Identification Request FAQ

ISE collects ID numbers to ensure the physical safety and security of all attendees. Collecting attendee identity data enables ISE to be aware of the identity of all attendees and, if strictly necessary due to concrete threats or risks to the event, to share this data with the Spanish police only following a formal request from them.  This supports targeted risk assessment and preventive action before anyone enters the venue. Identity verification by police is not a replacement for, but an enhancement of, existing access controls.

ISE processes passport data based on its legitimate interest in ensuring the physical safety and security of all attendees. This purpose is necessary given the event’s growth and international scale – over 85,000 attendees from more than 150 countries, high-profile governmental delegations and substantial media and public attention.

The measure is necessary because effective identification by ISE and background checks by police cannot be reliably performed without specific attendee data, including ID numbers. Alternatives such as on-site checks might not be considered operationally effective.

The approach is deemed proportionate by ISE: only the minimum necessary data is collected and shared, strictly for identification and targeted background checks. No more data is processed or disclosed than is required; data is only shared when a concrete security risk or threat presents itself and only if the Spanish police makes a request. All data is protected by robust security and retention limits.

In balancing interests, ISE attaches great importance to the privacy of attendees and gives substantial weight to this consideration. However, in this context, ISE has determined that ensuring the safety and security of all visitors is the highest priority. After careful assessment, ISE has concluded that these targeted security measures are justified.

Measures are taken to minimise impact:

• ID numbers are only shared with the Spanish police if there is a real, concrete security threat, as identified by ISE's security team or by the Spanish police. The police must provide a formal request before any data is shared.
• Attendees are informed in advance about this processing and potential data sharing as part of ISE's transparency obligations.
• ISE applies short data retention periods: data is deleted irreversibly shortly after the event, unless a security incident requires a longer retention that is strictly limited to what is necessary.
• Technical and organisational security measures protect the data.

Minimal data is collected (see next question).

ISE requests specifically your ID number, together with date of birth and country of issue. The collection does not involve full copies or scans of passports or ID documents, as that would be more intrusive. Information requested is strictly the minimum necessary to reliably identify attendees for background checks and access control.

ISE’s processor, GES, which provides the registration system in which you have provided your data, operates under strict confidentiality.

ID data would only be shared with Spanish police based on a formal request, in the event of specific and credible security risks that require background checks. The use of this data is strictly controlled; there is no routine or broad sharing of data.

Access to ID data is limited to a number of designated ISE staff and, only in case of substantiated security risk, to Spanish police for targeted background checks. ISE’s processor, GES, which provides the registration system in which you have provided your data, operates under strict confidentiality.

ID data is encrypted during storage and transfer and protected with robust technical and organisational safeguards. Only strictly necessary personnel are given access. No data is made public or used for other purposes. GES is also ISO27001 certified, meeting the required information security standards. Refer to the ISE privacy policy for more information on our technical and organisational measures.

ID data is retained until one week after the conclusion of the 2026 event. If an incident occurs that requires further investigation or follow-up by the authorities, data may be kept longer, but only for as long as strictly necessary for that purpose. Thereafter, all data is irreversibly deleted.

Advance collection and verification are necessary for effective, timely vetting and for the police to perform risk checks. On-site-only presentation is insufficient, as checks cannot be performed thoroughly or quickly enough to prevent entry by high-risk individuals, especially during peak times. Providing only the last digits or partial data is not sufficient for identification.

No. ID data is used only if strictly necessary, for targeted background checks by the police. The data is not disclosed to other parties, nor used for commercial or unrelated purposes.

ISE’s privacy policy can be found here: Your Privacy & Data Protection at ISE 2026.