GDPR services / Spain
GDPR and LOPDGDD in Spain — what each demands of your business
The GDPR is the European regulation, directly applicable in Spain with no transposition needed. The LOPDGDD — Ley Orgánica 3/2018 on the protection of personal data and the guarantee of digital rights — is the Spanish law that develops it, sharpens it and adds obligations of its own. Your business answers to both, before a single authority: the AEPD.
Acting for a client? We are appointed behind professional advisers and report to you. Your relationship with your client stays yours.
What each law does, in plain terms
The GDPR sets the framework
The principles (lawfulness, minimisation, accountability), the legal bases, data subjects’ rights, the controller and processor roles, impact assessments, breach handling and the sanctions regime. It is identical across the EU and needs no national law to apply.
The LOPDGDD adds the Spanish small print
Where the regulation leaves room, Spain has filled it in: who must appoint a DPO (Article 34), the duty to block data (Article 32), the age of consent for minors set at 14, concrete rules for CCTV and internal whistleblowing systems, and a whole title of digital rights — disconnection, privacy against company devices and more.
Controller, processor and DPO — the distinction that orders everything
Three roles that turn up confused in audit after audit — and whose confusion invalidates whole contracts and notices.
- CONTROLLER: who decides the purposes and means — your business, for its own customer and employee data
- PROCESSOR: who processes on the controller’s behalf — the payroll provider, the accountancy firm, the cloud platform; it needs an Article 28 contract
- DPO (delegado de protección de datos): the independent role that supervises and advises — it decides no purposes, processes for nobody, and answers for its judgement to the AEPD
Which box each supplier and department falls into decides the contracts to sign, the notices to give and the responsibilities assumed. Putting it in order is usually the first deliverable of our GDPR audit.
What the LOPDGDD demands that the GDPR never mentions
- Article 34: the Spanish list of entities that must appoint a DPO — broader than the three European triggers
- Article 32: the duty to block — rectified or erased data is kept immobilised for the limitation periods of possible liabilities
- Article 7: minors’ consent valid from age 14
- Article 22: presumptions and specific rules for CCTV
- Article 24: internal whistleblowing information systems
- Title X: digital rights — digital disconnection, privacy against company devices and workplace geolocation
None of these obligations appears in a generic GDPR template written for the whole of Europe. It is the layer that separates a provider who knows Spain from one who translates documents.
How we cover it
One programme that treats the GDPR and the LOPDGDD as what they are — a single obligation with two sources. An audit against both laws, an outsourced DPO notified to the AEPD, records and Article 28 contracts in order, and — for businesses with UK customers — UK GDPR coverage from our United Kingdom entity, verifiable at Companies House (17350509), alongside the European one on the Malta Business Registry (C 95774).
Questions, answered
What is the difference between controller, processor and DPO in Spain?
Three distinct roles the GDPR defines precisely. The controller decides the purposes and means — your business, for its own data. The processor processes on the controller’s behalf — your payroll provider, your accountancy firm, your cloud platform. And the DPO (delegado de protección de datos) processes for nobody: it is the independent role that supervises compliance, advises, and acts as the point of contact with the AEPD. Confusing them is the most frequent error we find in audits.
If we comply with the GDPR, do we already comply with the LOPDGDD?
Not automatically. The LOPDGDD develops the European regulation for Spain and adds obligations of its own: the Article 34 list of entities that must appoint a DPO, the Article 32 duty to block data, the age of consent for minors set at 14, specific rules for CCTV and internal whistleblowing systems, and a whole title of digital rights. A business can have the GDPR reasonably covered and still be in breach of purely Spanish obligations.
What is the Article 32 LOPDGDD duty to block?
A Spanish particularity: when data is rectified or erased, the controller must block it — keep it immobilised, available exclusively to judges, courts, the public prosecutor or the competent administrations, for the limitation periods of possible liabilities. It is not simple deletion: it is a concrete technical and organisational obligation that many foreign GDPR template providers never even mention.
Can a Malta and UK firm run Spanish compliance?
The GDPR is directly applicable across the EU, and our European entity — Privacy Core Services Ltd, C 95774, Malta — is established inside the same framework as your business. We work the Spanish layer (LOPDGDD, AEPD criteria and guidance) as part of the service, the DPO appointment is notified to the AEPD as with any local provider, and we add something a purely local provider does not have: UK GDPR coverage from our British entity for clients with UK exposure.
Start with a short conversation
Tell us what your business processes and for whom, and we will tell you plainly what the GDPR and the LOPDGDD require — and what they do not. No automated signup; we reply within one business day.