Spain's RGPD & LOPD Guide for Businesses: Data Protection Obligations Explained

If you operate a business in Spain or plan to expand into the Spanish market, understanding the RGPD (Reglamento General de Protección de Datos — Spain's name for the EU GDPR) and LOPDGDD (Ley Orgánica de Protección de Datos y Garantía de los Derechos Digitales) is non-negotiable. The LOPDGDD is Spain's domestic law that adapts and supplements the EU GDPR, in force since December 2018.

As of 2025, Spain's data protection authority — the AEPD (Agencia Española de Protección de Datos) — has intensified enforcement around AI-based personal data processing and cookie tracking compliance. This guide breaks down the key obligations every business needs to know.

How RGPD and LOPDGDD Relate

The EU GDPR applies directly across all member states. The LOPDGDD fills in the gaps where the GDPR allows national discretion, tailoring rules to the Spanish legal context.

Aspect	RGPD (EU GDPR)	LOPDGDD (Spanish law)
Scope	All of EU	Spain specifically
Legal nature	EU regulation (direct effect)	Organic law (supplementary)
Max fine	EUR 20M or 4% of global turnover	Same as GDPR
Supervisory authority	Each member state's DPA	AEPD

6 Core Obligations for Businesses

1. Consent Management (Consentimiento)

When collecting personal data, you need explicit, freely given consent. Pre-ticked checkboxes don't count. Withdrawing consent must be as easy as giving it.

2. Data Protection Officer (DPO)

Under the LOPDGDD, certain organizations must appoint a DPO:

• Public bodies
• Healthcare, education, and financial institutions
• Companies that regularly and systematically process personal data at scale
• Insurance companies and telecoms

3. Records of Processing Activities (Registro de Actividades)

Even if you have fewer than 50 employees, you must maintain processing records if you handle sensitive data or process personal data on a regular basis.

4. Breach Notification (Notificación de Brechas)

If a personal data breach occurs, you must notify the AEPD within 72 hours. If the breach poses a high risk to individuals' rights, you must also notify the affected data subjects.

5. Data Protection Impact Assessment (EIPD)

Before starting high-risk processing activities — such as profiling, large-scale monitoring, or processing sensitive data — you must conduct a Data Protection Impact Assessment (Evaluación de Impacto en la Protección de Datos).

6. Digital Rights

The LOPDGDD goes beyond the GDPR by establishing digital rights not covered by EU law:

• Employees' right to digital disconnection
• Rules on workplace video surveillance
• Enhanced protections for minors' data

Recent AEPD Enforcement Trends

In 2025, the AEPD has been particularly active in:

• AI and automated processing: Demanding transparency in automated decision-making and profiling
• Cookie compliance: Scrutinizing whether cookie banners provide genuine consent
• International data transfers: Verifying adequate safeguards for transfers outside the EU

AEPD Facilita: A Free Tool for SMEs

The AEPD offers Facilita RGPD, a free online tool for small businesses with low-risk data processing. By answering a few simple questions, you can generate basic compliance documentation automatically. It's especially useful for small companies that don't process sensitive data.

Sharing Compliance Documents Securely

During the compliance process, organizations need to share various internal documents — impact assessments, processing records, DPO contact details, breach response plans. These documents can contain sensitive information themselves.

Sending them through unprotected email or standard messaging apps like iMessage creates additional security risks. With LOCK.PUB, you can share compliance documents through password-protected memo links with expiration dates, ensuring sensitive compliance materials don't linger in inboxes indefinitely.

Penalty Framework

RGPD penalties are tiered based on severity:

Severity	Maximum Fine
Minor violations	EUR 40,000
Serious violations	EUR 300,000
Very serious violations	EUR 20M or 4% of global annual turnover (whichever is higher)

Quick Compliance Checklist

• Have you documented the purpose and legal basis for each data processing activity?
• Are you obtaining valid consent?
• Have you determined whether you need to appoint a DPO?
• Are you maintaining records of processing activities?
• Do you have a breach notification procedure in place?
• Have you conducted impact assessments for high-risk processing?

Data protection compliance in Spain isn't optional — the fines alone make that clear. Use the checklist above as a starting point, and consider secure tools like LOCK.PUB for safely managing and sharing the compliance documentation that keeps your business on the right side of the law.