Spain: Sectoral Watch

Financial Sector OverlayAmber

No separate banking-secrecy statute displaces GDPR; AEPD actively enforces against financial institutions, e.g. the 2026 CaixaBank fine and 2026 Gesternova (energy-retail, financial data) fine.

Claims (1):

• AEPD fined Gesternova, S.A. €220,000 in January 2026 for processing personal data without a valid legal basis and failing to provide mandatory transparency information at collection.

Health Sector OverlayAmber

Health data processing requires heightened DPO designation given its Art 9 special-category status; sanitary-sector sanctioning procedures rose 278% in 2025 (34 cases).

Claims (2):

• AEPD has endorsed designating a single DPD for health-data processing bodies (e.g. within a defence-sector health inspectorate) given the special-category nature of health data and the scale of processing.
• AEPD's 2025 annual figures show sanitary-sector sanctioning/reprimand procedures rose 278% year-on-year to 34 cases, among the six most active enforcement areas.

Telecoms And EprivacyGreen

Ley 34/2002 (LSSI) complements GDPR safeguards for information-society services, including the cookie-consent regime under its Art 22.2.

Claims (1):

• Ley 34/2002 (LSSI) complements GDPR safeguards for information-society services in Spain, including the cookie/tracker consent regime under LSSI Art 22.2.

Employment DataAmber

Biometric access/presence-control systems in employment require a specific statutory basis; consent is deemed inadequate due to employer/employee power imbalance.

Claims (1):

• AEPD guidance holds that consent cannot lift the Art 9 prohibition for biometric presence/access-control systems in employment contexts due to the power imbalance between employer and employee, and that reliance on the 'essential public interest' exception requires a statute of appropriate legal rank that does not currently authorise biometric time-control.

Credit And ScoringAmber

No ES-specific credit-scoring statute beyond GDPR Art 22 automated-decision safeguards was located in this research pass.

Absence provenance: unavailable. Searched: AEPD scoring crediticio normativa.

EducationGreen

Educational institutions offering any regulated level of teaching must designate a DPD, and online classes/exams do not require separate consent as they are legitimised by the educational mandate itself.

Claims (1):

• Educational institutions are obliged to designate a DPD in the cases covered by GDPR Art 37 and, in all cases, when they offer teaching at any level established under regulating legislation; online classes/exams delivered as part of regulated education do not require separate student/parental consent.

InsuranceGreen

The insurance sector operates under a voluntary Art 40 GDPR code of conduct (UNESPA CC-0012-2019) supervised by an OCCC, supplementing but not displacing GDPR/LOPDGDD.

Claims (1):

• The Spanish insurance sector operates under a voluntary Art 40 GDPR code of conduct (UNESPA CC-0012-2019), supervised by an OCCC, requiring adherent insurers to disclose their DPO identity and maintain ROPA compliance.