Spain

GDPR Articles 33-34 and LOPDGDD Article 69, Breach Notification

A controller must notify the AEPD within 72 hours of becoming aware of a personal-data breach, and notify the affected individual without undue delay where the breach is likely to result in a high risk.

LOPDGDD Article 69 gives the AEPD its own provisional-measures power, including a cautionary data block tied specifically to international-transfer risk (Art. 69.2), and Titulo IX makes late, incomplete, or missing breach notification its own separate administrative infraction (Art. 73(r)-(s)), confirmed by reading Titulo IX's text directly rather than inferring it from General Data Protection Regulation (GDPR) alone.

Ley Organica 3/2018 (LOPDGDD), GDPR-Aligned Comprehensive Regime

Spain gives the General Data Protection Regulation (GDPR) domestic effect through the Ley Organica 3/2018 (LOPDGDD, Organic Law on the Protection of Personal Data and the Guarantee of Digital Rights), in force since 7 December 2018.

Unlike a bare implementing act, the LOPDGDD carries substantial national additions confirmed by reading the BOE text directly: a freestanding Titulo X on digital rights (Arts. 79-97), a Titulo VI chapter on international transfers (Arts. 40-43) layered on GDPR Chapter V, and a Titulo IX administrative sanctioning regime (Arts. 70-78) calibrated onto GDPR Article 83's fine tiers.

Article 8, read verbatim, tightens rather than loosens GDPR's public-interest and legal-obligation bases: such processing is valid only where a Union-law norm or a Spanish statute-rank norm so provides.

LOPDGDD Titulo VI, International Transfers, Layered on GDPR Chapter V

A transfer of personal data outside the EEA requires an adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation, backed by the Article 83(5) top fine tier. LOPDGDD Titulo VI (Arts. 40-43), confirmed by reading the article headings directly, adds a national administrative-procedure layer: cases the AEPD may itself authorize, cases requiring AEPD prior authorization, and cases requiring prior notice to the competent authority.

LOPDGDD Article 72.1(l) separately makes an unauthorized international transfer its own "muy grave" national infraction category.

LOPDGDD Titulo III and Titulo X, Data-Subject and Digital Rights

LOPDGDD Titulo III (Arts. 11-18) mirrors General Data Protection Regulation (GDPR) Articles 12-22 domestically: transparency, access, rectification, erasure, restriction, portability, and objection.

Titulo X then layers freestanding rights with no GDPR counterpart, confirmed by reading the article titles directly: Article 93's right to be forgotten against internet search engines, Article 94's equivalent against social-network services, Article 95's social-network portability right, and Article 96's right to a digital will governing a deceased person's digital accounts.

AEPD Enforcement, GDPR Article 82 and LOPDGDD Titulo IX

The AEPD is Spain's supervisory authority; LOPDGDD Titulo IX (Arts. 70-78) sorts infractions into muy graves, graves, and leves, each defined by direct cross-reference to a General Data Protection Regulation (GDPR) Article 83 tier rather than an independent Spanish fine scale, confirmed by reading the text directly. GDPR Article 82 arms an individual with a direct private right of action.

This session could not confirm the specific Spanish instrument transposing the EU Representative Actions Directive for collective data-protection claims; LOPDGDD's own Disposicion final septima, read directly, only modifies a narrow amicus provision, not a class-action mechanism.

GDPR Article 9 and AEPD Biometric Guidance, Special Categories

LOPDGDD Article 9 supplies no independent biometric definition; it operates entirely within General Data Protection Regulation (GDPR) Article 9's special-category frame.

The AEPD's November 2023 guide on biometric presence-control systems, read directly (and itself marked "en revision", under review, so treated as the AEPD's current stated position rather than a settled rule), concludes that current Spanish law contains no sufficiently specific statutory authorization for biometric employee time-and-attendance processing, applying the Tribunal Constitucional's STC 76/2019 reserva-de-ley standard.

The AEPD fined Mercadona EUR 2,520,000 (Resolucion PS/00120/2021) for a facial-recognition system matching shoppers against people with criminal convictions or restraining orders, holding the processing categorically prohibited under Article 9.1 with no Article 9.2 exception available.