--- title: "Spain — Controller/Processor Duties | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/spain/controller-processor-duties/ source_html: /jurisdictions/spain/controller-processor-duties/index.html description: "Spain — Controller/Processor Duties: controller_processor_duties Controller/Processor Duties 7 sub-modules 7 claims Green ▾ # Comprehensive, actively-enforced accountability framework; breach and DPO statistics confirm re" generated_at: 2026-10-25T04:46:50Z content_sha256: 843d6dc77297aa20bd686c7e272536471b5d68cbc281c526b5a924381fed3434 generator: "fe-fleet/md-twin@1.0" --- # Spain — Controller/Processor Duties | Data Protection Monitor ### D4Controller/Processor Duties7 sub-modules7 claimsGreen▾# Comprehensive, actively-enforced accountability framework; breach and DPO statistics confirm real operative traction. Primary framework GDPR Arts 5, 24-39 + LOPDGDD Arts 28, 31-37 Supervisory authority [Agencia Española de Protección de Datos (AEPD)](https://www.aepd.es) Traffic-light rationale — Green Comprehensive, actively-enforced accountability framework; breach and DPO statistics confirm real operative traction. #### Sub-modules (7) #### Accountability And DpiaGreen Accountability (Art 5(2)) is operationalised via ROPA construction, risk analysis, and DPIA (EIPD) execution as sequential compliance steps recommended by AEPD. Claims (1): - AEPD's recommended RGPD-adaptation roadmap treats risk analysis and DPIA (EIPD) execution as core accountability tasks alongside ROPA construction and breach-notification mechanisms. #### Dpo RequirementsGreen GDPR Art 37.1 mandatory-DPO triggers (public authority, large-scale systematic monitoring, large-scale special-category processing) are extended by LOPDGDD Art 34 to additional categories of private entities (e.g. schools, sports federations processing minors' data). By end-2025, 126,176 DPOs were registered with AEPD. Claims (2): - A DPO must be appointed where processing is carried out by a public authority, where core activities require regular and systematic large-scale monitoring of data subjects, or where core activities involve large-scale processing of special-category or criminal-conviction data; LOPDGDD Art 34 extends mandatory designation to further categories of entity. - By the close of 2025, 126,176 DPOs were registered with AEPD (116,007 private sector, 10,169 public sector), up from 119,803 in 2024. #### Ropa RequirementsGreen Art 30 ROPA obligation replaced the former file-registration regime; ROPA is an internal document made available to AEPD on request, not filed with the Agency. Claims (1): - The Registro de Actividades de Tratamiento (ROPA) required by Art 30 GDPR is an internal document that must be made available to AEPD on request but does not need to be filed with or published to the Agency. #### Joint Controller ArrangementsAmber No ES-specific Art 26 joint-controller instrument beyond direct GDPR application and EDPB controller/processor guidance was located in this pass. Absence provenance: unavailable . Searched: AEPD corresponsables tratamiento articulo 26. #### Security MeasuresAmber Art 32 security-of-processing obligations are actively enforced; AEPD's 2026 CaixaBank decision found repeated breaches attributable to systemic design and organisational deficiencies rather than isolated errors. Claims (1): - AEPD confirmed a €500,000 fine (reduced to €400,000 on voluntary payment) against CaixaBank in March 2026 for repeated data breaches between 2022-2024 stemming from systemic design and organisational deficiencies rather than isolated human errors. #### Breach NotificationAmber Controllers must notify AEPD without undue delay and within 72 hours of becoming aware of a personal data breach (Art 33); breach-related sanctioning procedures rose sharply in 2025. Claims (2): - Controllers must notify AEPD of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, per Art 33 GDPR. - AEPD's 2025 annual report recorded a 157% rise in breach-related sanctioning/reprimand procedures (30 in 2024 to 77 in 2025), yielding fines totalling approximately €19.8 million. #### Retention And DisposalAmber No ES-specific retention/disposal instrument beyond GDPR's storage-limitation principle (Art 5.1(e)) was surfaced in this research pass. Absence provenance: unavailable . Searched: AEPD plazos conservacion supresion datos personales. Category narrative 51 words GDPR accountability principle applies directly (Art 5(2)), operationalised through ROPA (Art 30), DPIA where risk criteria are met, DPO appointment where GDPR Art 37 / LOPDGDD Art 34 thresholds apply, and Art 32-34 security/breach-notification obligations. AEPD's 2025 annual report shows sharply increased breach-related sanctioning activity, evidencing active enforcement of these duties. Periodic update · new data 2026-09-28 #### Controller/Processor Duties Three substantial fines this cycle turn on the same underlying accountability failure: an inadequate data protection impact assessment for biometric processing. The AEPD fined Aena EUR10,043,002 for deploying biometric-boarding facial recognition at eight airports without a DPIA that adequately assessed proportionality against less-intrusive alternatives, the largest of the three penalties and the clearest signal that the AEPD expects controllers to demonstrate genuine consideration of alternatives before deploying biometric systems at scale. Separately, the AEPD fined FC Barcelona EUR500,000 in March 2026 for a deficient biometric DPIA, covering facial and voice data collection for approximately 143,000 club members, again turning on DPIA adequacy rather than on the underlying lawfulness of the processing itself. Read together with the Yoti finding on unlawful biometric processing and invalid consent, these three actions establish DPIA adequacy for biometric systems as a distinct and currently very active enforcement front for the AEPD, spanning aviation, professional sport, and digital identity verification. The common thread across Aena and FC Barcelona is not that biometric processing itself was unlawful in principle, but that the controllers had not conducted or documented an assessment rigorous enough to justify the proportionality of the chosen approach against less intrusive alternatives. #### Outlook The pattern across three unrelated sectors this cycle suggests the AEPD is applying a consistent, elevated bar for DPIA adequacy specifically where biometric data is involved, and organisations deploying facial recognition, voice biometrics, or similar systems in Spain should expect continued scrutiny of their DPIA documentation. Whether this enforcement pattern extends into further sectors, and how the Yoti appeal to the Audiencia Nacional resolves, will indicate whether the current DPIA-adequacy standard for biometric systems is durable or subject to judicial narrowing. 1 further periodic run re-emitted the standing brief unchanged and is not shown. Evidence 7 Sources and claims (7) - Confirmed[Agencia Española de Protección de Datos](https://www.aepd.es/documento/1-manuel-villaseca.pdf) — AEPD's recommended RGPD-adaptation roadmap treats risk analysis and DPIA (EIPD) execution as core accountability tasks alongside ROPA construction and breach-notification mechanisms.observed 2026-08-03 - Confirmed[Agencia Española de Protección de Datos](https://www.aepd.es/en/rights-and-duties/fulfill-your-duties/measures-compliance/data-protection-officer) — A DPO must be appointed where processing is carried out by a public authority, where core activities require regular and systematic large-scale monitoring of data subjects, or where core activities involve large-scale processing of special-category or criminal-conviction data; LOPDGDD Art 34 extends mandatory designation to further categories of entity.observed 2026-08-03 - Confirmed[Agencia Española de Protección de Datos](https://www.aepd.es/prensa-y-comunicacion/notas-de-prensa/la-agencia-recibio-mas-de-30.000-reclamaciones-en-2025-un-64-mas) — By the close of 2025, 126,176 DPOs were registered with AEPD (116,007 private sector, 10,169 public sector), up from 119,803 in 2024.observed 2026-08-03 - Confirmed[Agencia Española de Protección de Datos](https://www.aepd.es/preguntas-frecuentes/2-tus-obligaciones-como-responsable-del-tratamiento/7-registro-de-actividades-de-tratamiento/FAQ-0220-que-es-el-registro-de-actividades-de-tratamiento) — The Registro de Actividades de Tratamiento (ROPA) required by Art 30 GDPR is an internal document that must be made available to AEPD on request but does not need to be filed with or published to the Agency.observed 2026-08-03 - Confirmed[DataGuidance](https://www.dataguidance.com/news/spain-aepd-fines-caixabank-eur500000-data-protection) — AEPD confirmed a €500,000 fine (reduced to €400,000 on voluntary payment) against CaixaBank in March 2026 for repeated data breaches between 2022-2024 stemming from systemic design and organisational deficiencies rather than isolated human errors.observed 2026-08-03 - Confirmed[Agencia Española de Protección de Datos](https://www.aepd.es/sites/default/files/2019-09/wp250rev01-es.pdf) — Controllers must notify AEPD of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, per Art 33 GDPR.observed 2026-08-03 - Confirmed[Agencia Española de Protección de Datos](https://www.aepd.es/prensa-y-comunicacion/notas-de-prensa/la-agencia-recibio-mas-de-30.000-reclamaciones-en-2025-un-64-mas) — AEPD's 2025 annual report recorded a 157% rise in breach-related sanctioning/reprimand procedures (30 in 2024 to 77 in 2025), yielding fines totalling approximately €19.8 million.observed 2026-08-03