--- title: "Spain — Regulator & Framework | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/spain/regulator-and-framework/ source_html: /jurisdictions/spain/regulator-and-framework/index.html description: "Spain — Regulator & Framework: regulator_and_framework Regulator & Framework 5 sub-modules 6 claims Green ▾ # Mature, fully operative omnibus regime with an active, well-resourced supervisory authority and clear" generated_at: 2026-10-25T04:46:50Z content_sha256: 03b224fd741c69cf64191f63c78bd497f408a072f7166eeb655fc53591af4391 generator: "fe-fleet/md-twin@1.0" --- # Spain — Regulator & Framework | Data Protection Monitor ### D1Regulator & Framework5 sub-modules6 claimsGreen▾# Mature, fully operative omnibus regime with an active, well-resourced supervisory authority and clear statutory instruments. Primary framework Reglamento (UE) 2016/679 (RGPD/GDPR) + Ley Orgánica 3/2018 (LOPDGDD) Supervisory authority [Agencia Española de Protección de Datos (AEPD)](https://www.aepd.es) Traffic-light rationale — Green Mature, fully operative omnibus regime with an active, well-resourced supervisory authority and clear statutory instruments. #### Sub-modules (5) #### Regulator And AuthorityGreen AEPD is the sole general-purpose national DPA for Spain; certain autonomous communities (Cataluña, País Vasco, Andalucía) maintain regional DPAs for public-sector processing within their territory, but AEPD retains general and private-sector competence. Claims (1): - The Agencia Española de Protección de Datos (AEPD) is Spain's national data protection supervisory authority under GDPR and LOPDGDD. #### Act And InstrumentsGreen Core instruments are GDPR (directly applicable), LOPDGDD, LO 7/2021 (law-enforcement data), RD 389/2021 (AEPD Statute) and Ley 34/2002 LSSI for information-society services. Claims (1): - Spain's data protection regime rests on GDPR (Regulation (EU) 2016/679) applied directly, LOPDGDD, LO 7/2021, RD 389/2021 (AEPD Statute) and Ley 34/2002 (LSSI) for e-commerce/electronic communications. #### Material ScopeGreen GDPR/LOPDGDD apply to any processing of personal data relating to an identified or identifiable natural person; data of legal persons is excluded. Claims (1): - GDPR/LOPDGDD apply to the processing of personal data relating to identified or identifiable natural persons; data concerning legal persons is not covered. #### Territorial ScopeGreen Extraterritorial reach under GDPR Art 3(2) captures non-EU controllers/processors offering goods/services to, or monitoring the behaviour of, EU data subjects; such entities must designate an EU representative. Claims (1): - Non-EU-established controllers/processors offering goods or services to, or monitoring the behaviour of, EU data subjects fall within GDPR's territorial scope and must appoint an EU representative as contact point for supervisory authorities and data subjects. #### Regulator Registration And FilingAmber General file-notification/registration with AEPD was abolished from 25 May 2018 and replaced by the internal, non-filed Registro de Actividades de Tratamiento (ROPA). The only affirmative filing duty remaining is communication of DPO appointments/removals to AEPD within 10 days. Claims (2): - Since 25 May 2018, the obligation to register/notify processing files with AEPD has disappeared, both for public and private controllers, replaced by the internal Registro de Actividades de Tratamiento (ROPA). - Controllers/processors that designate a DPO (mandatorily or voluntarily) must communicate the appointment, and any subsequent removal, to AEPD within 10 days. Category narrative 74 words Spain operates a fully-implemented GDPR omnibus regime. The Agencia Española de Protección de Datos (AEPD) is the national supervisory authority, operating under Ley Orgánica 3/2018 (LOPDGDD) alongside directly-applicable GDPR (Regulation (EU) 2016/679). The obligation to register files with AEPD was abolished on 25 May 2018 and replaced with internal accountability tools (ROPA). Territorial scope follows GDPR Art 3, extending to non-EU controllers targeting or monitoring EU-resident data subjects, who must appoint an EU representative. Evidence 6 Sources and claims (6) - Confirmed[Agencia Española de Protección de Datos](https://www.aepd.es/en/about-aepd/welcome-aepd) — The Agencia Española de Protección de Datos (AEPD) is Spain's national data protection supervisory authority under GDPR and LOPDGDD.observed 2026-08-03 - Confirmed[Agencia Española de Protección de Datos](https://www.aepd.es/en/our-work-and-tools/regulation) — Spain's data protection regime rests on GDPR (Regulation (EU) 2016/679) applied directly, LOPDGDD, LO 7/2021, RD 389/2021 (AEPD Statute) and Ley 34/2002 (LSSI) for e-commerce/electronic communications.observed 2026-08-03 - Confirmed[Agencia Española de Protección de Datos](https://www.aepd.es/preguntas-frecuentes/2-tus-obligaciones-como-responsable-del-tratamiento/2-aplicacion-de-la-normativa) — GDPR/LOPDGDD apply to the processing of personal data relating to identified or identifiable natural persons; data concerning legal persons is not covered.observed 2026-08-03 - Confirmed[Agencia Española de Protección de Datos](https://www.aepd.es/preguntas-frecuentes/2-tus-obligaciones-como-responsable-del-tratamiento/2-aplicacion-de-la-normativa/FAQ-0202-a-quien-se-aplica-el-RGPD) — Non-EU-established controllers/processors offering goods or services to, or monitoring the behaviour of, EU data subjects fall within GDPR's territorial scope and must appoint an EU representative as contact point for supervisory authorities and data subjects.observed 2026-08-03 - Confirmed[Agencia Española de Protección de Datos](https://www.aepd.es/preguntas-frecuentes/2-tus-obligaciones-como-responsable-del-tratamiento/2-aplicacion-de-la-normativa/FAQ-0205-sobre-la-obligatoriedad-de-la-inscripcion-de-ficheros) — Since 25 May 2018, the obligation to register/notify processing files with AEPD has disappeared, both for public and private controllers, replaced by the internal Registro de Actividades de Tratamiento (ROPA).observed 2026-08-03 - Confirmed[Agencia Española de Protección de Datos](https://www.aepd.es/en/rights-and-duties/fulfill-your-duties/measures-compliance/data-protection-officer) — Controllers/processors that designate a DPO (mandatorily or voluntarily) must communicate the appointment, and any subsequent removal, to AEPD within 10 days.observed 2026-08-03