--- title: "Spain Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/spain-data-protection-privacy-regulation/ source_html: /jurisdictions/spain/index.html description: "Spain data protection and privacy regulation: 10 categories, 103 claims, updated 2026-11-04. Lawful processing, data subject rights, cross-border transfer…" generated_at: 2026-11-07T14:58:19Z content_sha256: 684e84174a02b1f60d65fd51570eef6c4f5754dc2aed13c0596f7a0d048653df generator: "fe-fleet/md-twin@1.0" --- # Spain Data Protection & Privacy Regulation | Data Protection Monitor Not every instrument is backed by its official text yet. At least one law or rulebook covered here has no official source (tier 1) retrieved for it yet. No finding on this page is shown with confidence above “Probable” until stronger sources are retrieved. # Spain Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed regulated (omnibus) overlaps: [Sentinel (AML/CFT)](https://sentinel.gi/jurisdictions/spain/), [World Payments](https://payments.gi/jurisdictions/spain/), artificial-intelligence Last updated 2026-11-04 · 10 categories · 103 claims · 104 sources in the cumulative register Download report (PDF) Expand all AEPD's enforcement posture in Spain has shifted decisively toward algorithmic and biometric processing this cycle. Data collected 2026-11-02 · Data published 2026-11-04 AI-assembled from cited sources Not fully checked this cycle: Sectoral Watch, Enforcement & Redress (4 open gaps). Evidence re-verified: 2026-11-04 · Position last changed: 2026-11-04 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=SPAIN)[Build Report](/reports/?j=SPAIN)[Compare](/compare/?j=SPAIN) Framework posture Regulated (omnibus) 10 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Agencia Española de Protección de Datos (AEPD) Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 10 / 10 modules assessed 0 Confirmed · 10 Probable · 0 Uncertain 10 Categories 0 Red categories 57 Sub-modules 103 Claims 31 Tier-1 sources Traffic-light mix 5 green 5 amber (sums to 10 rendered categories; click to filter) No categories are currently flagged red. Law made at European Economic Area (Bloc) level that applies in Spain is covered once, on the [European Economic Area (Bloc)](/jurisdictions/european-economic-area-bloc/) page. This page covers Spain’s own layer: implementation, national authorities, national options and local enforcement. ## Jurisdiction brief Jurisdiction lead brief 641 Full executive summary 302 ###### Latest update · 24 October 2026 #### Lead Signal Spain's data protection authority, the AEPD, has proposed a EUR 5,000 fine against El Salto, a cooperative investigative media outlet, over its reporting on undercover police infiltration of social movements. The reported proposal would also require El Salto to redact elements of its published reporting, including pixelating images and removing initials and aliases used to refer to individuals connected to the infiltration operations. The proceeding is understood to still be at the proposal stage rather than a final resolution, and the outcome has not yet been settled. #### Other Developments No other material movement was identified across Spain's data protection framework. #### Cross-Monitor Connections No cross-monitor routing was identified for this finding. #### Outlook The proceeding against El Salto sits at the intersection of data protection enforcement and investigative reporting on state security operations, and its eventual resolution will indicate how the AEPD balances redaction and sanction powers against public-interest journalism concerning undercover policing. Confirmation of the final outcome, and of whether the proposed fine and redaction order are upheld, reduced, or contested, is the point to watch. 3 earlier updates not shown here. ###### Standing brief · as of 25 August 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal AEPD's enforcement posture in Spain has shifted decisively toward algorithmic and biometric processing this cycle. The regulator opened 147 AI-related enforcement files in 2025-2026, a 340 percent increase, with AI-related claims rising from 412 in 2024 to 1,890 in 2025-2026, a 359 percent increase; banking, human resources and insurance together account for 63.3 percent of these files. The clearest individual precedent behind this trend is AEPD's approximately EUR 10 million fine against Aena for deploying facial-recognition systems at Spanish airports without a Data Protection Impact Assessment meeting the Article 35 standard, a special-category biometric-processing failure now treated as the leading domestic precedent on DPIA adequacy for biometric deployments. #### Other Developments Beyond the AI and biometric surge, AEPD fined Bizum EUR 80,000 for a security breach exposing the personal data of more than 20,000 users, an action implicating both security-measure adequacy and breach-notification response quality; combined with the Aena case, it points to a recurring accountability-documentation failure across otherwise very different controllers. Separately, the financial-technology sector emerged as a distinct, fast-growing enforcement vector: AEPD opened 89 procedures against fintechs between 2023 and 2025, a 62 percent year-on-year increase, with fines of EUR 30,000 to EUR 1.2 million typically tied to opaque automated credit-scoring and invasive identity-verification practices. At the aggregate level, AEPD imposed 299 economic sanctions totalling approximately EUR 40 million in 2025, a 14 percent increase over 2024's EUR 35.6 million, while directing 47 formal warnings (apercibimientos) rather than economic sanctions at public-sector bodies under LOPDGDD Article 77. #### Cross-Monitor Connections The Bizum security-breach fine and the fintech-sector enforcement surge sit directly adjacent to the world-payments monitor's coverage of Spain's payments infrastructure and to the financial-integrity monitor's AML/CTF and consumer-financial-crime coverage; readers tracking Spain's payments or financial-crime exposure should read this cycle's fintech and Bizum findings alongside those monitors' output rather than as a standalone data-protection matter. The AI-enforcement surge, concentrated in banking, HR and insurance automated decision-making, is also the natural link point to any artificial-intelligence-focused monitor tracking AESIA's parallel AI Act supervision of the same systems; this brief does not re-analyse the AI Act dimension, only the GDPR enforcement dimension AEPD itself is pursuing. #### Outlook Three trajectories are worth tracking into the next cycle: whether AEPD's AI-related enforcement volume, having more than tripled, continues climbing or plateaus; whether the fintech sectoral enforcement vector produces published guidance on automated credit-scoring transparency rather than continuing as case-by-case action; and whether the 2025 sanctions total of approximately EUR 40 million is confirmed as part of a genuinely escalating multi-year trend once the 2026 full-year Memoria de Actividad is published. Read full brief · 641 words ###### Latest update · 4 November 2026 #### Regulatory Status Spain's data protection framework remains anchored in the Ley Orgánica 3/2018 alongside the Regulation (EU) 2016/679, with the one concrete framework-level change in view being the Article 23 amendment introduced by Ley 10/2025, which carries an adaptation deadline of 28 December 2026 for in-scope advertising-exclusion and customer-care systems. Enforcement activity by the Spanish authority has continued at a sustained tempo, illustrated by a €680,000 fine against a used-vehicle dealer over a security breach and mismanagement of marketing-objection rights, while a ruling attributed to the Audiencia Nacional has newly limited the authority's ability to charge interest on sanctions that remain judicially suspended pending appeal. #### Outlook The period ahead is likely to be defined by two threads: whether in-scope entities complete the required adaptation of exclusion-system handling before the 28 December 2026 deadline, and whether the judicial limit on interest collection for suspended sanctions is tested or extended in further appeals against the authority's enforcement actions. ###### Standing brief · as of 25 August 2026 #### Regulatory Status Spain's data-protection enforcement intensified sharply this cycle across biometric, security, fintech and AI-related processing. AEPD fined Aena approximately EUR 10 million for facial-recognition deployment without a compliant DPIA, fined Bizum EUR 80,000 for a security breach affecting more than 20,000 users, opened 89 fintech procedures (2023-2025, up 62 percent year on year), and opened 147 AI-related enforcement files in 2025-2026 (up 340 percent), with total 2025 sanctions reaching approximately EUR 40 million across 299 actions, a 14 percent increase over 2024. #### Outlook The AI- and fintech-related enforcement vectors are accelerating rather than stabilising; the 2026 full-year Memoria de Actividad will be the next confirming data point for whether Spain's overall AEPD sanctions trajectory continues escalating. Read full brief · 302 words Key regulatory facts for Spain Regulatory Dimension Spain Standing Position Jurisdiction Spain (ES) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 103 sourced findings) Regulator & Framework Mature, fully operative omnibus regime with an active, well-resourced supervisory authority and clear statutory instruments. Lawful Processing & Special Data Lawful basis and special-category framework is GDPR-aligned with clear, AEPD-published interpretive guidance; consent threshold for minors is well-documented. Data Subject Rights Full GDPR rights catalogue in force; AEPD publishes accessible guidance confirming scope, including minors' rights from age 14. Controller/Processor Duties Comprehensive, actively-enforced accountability framework; breach and DPO statistics confirm real operative traction. Primary Instruments Cited Agencia Española de Protección de Datos, Agencia Española de Protección de Datos, Agencia Española de Protección de Datos, Agencia Española de Protección de Datos, Agencia Española de Protección de Datos Last Confirmed / Updated 2026-11-04 (104 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### Spain: D1 Regulator & Framework5 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Mature, fully operative omnibus regime with an active, well-resourced supervisory authority and clear statutory instruments. Primary framework Reglamento (UE) 2016/679 (RGPD/GDPR) + Ley Orgánica 3/2018 (LOPDGDD) Supervisory authority [Agencia Española de Protección de Datos (AEPD)](https://www.aepd.es) Traffic-light rationale — Green Mature, fully operative omnibus regime with an active, well-resourced supervisory authority and clear statutory instruments. #### Sub-modules (5) #### Regulator And AuthorityGreen AEPD is the sole general-purpose national DPA for Spain; certain autonomous communities (Cataluña, País Vasco, Andalucía) maintain regional DPAs for public-sector processing within their territory, but AEPD retains general and private-sector competence. Claims (7): - The Agencia Española de Protección de Datos (AEPD) is Spain's national data protection supervisory authority under GDPR and LOPDGDD. - AEPD — 30,931 claims received in 2025 per published Memoria de Actividad, an increase versus prior cycles - APDCAT / AVPD — Catalonia (APDCAT) and the Basque Country (AVPD) hold regional data-protection competence over certain public-sector processing, distinct from the AEPD's national remit. - AESIA / AEPD supervisory coordination — aesia coordinates with aepd on ai personal data: true - Spanish AI Act implementation gap — lacks national penalty statute for ai act: true - Spain Data Act national competent authority designation — has not designated data coordinator: true - AEPD is Spain's national DPA; APDCAT (Catalonia) and AVPD (Basque Country) retain regional competence limited to certain public-sector processing within their territories. #### Act And InstrumentsGreen Core instruments are GDPR (directly applicable), LOPDGDD, LO 7/2021 (law-enforcement data), RD 389/2021 (AEPD Statute) and Ley 34/2002 LSSI for information-society services. Claims (4): - Spain's data protection regime rests on GDPR (Regulation (EU) 2016/679) applied directly, LOPDGDD, LO 7/2021, RD 389/2021 (AEPD Statute) and Ley 34/2002 (LSSI) for e-commerce/electronic communications. - LOPDGDD Art 23 — In-scope entities have until 28 December 2026 to adapt advertising-exclusion/suppression systems to the new requirements under Ley 10/2025. - Ley Orgánica 3/2018 — LOPDGDD, BOE-A-2018-16673, published 6 December 2018, in force from 7 December 2018. - Ley Orgánica 3/2018 (LOPDGDD) — in_force #### Material ScopeGreen GDPR/LOPDGDD apply to any processing of personal data relating to an identified or identifiable natural person; data of legal persons is excluded. Claims (1): - GDPR/LOPDGDD apply to the processing of personal data relating to identified or identifiable natural persons; data concerning legal persons is not covered. #### Territorial ScopeGreen Extraterritorial reach under GDPR Art 3(2) captures non-EU controllers/processors offering goods/services to, or monitoring the behaviour of, EU data subjects; such entities must designate an EU representative. Claims (1): - Non-EU-established controllers/processors offering goods or services to, or monitoring the behaviour of, EU data subjects fall within GDPR's territorial scope and must appoint an EU representative as contact point for supervisory authorities and data subjects. #### Regulator Registration And FilingAmber General file-notification/registration with AEPD was abolished from 25 May 2018 and replaced by the internal, non-filed Registro de Actividades de Tratamiento (ROPA). The only affirmative filing duty remaining is communication of DPO appointments/removals to AEPD within 10 days. Claims (2): - Since 25 May 2018, the obligation to register/notify processing files with AEPD has disappeared, both for public and private controllers, replaced by the internal Registro de Actividades de Tratamiento (ROPA). - Controllers/processors that designate a DPO (mandatorily or voluntarily) must communicate the appointment, and any subsequent removal, to AEPD within 10 days. Spain operates a fully-implemented GDPR omnibus regime. The Agencia Española de Protección de Datos (AEPD) is the national supervisory authority, operating under Ley Orgánica 3/2018 (LOPDGDD) alongside directly-applicable GDPR (Regulation (EU) 2016/679). The obligation to register files with AEPD was abolished on 25 May 2018 and replaced with internal accountability tools (ROPA). Territorial scope follows GDPR Art 3, extending to non-EU controllers targeting or monitoring EU-resident data subjects, who must appoint an EU representative. No periodic updates recorded in this cycle Sources and claims (15) - [Agencia Española de Protección de Datos](https://www.aepd.es/en/about-aepd/welcome-aepd) — The Agencia Española de Protección de Datos (AEPD) is Spain's national data protection supervisory authority under GDPR and LOPDGDD. - [Agencia Española de Protección de Datos](https://www.aepd.es/en/our-work-and-tools/regulation) — Spain's data protection regime rests on GDPR (Regulation (EU) 2016/679) applied directly, LOPDGDD, LO 7/2021, RD 389/2021 (AEPD Statute) and Ley 34/2002 (LSSI) for e-commerce/electronic communications. - [Agencia Española de Protección de Datos](https://www.aepd.es/preguntas-frecuentes/2-tus-obligaciones-como-responsable-del-tratamiento/2-aplicacion-de-la-normativa) — GDPR/LOPDGDD apply to the processing of personal data relating to identified or identifiable natural persons; data concerning legal persons is not covered. - [Agencia Española de Protección de Datos](https://www.aepd.es/preguntas-frecuentes/2-tus-obligaciones-como-responsable-del-tratamiento/2-aplicacion-de-la-normativa/FAQ-0202-a-quien-se-aplica-el-RGPD) — Non-EU-established controllers/processors offering goods or services to, or monitoring the behaviour of, EU data subjects fall within GDPR's territorial scope and must appoint an EU representative as contact point for supervisory authorities and data subjects. - [Agencia Española de Protección de Datos](https://www.aepd.es/preguntas-frecuentes/2-tus-obligaciones-como-responsable-del-tratamiento/2-aplicacion-de-la-normativa/FAQ-0205-sobre-la-obligatoriedad-de-la-inscripcion-de-ficheros) — Since 25 May 2018, the obligation to register/notify processing files with AEPD has disappeared, both for public and private controllers, replaced by the internal Registro de Actividades de Tratamiento (ROPA). - [Agencia Española de Protección de Datos](https://www.aepd.es/en/rights-and-duties/fulfill-your-duties/measures-compliance/data-protection-officer) — Controllers/processors that designate a DPO (mandatorily or voluntarily) must communicate the appointment, and any subsequent removal, to AEPD within 10 days. - [Global Suite Solutions](https://www.globalsuitesolutions.com/es/ley-organica-proteccion-datos-espana/) — LOPDGDD Art 23 — In-scope entities have until 28 December 2026 to adapt advertising-exclusion/suppression systems to the new requirements under Ley 10/2025. - [AEPD](https://www.aepd.es/prensa-y-comunicacion/blog/tendencia-sancionadora-en-proteccion-de-datos-en-europa) — AEPD — 30,931 claims received in 2025 per published Memoria de Actividad, an increase versus prior cycles - [Recording Law](https://www.recordinglaw.com/world-laws/world-data-privacy-laws/spain-data-privacy-laws/) — APDCAT / AVPD — Catalonia (APDCAT) and the Basque Country (AVPD) hold regional data-protection competence over certain public-sector processing, distinct from the AEPD's national remit. - [Global Suite Solutions](https://www.globalsuitesolutions.com/es/ley-organica-proteccion-datos-espana/) — Ley Orgánica 3/2018 — LOPDGDD, BOE-A-2018-16673, published 6 December 2018, in force from 7 December 2018. - [opotips.com](https://opotips.com/normativa/lo-3-2018-lopdgdd) — Ley Orgánica 3/2018 (LOPDGDD) — in_force - [TrustAI](https://trustai.es/blog/que-es-la-aesia) — AESIA / AEPD supervisory coordination — aesia coordinates with aepd on ai personal data: true - [Pablo Sáez Hurtado (legal blog)](https://pablosaezhurtado.com/guia-ia-empresa/espana/aesia/) — Spanish AI Act implementation gap — lacks national penalty statute for ai act: true - [Garrigues](https://www.garrigues.com/en_GB/garrigues-digital/data-act-and-regulated-access-data-essentials) — Spain Data Act national competent authority designation — has not designated data coordinator: true - [https://www.piconyasociados.es/noticias/la-aepd-no-puede-liquidar-intereses-suspensivos-derivados-de-una-sancion/](https://www.piconyasociados.es/noticias/la-aepd-no-puede-liquidar-intereses-suspensivos-derivados-de-una-sancion/) — AEPD is Spain's national DPA; APDCAT (Catalonia) and AVPD (Basque Country) retain regional competence limited to certain public-sector processing within their territories. ### Spain: D2 Lawful Processing & Special Data4 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Lawful basis and special-category framework is GDPR-aligned with clear, AEPD-published interpretive guidance; consent threshold for minors is well-documented. Primary framework GDPR Arts 6-9 + LOPDGDD Arts 6-9 Supervisory authority [Agencia Española de Protección de Datos (AEPD)](https://www.aepd.es) Traffic-light rationale — Green Lawful basis and special-category framework is GDPR-aligned with clear, AEPD-published interpretive guidance; consent threshold for minors is well-documented. Periodic update · new data 2026-09-28 #### Lawful Processing & Special Data The AEPD found that Yoti Ltd violated GDPR articles 5.1(e), 7 and 9 in connection with its biometric data processing, imposing combined fines of EUR950,000 broken into three components: EUR500,000 for unlawful biometric processing, EUR200,000 for invalid consent, and EUR250,000 for excessive retention. The finding is understood to treat facial-match biometric data as special-category data under article 9 even where the operator claims immediate deletion after matching, a position that narrows the room for operators to argue that transient or non-retained biometric processing falls outside the special-category regime. The consent finding is understood to have turned on a pre-ticked-box mechanism used to obtain agreement for ancillary research-and-development use of the data, which the AEPD treated as invalid consent under article 7's standard for freely given, specific and unambiguous agreement. This finding sits within a wider pattern this cycle of AEPD attention to biometric data specifically, rather than to special-category data generally, suggesting biometric processing has become a discrete enforcement priority rather than one example among many special-category categories. The retention component of the fine, EUR250,000 for excessive retention, indicates that even where initial collection and matching may have a lawful basis, the AEPD is scrutinising how long biometric data is actually held relative to the purpose for which it was collected. #### Outlook Yoti's appeal of the underlying sanction to the Spanish High Court, following the AEPD's rejection of its request for reconsideration on 2 March 2026, is the key item to watch for this module. Should the Audiencia Nacional narrow or overturn the AEPD's findings on the biometric special-category classification or the consent-validity analysis, that would materially affect the durability of the AEPD's current interpretive line on lawful processing of biometric data going forward. D2 · Lawful Processing — Full Module Record 4 sub-modules · 87 words · 8 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Spain: D3 Data Subject Rights5 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Full GDPR rights catalogue in force; AEPD publishes accessible guidance confirming scope, including minors' rights from age 14. Primary framework GDPR Arts 12-22 + LOPDGDD Arts 12-18 Supervisory authority [Agencia Española de Protección de Datos (AEPD)](https://www.aepd.es) Traffic-light rationale — Green Full GDPR rights catalogue in force; AEPD publishes accessible guidance confirming scope, including minors' rights from age 14. #### Sub-modules (5) #### Access RightGreen Right of access under GDPR Art 15 applies; AEPD confirms minors over 14 may exercise it themselves. Claims (1): - GDPR grants data subjects the rights of access, rectification, erasure, objection, portability, restriction of processing, and the right to object to automated decision-making including profiling; AEPD confirms these are exercisable by minors from age fourteen. #### Rectification And ErasureGreen Rights of rectification and erasure (Arts 16-17) form part of the standard rights catalogue confirmed by AEPD. Claims (1): - GDPR grants data subjects the rights of access, rectification, erasure, objection, portability, restriction of processing, and the right to object to automated decision-making including profiling; AEPD confirms these are exercisable by minors from age fourteen. #### Restriction And ObjectionGreen Rights to restriction of processing and objection, including objection to automated decision-making/profiling, are confirmed in AEPD's minors-and-education guidance as part of the exercisable rights catalogue. Claims (1): - GDPR grants data subjects the rights of access, rectification, erasure, objection, portability, restriction of processing, and the right to object to automated decision-making including profiling; AEPD confirms these are exercisable by minors from age fourteen. #### Data PortabilityGreen Portability right (Art 20) is included among the rights AEPD confirms as exercisable, including by minors from age 14. Claims (1): - GDPR grants data subjects the rights of access, rectification, erasure, objection, portability, restriction of processing, and the right to object to automated decision-making including profiling; AEPD confirms these are exercisable by minors from age fourteen. #### Deadlines And Response WindowsAmber No ES-specific deviation from the GDPR Art 12(3) one-month (extendable to three) response window was located in this research pass; GDPR default applies directly. Claims (1): - Royal Decree 723/2026 — Employers have 30 working days to respond to an existing employee's request for algorithmic-system information where not already provided GDPR Arts 15-22 rights (access, rectification, erasure, restriction, objection, portability, and objection to automated decision-making/profiling) apply directly in Spain and are reiterated in AEPD consumer-facing guidance, including specifically in the context of minors' data. No periodic updates recorded in this cycle Sources and claims (4) - [Agencia Española de Protección de Datos](https://www.aepd.es/preguntas-frecuentes/10-menores-y-educacion) — GDPR grants data subjects the rights of access, rectification, erasure, objection, portability, restriction of processing, and the right to object to automated decision-making including profiling; AEPD confirms these are exercisable by minors from age fourteen. - [Iberley](https://www.iberley.es/temas/derecho-no-ser-objeto-decisiones-individuales-automatizadas-rgpd-62752) — LOPDGDD Art.18/Art.22 automated-decision cross-reference — applies gdpr automated decision regime: true - [Prodat](https://www.prodat.es/blog/donde-esta-el-limite-del-articulo-22-del-reglamento-general-de-proteccion-de-datos-bosco-y-las-decisiones-automatizadas-en-la-administracion-publica/) — AEPD BOSCO automated-decision enforcement practice — applies three part automated decision test: true - [Kepler Newsletter](https://keplernewsletter.substack.com/p/privacy-and-cybersecurity-90) — Royal Decree 723/2026 — Employers have 30 working days to respond to an existing employee's request for algorithmic-system information where not already provided ### Spain: D4 Controller/Processor Duties7 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Comprehensive, actively-enforced accountability framework; breach and DPO statistics confirm real operative traction. Primary framework GDPR Arts 5, 24-39 + LOPDGDD Arts 28, 31-37 Supervisory authority [Agencia Española de Protección de Datos (AEPD)](https://www.aepd.es) Traffic-light rationale — Green Comprehensive, actively-enforced accountability framework; breach and DPO statistics confirm real operative traction. Periodic update · new data 2026-09-28 #### Controller/Processor Duties Three substantial fines this cycle turn on the same underlying accountability failure: an inadequate data protection impact assessment for biometric processing. The AEPD fined Aena EUR10,043,002 for deploying biometric-boarding facial recognition at eight airports without a DPIA that adequately assessed proportionality against less-intrusive alternatives, the largest of the three penalties and the clearest signal that the AEPD expects controllers to demonstrate genuine consideration of alternatives before deploying biometric systems at scale. Separately, the AEPD fined FC Barcelona EUR500,000 in March 2026 for a deficient biometric DPIA, covering facial and voice data collection for approximately 143,000 club members, again turning on DPIA adequacy rather than on the underlying lawfulness of the processing itself. Read together with the Yoti finding on unlawful biometric processing and invalid consent, these three actions establish DPIA adequacy for biometric systems as a distinct and currently very active enforcement front for the AEPD, spanning aviation, professional sport, and digital identity verification. The common thread across Aena and FC Barcelona is not that biometric processing itself was unlawful in principle, but that the controllers had not conducted or documented an assessment rigorous enough to justify the proportionality of the chosen approach against less intrusive alternatives. #### Outlook The pattern across three unrelated sectors this cycle suggests the AEPD is applying a consistent, elevated bar for DPIA adequacy specifically where biometric data is involved, and organisations deploying facial recognition, voice biometrics, or similar systems in Spain should expect continued scrutiny of their DPIA documentation. Whether this enforcement pattern extends into further sectors, and how the Yoti appeal to the Audiencia Nacional resolves, will indicate whether the current DPIA-adequacy standard for biometric systems is durable or subject to judicial narrowing. D4 · Controller & Processor — Full Module Record 7 sub-modules · 51 words · 16 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Spain: D5 Cross-Border & Adequacy6 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Fully harmonised EU transfer regime in force with active AEPD guidance on mechanisms; TIA obligation confirmed via CJEU Schrems II jurisprudence. Primary framework GDPR Arts 44-49 + Commission Implementing Decision (EU) 2021/914 Supervisory authority [Agencia Española de Protección de Datos (AEPD)](https://www.aepd.es) Traffic-light rationale — Green Fully harmonised EU transfer regime in force with active AEPD guidance on mechanisms; TIA obligation confirmed via CJEU Schrems II jurisprudence. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 54 words · 4 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Spain: D6 Sectoral Watch7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ No separate sectoral statutes displace GDPR, but overlays exist and healthcare/financial sanctioning activity rose sharply in 2025, indicating active but uneven sectoral risk. Primary framework GDPR/LOPDGDD + Ley 34/2002 (LSSI) + sector codes of conduct Supervisory authority [Agencia Española de Protección de Datos (AEPD)](https://www.aepd.es) Traffic-light rationale — Amber No separate sectoral statutes displace GDPR, but overlays exist and healthcare/financial sanctioning activity rose sharply in 2025, indicating active but uneven sectoral risk. D6 · Sectoral Watch — Full Module Record 7 sub-modules · 54 words · 7 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Spain: D7 AdTech & Commercial Privacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Cookie/dark-pattern regime is mature and AEPD-enforced; other sub-modules (opt-out signals, clean rooms, cross-context advertising) lack a direct EU/ES analogue and were not evidenced in this pass. Primary framework Ley 34/2002 (LSSI) Art 22.2 + GDPR + AEPD Guía sobre el uso de las cookies Supervisory authority [Agencia Española de Protección de Datos (AEPD)](https://www.aepd.es) Traffic-light rationale — Amber Cookie/dark-pattern regime is mature and AEPD-enforced; other sub-modules (opt-out signals, clean rooms, cross-context advertising) lack a direct EU/ES analogue and were not evidenced in this pass. D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 58 words · 9 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Spain: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ AI governance is institutionally advanced (AESIA operative, 16 guidelines published) but the core Organic Law implementing AI Act governance domestically remains in draft/proposed stage as of mid-2026. Primary framework GDPR Art 9, Art 22 + EU AI Act (Regulation (EU) 2024/1689) + draft Spanish Organic Law on AI governance Supervisory authority [Agencia Española de Supervisión de la Inteligencia Artificial (AESIA)](https://www.aesia.gob.es) Traffic-light rationale — Amber AI governance is institutionally advanced (AESIA operative, 16 guidelines published) but the core Organic Law implementing AI Act governance domestically remains in draft/proposed stage as of mid-2026. Periodic update · new data 2026-10-18 #### Algorithmic, Biometric & Surveillance Governance Royal Decree 723/2026 entered into force on 5 October 2026, repealing and fully replacing Royal Decree 1659/1998. Its Article 3.2(k) creates a binding duty on employers to inform each worker, in writing, in advance and traceably, of algorithmic or automated decision-making systems that determine working time, task allocation, pay, career progression, workplace location or contract termination, together with the guidelines, criteria and rules those systems apply. This is the single most material data-protection-adjacent development identified for Spain this cycle, and it establishes an individual worker right to algorithmic transparency that interacts directly with, but does not displace, obligations arising under the GDPR and the LOPDGDD. Separately, reports suggest the AEPD received a notification describing an AI-agent-linked breach, though the identity of the notifying organisation and the technical details of the incident have not been confirmed; this should be read as an early, unverified signal of AI-agent-related incidents reaching the breach-notification framework, not as a confirmed finding. #### Outlook The practical rollout of Royal Decree 723/2026 will be visible first in the volume and content of worker information requests submitted under its 30-working-day response mechanism. Whether the AEPD issues further guidance interpreting the scope of Article 3.2(k), for instance on what counts as sufficiently traceable disclosure of algorithmic criteria, is the clearest near-term marker to watch. Any corroboration of the reported AI-agent-linked breach notification would also be a significant development for how the breach-notification framework applies to AI-agent architectures specifically. Periodic update · new data 2026-09-28 #### Algorithmic, Biometric & Surveillance Governance Biometric enforcement is currently the AEPD's most active governance front, evidenced by three fines this cycle spanning digital identity verification (Yoti, EUR950,000 combined), aviation boarding systems (Aena, EUR10,043,002), and professional sports club membership management (FC Barcelona, EUR500,000). Each case turns on a different specific failure -- unlawful processing and invalid consent for Yoti, inadequate DPIA proportionality assessment for Aena and FC Barcelona -- but together they establish biometric data processing as a category receiving sustained, cross-sectoral AEPD attention rather than isolated sectoral scrutiny. AESIA, Spain's national AI supervisory authority established under the national AI governance framework, is expected to coordinate with the AEPD to help ensure data-protection requirements are enforced alongside the EU AI Act's obligations, particularly for biometric and AI-driven systems where the two regulatory frameworks overlap. This coordination expectation reflects the structural reality that AI-driven biometric identification systems increasingly sit at the intersection of AI Act risk-classification obligations and GDPR's special-category data rules, though the operational form this AEPD-AESIA coordination will take has not been confirmed through a primary document this cycle. #### Outlook The coordination relationship between AESIA and the AEPD is the item to watch most closely, since formal confirmation of how the two authorities divide or share supervisory responsibility for AI-driven biometric systems would clarify whether Spain is developing an integrated AI-Act/GDPR enforcement posture for biometric technologies or maintaining largely separate regulatory tracks that happen to converge on the same underlying processing activities. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 81 words · 11 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Spain: D9 Children & Vulnerable Groups5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Consent-age and parental-consent framework is clear and GDPR-aligned; minor-specific profiling bans and dependent-adult protections beyond general GDPR safeguards were not evidenced in this pass. Primary framework GDPR Art 8 + LOPDGDD Art 7 + LOPDGDD Art 34 Supervisory authority [Agencia Española de Protección de Datos (AEPD)](https://www.aepd.es) Traffic-light rationale — Amber Consent-age and parental-consent framework is clear and GDPR-aligned; minor-specific profiling bans and dependent-adult protections beyond general GDPR safeguards were not evidenced in this pass. D9 · Children's Privacy — Full Module Record 5 sub-modules · 50 words · 6 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Spain: D10 Enforcement & Redress6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Enforcement activity is vigorous and well-documented, but AEPD's own reporting flags a capacity/resourcing strain relative to caseload growth. Primary framework GDPR Arts 58, 77-84 + LOPDGDD Arts 48, 50, 63-72 Supervisory authority [Agencia Española de Protección de Datos (AEPD)](https://www.aepd.es) Traffic-light rationale — Amber Enforcement activity is vigorous and well-documented, but AEPD's own reporting flags a capacity/resourcing strain relative to caseload growth. Periodic update · new data 2026-11-04 #### Enforcement & Redress The Spanish data protection authority is understood to have fined a used-vehicle dealer €680,000 under resolution PS-00540-2025, in connection with a security breach that allowed exfiltration of customer data and with mismanagement of the right to object to direct marketing. The figure places this among the larger sanctions reported in this enforcement channel, and the dual basis for the fine — a security failure together with handling of marketing-objection rights — illustrates that the authority continues to treat breach-response adequacy and the practical operation of data-subject rights as connected questions in a single enforcement action rather than as separate matters. At the same time, a ruling attributed to the Audiencia Nacional has constrained one of the authority's own enforcement tools: the court held that the regulator cannot demand payment of default interest that accrues on a sanction while that sanction remains judicially suspended pending appeal. This is a procedural limit on how the authority can pursue collection during an active appeal, rather than a limit on its power to impose sanctions in the first place, and it indicates that the courts are prepared to check the mechanics of enforcement even where the underlying sanctioning power is not in question. The exact case reference for this ruling has not been independently confirmed. Taken together, the picture for this period is of a regulator maintaining a high enforcement tempo — with fines against commercial actors for breach and rights-handling failures continuing to be issued — set against a judiciary willing to impose boundaries on how collection is pursued once a sanction is contested. #### Outlook Enforcement activity by the Spanish authority is expected to continue at a similar pace, with breach-handling and marketing-related rights failures remaining a recurring basis for sanctions against commercial operators. The interest-collection ruling is likely to be a reference point in future appeals where sanctioned parties seek judicial suspension, and whether it is applied more broadly across pending appeals is a point to watch. Periodic update · new data 2026-10-24 #### Enforcement & Redress The AEPD, Spain's data protection supervisory authority, has proposed a EUR 5,000 administrative fine against El Salto, a cooperative investigative media outlet, in connection with its reporting on undercover police infiltration of social movements. Alongside the proposed fine, the reported proceeding would require El Salto to redact elements of its published coverage, specifically pixelating images and removing the initials and aliases used to refer to individuals connected to the infiltration operations described in its reporting. The matter is understood to still be at the proposal stage: a formal AEPD proposal is not the same as a final, binding resolution, and reporting available at this point does not establish whether the outlet will contest the proposed measures or whether the AEPD will adjust or confirm them before any final decision issues. The underlying substantive question, whether and how data protection rules concerning the identifiability of individuals in published reporting apply to investigative journalism about undercover state security operations, has not yet been resolved by a final AEPD decision on the public record. This finding rests on secondary press reporting rather than on direct retrieval of the AEPD's own resolution or proceeding record, so procedural detail beyond the fine amount and the redaction elements described, such as the formal legal basis cited or the specific statutory provision invoked, is not yet confirmed. #### Outlook The eventual resolution of this proceeding will be the point of note: confirmation of whether the proposed fine and redaction order are upheld, reduced, withdrawn, or contested will clarify how the AEPD applies data protection enforcement powers against investigative reporting that identifies individuals connected to undercover policing operations. Periodic update · new data 2026-10-18 #### Enforcement & Redress The AEPD's enforcement activity remained materially active in the period under review. Its record EUR 18 million fine against Amadeus IT Group, S.A., reported in May 2026, concerned a traveller-profiling pilot project the regulator found was conducted without adequate legal basis or sufficient information to data subjects, addressing breaches of Articles 6 and 14 of the GDPR. The AEPD is also reported to have fined Vodafone EUR 750,000, reported 25 September 2026, in connection with a data breach and inadequate security measures, and to have fined 23andMe EUR 2.4 million, reported 10 August 2026, for security and breach-notification failures affecting 2,642 individuals. Separately, the AEPD fined a security-alarm and video-surveillance company EUR 100,000 for obstructing the exercise of data-subject rights via a chargeable phone line, a decision reported 22 September 2026. Across this enforcement activity, the AEPD is understood to consistently apply the proportionality principle under Article 83(1) of the GDPR, giving considerable weight to the fact that most respondents before it are small and medium-sized enterprises; no change to the underlying maximum-fine tiers was found this cycle. #### Outlook The Amadeus decision, as the largest fine identified in this period, is likely to remain a reference point in AEPD enforcement reasoning on profiling conducted without adequate legal basis. Continued proportionality-weighted treatment of SME respondents suggests the AEPD's fine levels for smaller entities will likely remain calibrated below headline GDPR maximums, even as enforcement volume continues at a sustained pace. Periodic update · new data 2026-10-12 #### Enforcement & Redress The Audiencia Nacional, Spain's national court competent to review AEPD sanction decisions, held in a judgment reported as issued on 24 September 2026 that the AEPD may not liquidate suspensive interest that accrues during the period a sanction decision remains suspended pending appeal. This is a narrowing of one specific collection mechanism available to the regulator once a fine is contested, not a change to the AEPD's underlying power to impose sanctions or to the level of fines it may impose. The finding is sourced via law-firm commentary (Picón y Asociados) describing the ruling; the primary judgment text, including its docket reference, was not independently retrieved this cycle, so the precise legal reasoning and scope of application remain to be confirmed against the original source. Alongside this development, the AEPD's statutory fine-tier maxima remain unchanged: sanctions for the lower infraction tier under the GDPR's own penalty framework, as applied domestically, continue to carry a ceiling of up to EUR 10 million or 2% of total annual global turnover, and the higher tier continues to carry a ceiling of up to EUR 20 million or 4%. No development this cycle alters either ceiling or the AEPD's general sanctioning authority; the change is confined to a procedural detail of how accessory interest on a suspended sanction may be collected. The practical significance for entities with a sanction currently under appeal is that the regulator's ability to add suspensive interest to the eventual collected amount appears to be constrained by this ruling, though the exact mechanics, including whether the ruling applies to sanctions already under appeal or only to future cases, were not established in the material reviewed this cycle. #### Outlook Confirmation of the underlying Audiencia Nacional judgment text, including its docket reference, is the clearest item likely to sharpen this finding in a future cycle. Until that confirmation is obtained, the practical scope of the suspensive-interest limitation for entities with pending AEPD appeals should be treated as provisional. Periodic update · new data 2026-09-28 #### Enforcement & Redress The AEPD's sanctioning powers remain grounded in GDPR article 83, permitting administrative fines of up to EUR20 million or 4% of global annual turnover, whichever is higher, and LOPDGDD article 77 mandates publication of final sanctioning resolutions once they become firm. This cycle's biometric enforcement wave -- the Yoti, Aena and FC Barcelona fines -- illustrates the AEPD exercising this authority at a range of scales, from EUR500,000 up to over EUR10 million, depending on the severity and sectoral context of the underlying violation. Of particular note for the redress dimension is the active contestation of the Yoti sanction. The AEPD rejected Yoti's request for reconsideration on 2 March 2026, and Yoti has since escalated its challenge to a full appeal before the Spanish High Court, the Audiencia Nacional, disputing both the substantive findings and the adequacy of the AEPD's notification procedure. This is a live, unresolved legal proceeding rather than a settled enforcement outcome, and it represents the clearest current test of how far Spanish courts will support the AEPD's interpretive approach to biometric special-category data and consent validity under the current enforcement wave. #### Outlook The Audiencia Nacional's eventual ruling on Yoti's appeal is the single most consequential redress-related development to track, since it will either validate or narrow the AEPD's current enforcement approach to biometric data, with direct implications for how durable the accompanying Aena and FC Barcelona DPIA-adequacy findings prove to be if similarly challenged. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 69 words · 23 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (37 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) deadlines and response windows Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) deadlines and response windows Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy granted Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties