Law note · Spain
LOPDGDD Titulo VI, International Transfers, Layered on GDPR Chapter V
A transfer of personal data outside the EEA requires an adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation, backed by the Article 83(5) top fine tier. LOPDGDD Titulo VI (Arts. 40-43), confirmed by reading the article headings directly, adds a national administrative-procedure layer: cases the AEPD may itself authorize, cases requiring AEPD prior authorization, and cases requiring prior notice to the competent authority.
LOPDGDD Article 72.1(l) separately makes an unauthorized international transfer its own "muy grave" national infraction category.
What it asks of an app
- Rely on an adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data of a person in Spain outside the EEA, and check whether LOPDGDD Articles 41-43 require AEPD authorization or prior notice for the specific transfer.
When LexLint raises it
Declared activities: crawls_web, trains_models
Primary source: GDPR Arts. 44-49, 83(5)
LOPDGDD Arts. 40-43, 72.1(l) (direct read)