Data protection in Spain compared to the GDPR

General overview

The Spanish Data Protection Law (Organic Law 3/2018) contains several specifications related to various opening clauses of the GDPR. These pertain to, for example, the rights of data subjects, rules on the mandatory appointment of a Data Protection Officer (DPO), consent from minors, and information obligations. Furthermore, the Spanish Data Protection Law provides additional regulations for the digital rights of citizens and employees, such as rights to internet access, digital education, and digital separation in the workplace.

GDPR opening clauses

Spain has established national regulations for data processing involving minors, data processing for journalistic purposes, and data processing for scientific research.

Key differences and national specifics

Specific data protection laws and official guidelines

Spain has specific data protection laws and official guidelines. These provide detailed information and guidance for compliance with data protection regulations in Spain.

Legal basis and sensitive data

In Spain, there are specific regulations concerning the legal basis for data processing as well as the processing of sensitive data. Companies must ensure that they inform data subjects adequately about the processing of their data.

E-Marketing, cookies, and automated decision-making

Spain has regulations related to e-marketing and the handling of cookies. It is important to note that a new regulation through the ePrivacy Regulation is still pending. Additionally, there are regulations concerning automated decision-making.

Data subject rights and Data Protection Impact Assessments (DPIAs)

Data subject rights in Spain are extensively regulated. Companies should ensure that they respect these rights. Furthermore, companies in Spain should conduct DPIAs in accordance with Spanish regulations.

DPO (Data Protection Officer)

Companies in Spain should ensure that they perform DPIAs according to Spanish provisions. Additionally, there are regulations concerning the appointment of a Data Protection Officer.

Conclusion

Spain has adopted many of the GDPR guidelines but has also introduced some national peculiarities. Companies operating in Spain or conducting business with Spanish citizens should ensure that they fully understand and comply with both the GDPR and Spanish data protection laws.