#
Comprehensive, actively-enforced accountability framework; breach and DPO statistics confirm real operative traction.
Sub-modules (7)
Accountability And DpiaGreen
Accountability (Art 5(2)) is operationalised via ROPA construction, risk analysis, and DPIA (EIPD) execution as sequential compliance steps recommended by AEPD.
Claims (1):
- AEPD's recommended RGPD-adaptation roadmap treats risk analysis and DPIA (EIPD) execution as core accountability tasks alongside ROPA construction and breach-notification mechanisms.
Dpo RequirementsGreen
GDPR Art 37.1 mandatory-DPO triggers (public authority, large-scale systematic monitoring, large-scale special-category processing) are extended by LOPDGDD Art 34 to additional categories of private entities (e.g. schools, sports federations processing minors' data). By end-2025, 126,176 DPOs were registered with AEPD.
Claims (2):
- A DPO must be appointed where processing is carried out by a public authority, where core activities require regular and systematic large-scale monitoring of data subjects, or where core activities involve large-scale processing of special-category or criminal-conviction data; LOPDGDD Art 34 extends mandatory designation to further categories of entity.
- By the close of 2025, 126,176 DPOs were registered with AEPD (116,007 private sector, 10,169 public sector), up from 119,803 in 2024.
Ropa RequirementsGreen
Art 30 ROPA obligation replaced the former file-registration regime; ROPA is an internal document made available to AEPD on request, not filed with the Agency.
Claims (1):
- The Registro de Actividades de Tratamiento (ROPA) required by Art 30 GDPR is an internal document that must be made available to AEPD on request but does not need to be filed with or published to the Agency.
Joint Controller ArrangementsAmber
No ES-specific Art 26 joint-controller instrument beyond direct GDPR application and EDPB controller/processor guidance was located in this pass.
Absence provenance: unavailable. Searched: AEPD corresponsables tratamiento articulo 26.
Security MeasuresAmber
Art 32 security-of-processing obligations are actively enforced; AEPD's 2026 CaixaBank decision found repeated breaches attributable to systemic design and organisational deficiencies rather than isolated errors.
Claims (1):
- AEPD confirmed a €500,000 fine (reduced to €400,000 on voluntary payment) against CaixaBank in March 2026 for repeated data breaches between 2022-2024 stemming from systemic design and organisational deficiencies rather than isolated human errors.
Breach NotificationAmber
Controllers must notify AEPD without undue delay and within 72 hours of becoming aware of a personal data breach (Art 33); breach-related sanctioning procedures rose sharply in 2025.
Claims (2):
- Controllers must notify AEPD of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, per Art 33 GDPR.
- AEPD's 2025 annual report recorded a 157% rise in breach-related sanctioning/reprimand procedures (30 in 2024 to 77 in 2025), yielding fines totalling approximately €19.8 million.
Retention And DisposalAmber
No ES-specific retention/disposal instrument beyond GDPR's storage-limitation principle (Art 5.1(e)) was surfaced in this research pass.
Absence provenance: unavailable. Searched: AEPD plazos conservacion supresion datos personales.
Controller/Processor Duties
Three substantial fines this cycle turn on the same underlying accountability failure: an inadequate data protection impact assessment for biometric processing. The AEPD fined Aena EUR10,043,002 for deploying biometric-boarding facial recognition at eight airports without a DPIA that adequately assessed proportionality against less-intrusive alternatives, the largest of the three penalties and the clearest signal that the AEPD expects controllers to demonstrate genuine consideration of alternatives before deploying biometric systems at scale. Separately, the AEPD fined FC Barcelona EUR500,000 in March 2026 for a deficient biometric DPIA, covering facial and voice data collection for approximately 143,000 club members, again turning on DPIA adequacy rather than on the underlying lawfulness of the processing itself.
Read together with the Yoti finding on unlawful biometric processing and invalid consent, these three actions establish DPIA adequacy for biometric systems as a distinct and currently very active enforcement front for the AEPD, spanning aviation, professional sport, and digital identity verification. The common thread across Aena and FC Barcelona is not that biometric processing itself was unlawful in principle, but that the controllers had not conducted or documented an assessment rigorous enough to justify the proportionality of the chosen approach against less intrusive alternatives.
Outlook
The pattern across three unrelated sectors this cycle suggests the AEPD is applying a consistent, elevated bar for DPIA adequacy specifically where biometric data is involved, and organisations deploying facial recognition, voice biometrics, or similar systems in Spain should expect continued scrutiny of their DPIA documentation. Whether this enforcement pattern extends into further sectors, and how the Yoti appeal to the Audiencia Nacional resolves, will indicate whether the current DPIA-adequacy standard for biometric systems is durable or subject to judicial narrowing.
1 further periodic run re-emitted the standing brief unchanged and is not shown.
Sources and claims (7)
- ConfirmedAgencia Española de Protección de Datos — AEPD's recommended RGPD-adaptation roadmap treats risk analysis and DPIA (EIPD) execution as core accountability tasks alongside ROPA construction and breach-notification mechanisms.observed
- ConfirmedAgencia Española de Protección de Datos — A DPO must be appointed where processing is carried out by a public authority, where core activities require regular and systematic large-scale monitoring of data subjects, or where core activities involve large-scale processing of special-category or criminal-conviction data; LOPDGDD Art 34 extends mandatory designation to further categories of entity.observed
- ConfirmedAgencia Española de Protección de Datos — By the close of 2025, 126,176 DPOs were registered with AEPD (116,007 private sector, 10,169 public sector), up from 119,803 in 2024.observed
- ConfirmedAgencia Española de Protección de Datos — The Registro de Actividades de Tratamiento (ROPA) required by Art 30 GDPR is an internal document that must be made available to AEPD on request but does not need to be filed with or published to the Agency.observed
- ConfirmedDataGuidance — AEPD confirmed a €500,000 fine (reduced to €400,000 on voluntary payment) against CaixaBank in March 2026 for repeated data breaches between 2022-2024 stemming from systemic design and organisational deficiencies rather than isolated human errors.observed
- ConfirmedAgencia Española de Protección de Datos — Controllers must notify AEPD of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, per Art 33 GDPR.observed
- ConfirmedAgencia Española de Protección de Datos — AEPD's 2025 annual report recorded a 157% rise in breach-related sanctioning/reprimand procedures (30 in 2024 to 77 in 2025), yielding fines totalling approximately €19.8 million.observed