English
Español 
Deutsch Data Protection and GDPR in Spain
Organisations operating in Spain must apply the EU GDPR together with Spain's LOPDGDD and sector-specific rules. Effective compliance requires more than a privacy notice: processing records, lawful bases, contracts, security and response procedures must match real operations.
Map the personal data you actually use
A compliance project begins with data flows: customers, employees, applicants, suppliers, website users, CCTV, marketing contacts and special-category information. The controller, processors, purposes, systems, recipients and retention periods should be identified.
Lawful basis and transparency
Consent is only one lawful basis and is not always appropriate. Contract, legal obligation, legitimate interests and other grounds may apply depending on purpose.
Privacy information must be concise, accessible and consistent with actual processing.
Purpose and lawful basis
Retention or deletion criteria
Recipients and international transfers
Rights and complaint information
Automated decisions or profiling
Processors and international transfers
Cloud providers, payroll firms, marketing platforms and other suppliers may process data on behalf of the business. Article 28 terms, security, sub-processors and deletion duties should be documented.
Transfers outside the EEA require an appropriate GDPR transfer mechanism and risk assessment where applicable.
Security and personal-data breaches
Measures should reflect risk: access control, backups, encryption, patching, staff training and incident response. A personal-data breach must be assessed promptly; some breaches require notification to the AEPD within 72 hours and communication to affected people.
Cookies, marketing and employee data
Spanish rules affect electronic marketing and cookies in addition to GDPR. Non-essential trackers generally require consent, and consent withdrawal must be easy.
Employee monitoring, CCTV, biometric data and whistleblowing systems require separate proportionality and information analysis.
Useful official resources
Official requirements, fees and procedures can change. The competent authority and current rules are checked for each individual case.
Questions about Data Protection and GDPR in Spain
Does every company need a data protection officer?
No. A DPO is mandatory only in defined cases, though voluntary appointment is possible.
Is consent always required?
No. The correct lawful basis depends on the purpose and relationship.
When must a breach be reported?
A qualifying breach should be notified to the supervisory authority within 72 hours where feasible; risk determines the duty.
Does a cookie banner solve compliance?
No. The banner, settings, scripts, cookie policy and consent records must operate consistently.
Continue with FLIN
All administrative services
Return to the overview of English-speaking administrative assistance throughout Spain.
View all services →Contact FLIN
Describe the matter, location and relevant deadline so that we can assess the appropriate next step.
Contact us →Discuss your case in English
Send us the relevant documents and tell us the location, circumstances and any deadline. We will confirm the next practical step and whether specialist legal, tax or technical advice is required.
Important: This page provides general information and does not replace individual legal, tax, labour, medical or technical advice. Authorities decide applications and disputes independently. Requirements and practice may change.