of identifying historical victims: they must be accredited by the National Commission for Forensic DNA Use.
- Autonomous communities that have their own databases of genetic profiles of victims: they must integrate them into the state system.
- National Institute of Toxicology and Forensic Sciences: assumes responsibility as the data controller.
- Data protection officers in bodies that process or transfer genetic profiles within the framework of this bank.
Practical example
An autonomous community that, since 2015, has been collecting DNA samples from relatives of victims of Francoism and has generated its own database of genetic profiles, must now integrate those profiles into the State Bank managed by the National Institute of Toxicology and Forensic Sciences.
To do so, it must: (1) verify that the laboratory that performed the analyses has accreditation from the National Commission for Forensic DNA Use; (2) adapt data processing protocols to the GDPR and LOPDGDD framework as special category data; and (3) coordinate with the National Institute of Toxicology the technical process of migration and integration.
If the regional laboratory does not have the required accreditation, it will not be able to access the state database or perform new analyses within the framework of this system, which would require referring analyses to an accredited laboratory.
What should organizations do now?
- Forensic laboratories: Verify if they have accreditation from the National Commission for Forensic DNA Use. If they do not have it, initiate the accreditation process before performing any analysis or requesting access to the state database.
- Autonomous communities: Identify existing genetic profiles in their own databases and plan their integration into the State Bank, coordinating with the National Institute of Toxicology and Forensic Sciences.
- Data protection officers: Review activity records for processing to include, where appropriate, the processing of genetic profiles under the category of specially protected data under GDPR and LOPDGDD.
- Bodies managing the newborn abduction database: Coordinate with the National Institute of Toxicology the integration of their data into the unified system.
- Families of victims: May contact the National Institute of Toxicology and Forensic Sciences to learn about the official procedure for providing DNA samples through the state bank.
Frequently asked questions
What laboratories can access the State DNA Bank for victims?
Only laboratories accredited by the National Commission for Forensic DNA Use. Without this accreditation, no laboratory—public or private—can analyze samples or consult the state database. Laboratories operating within autonomous community databases must verify if they have this specific accreditation.
What data is stored in the bank and how is it protected?
The bank stores exclusively genetic profiles. No direct identifying data such as name or address are stored. As genetic data, they are classified as special category data under the GDPR and LOPDGDD, which implies the highest level of protection. The data controller is the National Institute of Toxicology and Forensic Sciences.
Must autonomous communities with their own databases integrate into the state bank?
Yes. Royal Decree 807/2026 expressly establishes that genetic profiles already existing in autonomous communities must be integrated into the State Bank. The newborn abduction database is also integrated. The objective is to unify dispersed information and guarantee equal rights throughout the territory.
When does this regulation come into force?
Royal Decree 807/2026 came into force on the same day as its publication in the BOE: October 8, 2026. There is no explicit transitional period mentioned in the regulatory summary, so obligations are enforceable from that date.
What law provides coverage for this Royal Decree?
Royal Decree 807/2026 develops the mandate of the Democratic Memory Law of 2022, which ordered the creation of the State DNA Bank but did not regulate its detailed operation. This Royal Decree covers that regulatory development: organization, operation, ethical and biosafety guarantees.
Official source
Consult complete regulation in official source
Notice: This article is for informational purposes only and does not constitute legal advice. For specific decisions, consult a qualified professional. Source: https://www.boe.es/diario_boe/txt.php?id=BOE-A-2026-20910
