Spain

Two layers stack here. The bloc layer is Regulation (EU) 2016/679 (GDPR), Articles 3(2) and 27. The national layer is Ley Organica 3/2018 (LOPDGDD), whose Article 2 extends the Spanish statute to processing that the GDPR itself does not directly cover, for example activities outside European Union law. Article 2(2)(c) carves out processing governed by classified-information rules, which is the defence sector's exit door. Spain has no separate registration, licence or filing before you may start processing.

The wall is Article 46 bis of Ley 40/2015, inserted by Real Decreto-ley 14/2019 on public-security grounds — the one ground that Regulation (EU) 2018/1807 leaves open to member states. Verbatim: 'Los sistemas de informacion y comunicaciones para la recogida, almacenamiento, procesamiento y gestion del censo electoral, los padrones municipales de habitantes y otros registros de poblacion, datos fiscales relacionados con tributos propios o cedidos y datos de los usuarios del sistema nacional de salud, asi como los correspondientes tratamientos de datos personales, deberan ubicarse y prestarse dentro del territorio de la Union Europea.' Sector ratings on top of the national picture: - Government and public-sector suppliers: data can leave with the right paperwork, but European Union location is compulsory for the four categories above, and any system sold into the Spanish public sector must be certified against the National Security Framework (Esquema Nacional de Seguridad). - Health: data can leave with the right paperwork generally; data can leave with the right paperwork and EU-wall for national health service user data via Article 46 bis. Private clinics outside the national health service are not caught by that article. - Online gambling: data can leave with the right paperwork. Contrary to widespread belief the technical decree expressly permits the operator's central gaming unit and its backup to sit anywhere in the world; what it demands is real-time monitoring from Spain, physical inspection access, and a Spanish '.es' website. The regulator does hold a live power to order named secondary systems into Spain. - Telecoms: data can leave with the right paperwork. Connection records must be kept for twelve months but no article says where. - Banking, payments, securities, insurance: data can leave with the right paperwork. No location rule found in the Spanish statutes, checked 18 August 2026. Insurance outsourcing is gated by a prior-notification and veto process instead. - Mapping and location data: no localisation rule found in Spanish law, checked 18 August 2026, medium confidence. - Defence and classified material: outside the data protection statute entirely and governed by the 1968 Official Secrets Act.

Ley Organica 3/2018 Articles 40 to 43 bolt Spanish procedure onto the European framework. Article 41 lets the Spanish Agency, and the regional authorities in Catalonia, the Basque Country and Andalusia, adopt their own standard clauses and approve binding corporate rules, with a nine-month maximum for the latter. Article 42 makes prior authorisation compulsory for bespoke contractual safeguards and for certain public-body transfers. Article 43 requires you to tell the regulator in advance if you rely on the narrow 'compelling legitimate interests' route, and to tell the affected people too. On the approved list itself, the bloc-layer position applies unchanged: Andorra, Argentina, Brazil, Canada (commercial bodies), Faroe Islands, Guernsey, Isle of Man, Israel, Japan, Jersey, New Zealand, South Korea, Switzerland, the United Kingdom, Uruguay, and the United States only for organisations self-certified under the EU-US Data Privacy Framework. None has been withdrawn or suspended as at 18 August 2026. For the four Article 46 bis categories the picture inverts: standard contracts and corporate rules are unavailable, and only the approved list works.

The Agencia Espanola de Proteccion de Datos (AEPD) is chaired by Lorenzo Cotino and publishes press releases, guidance and decisions continuously — items dated 9, 14, 15, 20, 21, 23, 27 and 28 July 2026 were live on its site. It is consistently among the highest-volume enforcers in Europe. Rating: aggressive. It runs a priority channel for urgent takedowns of intimate imagery, opens investigations on its own initiative, and its published caseload is dominated by finance and insurance (9,928 decisions), information and communications (8,435) and video surveillance (7,072). One large asterisk: Article 77 of Ley Organica 3/2018 means Spanish public bodies, the Bank of Spain, public universities and similar entities are not fined. They receive a warning and an order to fix the problem. So the regulator's fining power is aimed squarely at the private sector. The Catalan authority (Autoritat Catalana de Proteccio de Dades, director Meritxell Borras) was publishing through July 2026. The Basque and Andalusian authorities exist and are named in the statute; we did not separately re-verify their 2026 output in this run. Sector regulators that also bite: the Bank of Spain, the securities commission CNMV, the insurance directorate DGSFP, the gambling directorate DGOJ, the telecoms and competition authority CNMC, the National Cryptologic Centre for public-sector cyber incidents, and INCIBE for everyone else.

Floors, with citations: - Money laundering: ten years for customer due diligence papers and transaction records, Ley 10/2010 Article 25. After five years the file may only be opened by internal compliance staff and legal defence. At the ten-year mark deletion is mandatory, not optional — the statute says 'procediendo tras el mismo a su eliminacion'. This is one of the few genuine ceilings in Spanish law. - Business books and correspondence: six years from the last accounting entry, Commercial Code Article 30. - Clinical records: at least five years from discharge for each episode of care, Ley 41/2002 Article 17. Birth-related records are never destroyed. Several regions set longer periods in their own health laws. - Telecoms connection records: twelve months, Ley 25/2007 Article 5, adjustable by regulation between six months and two years. - Tax: the authorities' right to assess expires after four years, Ley 58/2003 Article 66, so four years is the practical floor for tax paperwork. The ceiling: Article 32 of Ley Organica 3/2018 creates a duty to 'block' data. When you rectify or erase, you must isolate the record, make it invisible to normal processing, and keep it available only to courts, prosecutors and regulators until the relevant limitation period runs out — then destroy it. If your system cannot do this you must record that fact and migrate at your next major upgrade. A global 'delete means delete' architecture is non-compliant in Spain. Conflict resolution: the sector floor wins over a person's erasure request, and the blocking rule is what bridges the gap.

Clock one — privacy. Regulation (EU) 2016/679 Article 33, confirmed on the Spanish regulator's own breach page: 72 hours from becoming aware. You notify the Spanish agency if your only establishment is in Spain, or if Spain hosts your main European establishment. High-risk breaches must also be told to the affected people without undue delay. Clock two — telecoms. Commission Regulation (EU) 611/2013 gives providers of publicly available electronic communications services 24 hours from detection to make an initial notification. It applies directly and is easy to miss because it sits outside the GDPR. Clock three — cyber. Real Decreto 43/2021 with Real Decreto-ley 12/2018 governs operators of essential services and digital service providers. Its national instruction sets a reporting window table: initial notification immediate for CRITICAL, VERY HIGH and HIGH incidents; intermediate report at 24 to 48 hours (critical) or 72 hours (very high); final report at 20 days (critical) or 40 days (very high). Reporting goes through the National Platform for Cyber Incident Notification, to the National Cryptologic Centre for public bodies or INCIBE for private operators. The overlap is where people fail. A ransomware attack on a Spanish telecoms operator triggers all three at once, on three different forms, to two or three different bodies.

1. Age of consent — Article 7 of Ley Organica 3/2018 sets fourteen. Below fourteen you need a parent or guardian. Most global products are built to sixteen or thirteen; both are wrong for Spain. 2. Blocking — Article 32 of the same law. Rectified or erased data must be identified, reserved and made unavailable to everything except courts, prosecutors and regulators, for as long as liability could still be claimed, and only then destroyed. Where the system cannot do it, you must document that and fix it at the next major overhaul. 3. Mandatory data protection officers — Article 34 lists sixteen categories on top of the European test: professional colleges, all schools and universities, telecoms operators processing at large scale, online services that profile users at large scale, credit institutions, financial credit establishments, insurers and reinsurers, investment firms, electricity and gas retailers and distributors, credit-scoring and fraud-prevention file operators, advertising and market research firms that profile, health centres that keep clinical records, commercial-report issuers, and electronic gambling operators. 4. Criminal liability — Criminal Code Article 197(2) punishes appropriating, using or altering another person's reserved personal data held in any file, to their detriment, with one to four years in prison plus a fine. Article 197 quinquies extends liability to the company itself. This is prosecution, not an administrative fine, and it attaches to named individuals. 5. Encryption disclosure — Ley 11/2022 Article 62(2) allows the state to require an electronic communications operator to hand over the algorithms or any encryption procedure used, and to hand over cipher equipment free of charge, where essential state security, public security or a criminal investigation justifies it. Bonus trap: Real Decreto-ley 14/2019 restricted the use of distributed ledger (blockchain) systems for identifying and signing in dealings with Spanish public administrations, unless the central government acts as an intermediate authority. Teams building on-chain identity for Spanish public-sector work walk into this without warning.

Confirmed gaps and dates: - Network and Information Security Directive 2 (NIS2): a search of the official gazette's consolidated national legislation on 18 August 2026 found no Spanish transposing act. The operative regime remains Real Decreto-ley 12/2018 and Real Decreto 43/2021. When the transposition lands it will expand the list of covered sectors, add management liability and change the reporting clocks. Treat the current comfort as temporary. - No Spanish artificial intelligence governance act appears in the gazette either, though the supervisory agency AESIA is up and running and coordinating with the privacy regulator as of July 2026. The EU AI Act's transparency duties started on 2 August 2026 regardless. - No organic law on protecting minors in digital environments appears in the gazette as at 18 August 2026. If and when it passes it is expected to disturb the fourteen-year consent age. - Data Act (EU) 2023/2854: cloud switching charges and data egress fees must be zero from 12 January 2027. Dormant switches, all live today: 1. Ley 11/2022 Article 4(6): the government may, exceptionally and temporarily, take over direct management of electronic communications services or networks for public and national security. No notice, no consultation. 2. Real Decreto 1613/2011 Article 14(3): the gambling regulator may require an operator to place named secondary systems inside Spain. Not currently exercised generally, and it converts a location-neutral regime into a localisation regime overnight. 3. Ley 11/2022 Article 62(2): the state may demand the encryption algorithms and procedures an operator uses. 4. Ley 40/2015 Article 46 bis is drafted around public security and is expressly provisional 'until progress is made within the European Union'. Its scope could be widened by another decree-law with immediate effect, exactly as it was created. 5. Bloc-level: the EU-US Data Privacy Framework remains valid but the European Data Protection Board formally asked the Commission on 31 July 2026 to examine its validity. Any Spanish architecture that relies on that framework alone should have a fallback.