What obligations your company has, when you need a data protection officer and how to avoid fines, with an English-speaking specialist lawyer if you need one.
Data protection for businesses: what you must comply with
Every company, self-employed person or association that processes personal data must comply with the General Data Protection Regulation (GDPR; RGPD in Spanish) and Ley Orgánica 3/2018 (LOPDGDD). A data protection lawyer reviews your processing and helps you comply.
Do you need a data protection officer?
A data protection officer (DPO; DPD in Spanish) is compulsory for public bodies, for organisations that regularly and systematically monitor individuals on a large scale or process health data or other special categories on a large scale, and in the cases set out in the LOPDGDD (educational establishments, healthcare centres, financial institutions…). In all other cases, it is voluntary.
Data protection and employees
The relationship with staff is also subject to the rules: inform them about video surveillance, set rules on the use and monitoring of devices and on geolocation, and respect the right to digital disconnection. Review it together with employment advice.
Website, cookies and marketing
Non-technical cookies need consent, and marketing emails, as a general rule, prior consent, unless there is an earlier contractual relationship involving similar products or services. A GDPR consultant helps with the technical side; legal interpretation and defence before the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) are a lawyer’s job.
Fines and how the AEPD acts
The AEPD can investigate on its own initiative or following a complaint from an affected person. Fines can reach €20 million or 4% of total worldwide annual turnover, whichever is higher. More services in commercial lawyer, including your trade mark with an intellectual property lawyer.
Checklist
What obligations your company has
Four points for reviewing how your company handles personal data.
Legal basis for each processing activity (consent, contract, legal obligation or legitimate interest) and the duty to inform with clear clauses.
Record of processing activities: in practice almost all companies need one, including those with fewer than 250 workers.
Data processor agreements with the suppliers that have access to your data, such as the gestoría (an administrative and accounting agency) or the web hosting.
Individuals' rights (access, rectification, erasure, objection…): you must respond within one month, which can be extended in complex cases.
Security breaches
A data breach? The 72 hours count
If it poses a risk to individuals, it must be notified to the AEPD without delay and, where possible, within 72 hours of your becoming aware of it.
What data you process or what letter you have received from the AEPD: that's all we need.
02
02A specialist
A GDPR lawyer reviews it
A lawyer specialising in data protection studies your case and contacts you.
03
03No obligation
You decide with the facts
You'll know your options and the fee quote before you take any step.
No-obligation enquiry
Doubts about the GDPR?
Tell us about your case: a data protection lawyer will review your obligations or help you before the AEPD.
Enquiring is free
Your details, always confidential
No obligation to hire
Your enquiry
Under 2 min
Confidential
No obligation
Frequently asked questions
Questions about data protection
Does a small company or a self-employed person have to comply with the GDPR?
Yes: the GDPR applies to anyone who processes personal data in their business, whatever their size. What changes is the level of measures, according to the risk of the processing.
What is the record of processing activities?
An internal document setting out what personal data you process, what for, who you disclose it to, how long you keep it and what security measures you apply. The AEPD can ask you for it.
When is a data protection officer compulsory?
In public bodies, in organisations that monitor individuals or process sensitive data on a large scale and in the cases listed by the LOPDGDD. In all other cases, it is voluntary.
How high can data protection fines be?
The most serious, up to €20 million or 4% of total worldwide annual turnover, whichever is higher, depending on the seriousness, the intent and the size of the company.
What do I do if I receive a complaint from the AEPD?
Reply within the deadline stated in the letter, explaining what measures you have taken, ideally with a lawyer: what you answer can influence whether sanctioning proceedings are opened.
What the people we put in touch with their lawyer tell us.
4.9/5
★★★★★
Average rating on Google
“★★★★★
From the very first moment they inspired a lot of confidence. They explained everything clearly and answered my questions in a friendly, professional way. Without a doubt, a very positive experience.
María G.Google
“★★★★★
Excellent treatment and impeccable service. I especially appreciate that they explained the different options available and the steps I needed to follow. Very professional and attentive.
Carlos M.Google
“★★★★★
I was looking for advice and found a team that made me feel listened to from the start. I would highlight how clearly they explain things, how approachable they are and the peace of mind they give you throughout the whole process.
María G.Google
Carlos M.Google
Laura R.Google