---
title: "Spain — Sectoral Watch | Data Protection Monitor"
canonical: https://dataprotection.gi/jurisdictions/spain/sectoral-watch/
source_html: /jurisdictions/spain/sectoral-watch/index.html
description: "Spain — Sectoral Watch: sectoral_watch Sectoral Watch 7 sub-modules 6 claims Amber ▾ # No separate sectoral statutes displace GDPR, but overlays exist and healthcare/financial sanctioning activity rose sharpl"
generated_at: 2026-10-25T04:46:50Z
content_sha256: 9dbb034270d51f486521fb222417743dea9457dd9eea30e6c173fac62ef0a928
generator: "fe-fleet/md-twin@1.0"
---
# Spain — Sectoral Watch | Data Protection Monitor

### D6Sectoral Watch7 sub-modules6 claimsAmber▾#

No separate sectoral statutes displace GDPR, but overlays exist and healthcare/financial sanctioning activity rose sharply in 2025, indicating active but uneven sectoral risk.

Primary framework GDPR/LOPDGDD + Ley 34/2002 (LSSI) + sector codes of conduct

Supervisory authority [Agencia Española de Protección de Datos (AEPD)](https://www.aepd.es)

Traffic-light rationale — Amber No separate sectoral statutes displace GDPR, but overlays exist and healthcare/financial sanctioning activity rose sharply in 2025, indicating active but uneven sectoral risk.

#### Sub-modules (7)

#### Financial Sector OverlayAmber

No separate banking-secrecy statute displaces GDPR; AEPD actively enforces against financial institutions, e.g. the 2026 CaixaBank fine and 2026 Gesternova (energy-retail, financial data) fine.

Claims (1):

- AEPD fined Gesternova, S.A. €220,000 in January 2026 for processing personal data without a valid legal basis and failing to provide mandatory transparency information at collection.

#### Health Sector OverlayAmber

Health data processing requires heightened DPO designation given its Art 9 special-category status; sanitary-sector sanctioning procedures rose 278% in 2025 (34 cases).

Claims (2):

- AEPD has endorsed designating a single DPD for health-data processing bodies (e.g. within a defence-sector health inspectorate) given the special-category nature of health data and the scale of processing.
- AEPD's 2025 annual figures show sanitary-sector sanctioning/reprimand procedures rose 278% year-on-year to 34 cases, among the six most active enforcement areas.

#### Telecoms And EprivacyGreen

Ley 34/2002 (LSSI) complements GDPR safeguards for information-society services, including the cookie-consent regime under its Art 22.2.

Claims (1):

- Ley 34/2002 (LSSI) complements GDPR safeguards for information-society services in Spain, including the cookie/tracker consent regime under LSSI Art 22.2.

#### Employment DataAmber

Biometric access/presence-control systems in employment require a specific statutory basis; consent is deemed inadequate due to employer/employee power imbalance.

Claims (1):

- AEPD guidance holds that consent cannot lift the Art 9 prohibition for biometric presence/access-control systems in employment contexts due to the power imbalance between employer and employee, and that reliance on the 'essential public interest' exception requires a statute of appropriate legal rank that does not currently authorise biometric time-control.

#### Credit And ScoringAmber

No ES-specific credit-scoring statute beyond GDPR Art 22 automated-decision safeguards was located in this research pass.

Absence provenance: unavailable . Searched: AEPD scoring crediticio normativa.

#### EducationGreen

Educational institutions offering any regulated level of teaching must designate a DPD, and online classes/exams do not require separate consent as they are legitimised by the educational mandate itself.

Claims (1):

- Educational institutions are obliged to designate a DPD in the cases covered by GDPR Art 37 and, in all cases, when they offer teaching at any level established under regulating legislation; online classes/exams delivered as part of regulated education do not require separate student/parental consent.

#### InsuranceGreen

The insurance sector operates under a voluntary Art 40 GDPR code of conduct (UNESPA CC-0012-2019) supervised by an OCCC, supplementing but not displacing GDPR/LOPDGDD.

Claims (1):

- The Spanish insurance sector operates under a voluntary Art 40 GDPR code of conduct (UNESPA CC-0012-2019), supervised by an OCCC, requiring adherent insurers to disclose their DPO identity and maintain ROPA compliance.

Category narrative 54 words

GDPR/LOPDGDD apply horizontally, with sector overlays: Ley 34/2002 LSSI for electronic communications/cookies, DPO-mandatory designation for schools and sports federations processing minors' data, heightened biometric-data scrutiny in employment, and voluntary Art 40 sectoral codes of conduct (e.g. UNESPA insurance code). AEPD's strategic engagement covers health, education, telecoms, insurance, banking, and public administration as priority sectors.

No new data since the standing brief. 1 periodic run re-emitted it unchanged.

Evidence 6

Sources and claims (6)
- Confirmed[DataGuidance](https://www.dataguidance.com/news/spain-aepd-fines-gesternova-eu220000-unlawful-data) — AEPD fined Gesternova, S.A. €220,000 in January 2026 for processing personal data without a valid legal basis and failing to provide mandatory transparency information at collection.observed 2026-08-03
- Confirmed[Agencia Española de Protección de Datos](https://www.aepd.es/documento/2019-0100.pdf) — AEPD has endorsed designating a single DPD for health-data processing bodies (e.g. within a defence-sector health inspectorate) given the special-category nature of health data and the scale of processing.observed 2026-08-03
- Confirmed[Agencia Española de Protección de Datos](https://www.aepd.es/prensa-y-comunicacion/notas-de-prensa/la-agencia-recibio-mas-de-30.000-reclamaciones-en-2025-un-64-mas) — AEPD's 2025 annual figures show sanitary-sector sanctioning/reprimand procedures rose 278% year-on-year to 34 cases, among the six most active enforcement areas.observed 2026-08-03
- Confirmed[Agencia Española de Protección de Datos](https://www.aepd.es/guias/orientaciones-analitica-web-aapp.pdf) — Ley 34/2002 (LSSI) complements GDPR safeguards for information-society services in Spain, including the cookie/tracker consent regime under LSSI Art 22.2.observed 2026-08-03
- Confirmed[Agencia Española de Protección de Datos](https://www.aepd.es/preguntas-frecuentes/10-menores-y-educacion) — Educational institutions are obliged to designate a DPD in the cases covered by GDPR Art 37 and, in all cases, when they offer teaching at any level established under regulating legislation; online classes/exams delivered as part of regulated education do not require separate student/parental consent.observed 2026-08-03
- Probable[AEPD / UNESPA](https://www.aepd.es/documento/codigo-conducta-unespa-cc-0012-2019.pdf) — The Spanish insurance sector operates under a voluntary Art 40 GDPR code of conduct (UNESPA CC-0012-2019), supervised by an OCCC, requiring adherent insurers to disclose their DPO identity and maintain ROPA compliance.observed 2026-08-03