España · Ley Orgánica de Protección de Datos (LOPDGDD)
TL;DR
Websites targeting users in Spain must comply with GDPR as implemented locally through the Ley Orgánica de Protección de Datos (LOPDGDD). The supervisory authority is the Agencia Española de Protección de Datos (AEPD). Notable enforcement: CaixaBank fined for marketing violations (€6 million). Use our free scanner below to check your website instantly.
Free audit — 25+ automated checks in 60 seconds
Scan My Website Free →Authority
Agencia Española de Protección de Datos (AEPD)
Website
www.aepd.es ↗Local Law
Ley Orgánica de Protección de Datos (LOPDGDD)
Language
Spanish
Largest Fine
€6 million
Population
47 million
Explicit consent needed for commercial emails (LSSI-CE)
Cookie policy must be clearly visible
DPO is mandatory for many organizations including healthcare, financial, and telecom
National ID number (DNI) has special protections
Data breach notifications to AEPD within 72 hours
Right to digital disconnection for employees
Spain's LOPDGDD includes unique provisions like the right to digital disconnection and digital testament. The AEPD is among the most prolific enforcers in Europe, issuing hundreds of fines annually, often targeting SMEs as well as large corporations.
Cookie consent banner that requires opt-in before non-essential cookies
Privacy policy available in Spanish
Clear identification of data controller and contact details
Data Processing Agreement (DPA) with all third-party processors
Lawful basis documented for each processing activity
Data Subject Access Request (DSAR) process in place
Data breach notification procedure compliant with 72-hour rule
Data Protection Impact Assessment for high-risk processing
International data transfer mechanisms documented (SCCs, adequacy decisions)
Records of processing activities (ROPA) maintained
In Spain, websites must comply with GDPR as implemented by the Ley Orgánica de Protección de Datos (LOPDGDD). Key requirements include obtaining explicit consent before setting non-essential cookies, providing a clear privacy policy, appointing a DPO when required, and notifying data breaches within 72 hours to the Agencia Española de Protección de Datos (AEPD).
The Agencia Española de Protección de Datos (AEPD) is the supervisory authority responsible for enforcing data protection laws in Spain. They can investigate complaints, conduct audits, and issue fines up to €20 million or 4% of annual global turnover.
Use PrivacyChecker's free scanner to perform an instant audit of your website. Our tool checks 25+ compliance points including cookie consent, privacy policy presence, security headers, tracker detection, and more — all relevant to Spain's GDPR requirements.
Find out in 60 seconds with our free GDPR scanner
Run Free Audit →