Bizum digital identifier: key points and implications for businesses and users

Bizum is no longer just a way to send and receive money. With the gradual rollout of its digital identifier, banks such as CaixaBank, Santander, and BBVA already allow users to register or log in to websites and online platforms using only their phone number and banking app, without the need to create passwords.

For users, the advantage is clear: less friction and greater convenience. For companies looking to integrate it into their websites, however, the issue is not purely technical. It also has legal and data protection implications that should be reviewed before implementation.

What is the Bizum digital identifier and how does it work

The Bizum digital identifier is an authentication system that allows a user to register or access a website by entering their phone number and validating the operation through their bank’s app.

The process is simple. The user accesses a website that has integrated this functionality, enters their phone number, and receives a notification in their banking app. Once confirmed, they are authenticated on the platform.

There are no passwords to remember or long forms to complete. The bank verifies the user’s identity and transmits to the merchant only the information necessary to complete the registration or grant access.

The key to the system is that authentication is shifted from the website to the secure environment of the banking app.

Why Bizum is promoting this system

One of the main challenges in e-commerce is friction during the registration or login process. Many users abandon a purchase or registration when faced with long forms or the need to create a new account with a password.

The Bizum digital identifier reduces this process to two steps: entering the phone number and confirming the operation in the banking app. For merchants already using Bizum as a payment method, its integration can also be seen as a natural extension of their existing digital ecosystem.

From the user’s perspective, it also provides an additional advantage: it limits the exposure of personal data to third-party platforms, as the information shared is minimal and verified by the bank.

What implications it has for companies that integrate it

If a company incorporates the Bizum digital identifier into its website or online store, it is not only enabling a new access method. It is also introducing a new channel for processing personal data that must be reviewed from a legal standpoint.

Before implementing it, special attention should be paid to three key areas.

1. Data protection and GDPR compliance

When a user registers or logs in using the Bizum identifier, the company receives certain personal data transmitted by the bank. Even if the data is minimal, it still constitutes the processing of personal data subject to the General Data Protection Regulation (GDPR).

This requires companies to:

• Update their privacy policy to reflect the use of the Bizum identifier as an authentication method.
• Explain what data is received through this channel and for what purposes it is processed.
• Ensure there is a valid legal basis for processing, typically the performance of a contract or, in some cases, consent.
• Guarantee that users can exercise their data rights regarding information obtained through this system.

The fact that identity verification is handled by the bank does not remove the company’s obligations as the data controller of the information it receives.

2. Review of terms and conditions

Integrating the Bizum digital identifier involves accepting the service terms established for merchants and platforms that implement it.

These terms may include restrictions on how user data can be used, requirements for managing consent, and technical and organizational obligations related to security and data protection.

For this reason, it is advisable to review these terms carefully before activation and ensure they align with the company’s business model and data practices.

3. Internal audit of the data received and stored

Introducing a new authentication system is also an opportunity to review the company’s data map. In many organizations, a common issue is not just receiving personal data, but not having a clear understanding of what data is collected, where it is stored, who has access to it, and how long it is retained.

With the Bizum identifier, it is essential to answer basic questions: what data the website receives, where it is stored, which departments or providers have access to it, and what the applicable retention period is.

It is not enough to integrate the tool and ensure it works. You must also know precisely what information enters your organization and how it is managed.

What individual users should keep in mind

For users, the Bizum digital identifier can significantly simplify access to websites and online platforms. However, there are a few key points to keep in mind.

It is important to remember that:

• Users can check which websites or services have requested access via the identifier through their banking app.
• They can revoke access at any time directly from the bank’s app.
• Logging in with Bizum is not the same as paying with Bizum; they are different functionalities.
• The information shared is minimal but still constitutes personal data processing.

The bank does not share full financial data or transaction history with the merchant, but it does transmit enough information to identify the user and enable access or registration.

What companies should not overlook

User convenience and improved conversion rates should not obscure a key reality: integrating the Bizum digital identifier is not a legally neutral decision.

If a company receives personal data through this system, it must properly document the processing, update its legal texts, and ensure that the integration complies with data protection obligations.

The fact that the system relies on banking infrastructure may create a false sense of full compliance. However, responsibility for the subsequent use of the data lies with the entity that receives and processes it within its own systems.

If you also use Bizum as a payment method, it is important to note that in 2026 the Spanish Tax Agency has strengthened its fiscal control over these transactions.

How to integrate the Bizum identifier with legal safeguards

The Bizum digital identifier can be a useful tool to reduce friction in e-commerce and improve the user experience. When properly implemented, it can facilitate registration and access while strengthening customer trust.

If your company is considering implementing it, you should at least:

• Review and update your privacy policy to reflect the new authentication channel.
• Assess the legal basis for processing the data received.
• Ensure that the service terms are compatible with your actual operations.
• Audit what data enters your systems, where it is stored, and who can access it.
• Verify that the use of the Bizum identifier aligns with your overall GDPR compliance framework.

The usefulness of the system does not eliminate the need to integrate it with proper compliance measures from the outset.

In short, the Bizum digital identifier simplifies user access and can provide real value to businesses, but its implementation must be carried out with the appropriate legal safeguards. Technology can reduce friction, but it does not replace compliance.

At navarro, we advise on GDPR compliance and the legal obligations triggered by any new digital channel. You can contact us using the form below.