Bizum Digital ID: How It Works and What Businesses Must Review

Bizum Digital ID lets a user register or sign in to a website or app with a mobile number and confirmation in the banking app. It is not a payment and should not be presented as a universal public identity credential: it is an authentication service whose availability, attributes and terms depend on the integration offered by Bizum and the relevant bank.

What the business actually receives

Bizum says users can authorise the data needed for registration or access and can review or withdraw permissions. The integrating business must confirm in the technical and contractual documents which attributes it receives, who discloses them, how long they are kept and what withdrawal changes. It should not infer that it receives financial data or identity evidence suitable for every regulatory purpose.

Bank authentication does not remove the company's duties

When a company uses the data to create an account, deliver a service, prevent fraud or retain an access history, it processes personal data. The roles of the merchant, bank, Bizum and technical suppliers follow their actual purposes and means; they are not settled by a generic processor label or blanket consent.

Pre-integration checklist

1. Map the flow: data requested, received, stored, shared and deleted.
2. Define purpose and legal basis: separate account creation, authentication, contract performance, security and optional uses.
3. Update privacy information: identify actors, data, purposes, retention, rights and any transfers.
4. Minimise: request only the attributes required for each use case.
5. Review contracts and suppliers: document roles, instructions, security, incidents, subprocessors and deletion or return.
6. Design security and recovery: protect sessions and accounts, retain proportionate logs and offer a secure fallback method.
7. Set retention: distinguish account data from technical or security records.
8. Assess risk: using Bizum does not automatically require a DPIA; one is required where the planned processing is likely to create high risk.

Practical decision

Before activation, the company should be able to state in writing which problem the integration solves, which data enters its systems, why it is used and when it is deleted. NRRO can review the flow, contracts and legal notices for an identified integration; technical and security validation must be coordinated with the responsible provider.

Official sources

• Bizum: Digital ID.
• General Data Protection Regulation.

Reviewed on 26 August 2026. Allocation of responsibility requires the actual integration and contracts to be reviewed.