Your Jurisdiction at a Glance — Spain

GDPR + Organic Law 3/2018 on Data Protection and Digital Rights (LOPDGDD)

Authority: Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD)

Requirements to remember

Spain
  • Data Protection Officer mandatory for the sectors listed in Art. 34 LOPDGDD, e.g. schools, insurers, financial institutions and energy suppliers
  • Age of digital consent: 14 years
  • Catalogue of digital rights, e.g. digital disconnection for employees
  • Data breach notification to the AEPD within 72 hours (Art. 33 GDPR)

Where the programme covers them

  • Task 2 of this workshop: document Spain in the data protection scope document, together with sector rules and other countries you operate in
  • Workshop 2: governance, roles and the data protection officer
  • Workshop 3: records of processing activities
  • Workshop 8 and 9: risk assessment and security measures
  • Workshop 10: vendors, processors and international transfers
  • Workshop 11: data breaches and notification deadlines
ResGuard — Data Protection Workshop 1 · Task 1 · Jurisdiction: Spain Slide 9 of 10