Checked on September 27, 2026
GDPR in Spain
How the GDPR works in Spain: the supervisory authority, the national law that supplements the regulation, and where to notify a breach.
- Supervisory authority
- Spanish Data Protection Agency (AEPD) (Agencia Española de Protección de Datos)
- National law supplementing the GDPR
- Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights (LOPDGDD) · Ley Orgánica 3/2018, de 5 de diciembre, de Protección de Datos Personales y garantía de los derechos digitales · Ley Orgánica 3/2018
- Age of digital consent
- 14
- Breach notification
- sedeaepd.gob.es/sede-electronica-web/vistas/formBrechaSeguridad/nbs/procedimientoBrechaSeguridad.jsf
- National specifics
- Art. 34 LOPDGDD lists sectors that must appoint a DPO regardless of size; DPO appointments/removals must be notified to the AEPD within 10 days.
- Breach notifications must be filed electronically through the AEPD e-office form.
Where does your company stand?
The free assessment applies these national rules to your answers and scores every area of the law.
Sources
- www.aepd.es/en/rights-and-duties/fulfill-your-duties/measures-compliance/notification-of-personal-data-breach-to-the-supervisory-authority
- sedeaepd.gob.es/sede-electronica-web/vistas/formBrechaSeguridad/nbs/procedimientoBrechaSeguridad.jsf
- letslaw.es/en/minors-consent-regarding-privacy/
- cms.law/en/int/expert-guides/cms-expert-guide-to-data-protection-and-cyber-security-laws/spain
National laws and portals change. This page is general information, not legal advice; confirm with the authority before relying on it.