Spain

Two layers stack here. The European layer is the General Data Protection Regulation, Regulation (EU) 2016/679. It sets the reach test and the duty to name a representative in Europe. The Spanish layer is Ley Organica 3/2018 (LOPDGDD). It stretches the Spanish law to cover uses of data that the European rules do not reach directly, such as activities outside European Union law. It also leaves out anything covered by classified-information rules. That is the exit door for the defence industry. Spain has no separate registration, licence or filing before you may start using personal data.

The ban comes from Ley 40/2015, as amended by Real Decreto-ley 14/2019 on public-security grounds. Public security is the one ground that Regulation (EU) 2018/1807 leaves open to member states. The Spanish text reads: 'Los sistemas de informacion y comunicaciones para la recogida, almacenamiento, procesamiento y gestion del censo electoral, los padrones municipales de habitantes y otros registros de poblacion, datos fiscales relacionados con tributos propios o cedidos y datos de los usuarios del sistema nacional de salud, asi como los correspondientes tratamientos de datos personales, deberan ubicarse y prestarse dentro del territorio de la Union Europea.' Industry by industry, on top of the national position: - Government and public-sector suppliers: data can leave only if conditions are met European Union location is compulsory for the four kinds of data above. Any system sold into the Spanish public sector must also be certified against Spain's national security standard for public bodies, the Esquema Nacional de Seguridad. - Health: data can leave only if conditions are met in general. For national health service user data it is conditional with EU wall, because of the four-category rule. Private clinics outside the national health service are not covered by that rule. - Online gambling: data can leave only if conditions are met The technical decree expressly allows the operator's central gaming unit and its backup to sit anywhere in the world. What it demands is real-time monitoring from Spain, physical inspection access, and a Spanish '.es' website. The regulator does hold a live power to order named secondary systems into Spain. - Telecoms: data can leave only if conditions are met Connection records must be kept for twelve months. No rule says where. - Banking, payments, securities, insurance: data can leave only if conditions are met We found no location rule in the Spanish laws, checked 18 August 2026. Insurance outsourcing is controlled instead by advance notice and a right to veto. - Mapping and location data: we found no rule forcing data to stay in the country, checked 18 August 2026, medium confidence. - Defence and classified material: outside the data protection law entirely. It is governed by the 1968 Official Secrets Act.

Ley Organica 3/2018 adds Spanish procedure on top of the European rules. The Spanish Agency can adopt its own standard clauses and approve group-wide internal rules. So can the regional authorities in Catalonia, the Basque Country and Andalusia. Group-wide rules take up to nine months to approve. You need permission in advance for a contract you wrote yourself, and for certain transfers by public bodies. If you rely on the narrow 'compelling legitimate interests' route, you must tell the regulator in advance and tell the affected people too. The approved list is the European one, unchanged. It covers Andorra, Argentina, Brazil, Canada (commercial bodies), Faroe Islands, Guernsey, Isle of Man, Israel, Japan, Jersey, New Zealand, South Korea, Switzerland, the United Kingdom, Uruguay, and the United States only for organisations signed up to the EU-US Data Privacy Framework. None has been withdrawn or suspended as at 18 August 2026. For the four kinds of state-held data it works the other way round. Standard contracts and group-wide rules are not available. Only the approved list works.

The Agencia Espanola de Proteccion de Datos (AEPD) is chaired by Lorenzo Cotino. It publishes press releases, guidance and decisions continuously. Items dated 9, 14, 15, 20, 21, 23, 27 and 28 July 2026 were live on its site. It is consistently among the highest-volume enforcers in Europe. We rate it aggressive. It runs a fast channel for urgent takedowns of intimate images. It opens investigations on its own initiative. Its published caseload is dominated by finance and insurance (9,928 decisions), information and communications (8,435) and video surveillance (7,072). One big exception. Under Ley Organica 3/2018, Spanish public bodies, the Bank of Spain, public universities and similar entities are not fined. They get a warning and an order to fix the problem. So the power to fine is aimed at private companies. The Catalan authority (Autoritat Catalana de Proteccio de Dades) is led by Meritxell Borras. It was publishing through July 2026. The Basque and Andalusian authorities exist and are named in the law. We did not separately check their 2026 output. Other regulators also enforce: the Bank of Spain, the securities commission CNMV, the insurance directorate DGSFP, the gambling directorate DGOJ, the telecoms and competition authority CNMC, the National Cryptologic Centre for public-sector cyber incidents, and INCIBE for everyone else.

MINIMUM KEEP-TIMES: - Money laundering: ten years for customer checks and transaction records, under Ley 10/2010. After five years only internal compliance staff and legal defence staff may open the file. At ten years you must delete it. The law says 'procediendo tras el mismo a su eliminacion'. This is one of the few real deadlines to delete in Spanish law. - Business books and correspondence: six years from the last accounting entry, under the Commercial Code. - Clinical records: at least five years from discharge for each episode of care, under Ley 41/2002. Birth-related records are never destroyed. Several regions set longer periods in their own health laws. - Telecoms connection records: twelve months, under Ley 25/2007. A regulation can move this between six months and two years. - Tax: the authorities' right to assess runs out after four years, under Ley 58/2003. So four years is the working minimum for tax paperwork. MAXIMUM KEEP-TIMES: Ley Organica 3/2018 creates a duty to 'block' data. When you correct or erase, you must isolate the record. You must make it invisible to normal use. You keep it available only to courts, prosecutors and regulators until the relevant time limit runs out. Then you destroy it. If your system cannot do this, you must write that down and fix it at your next major upgrade. A system where delete means delete does not comply in Spain. CLASHES: the minimum keep-time set for your industry beats a person's request to erase. The blocking rule is what bridges the gap.

Deadline one, privacy. Regulation (EU) 2016/679 gives you 72 hours from becoming aware. The Spanish regulator confirms this on its own breach page. You notify the Spanish agency if your only office is in Spain, or if Spain hosts your main European office. If the risk to people is high, you must also tell them without undue delay. Deadline two, telecoms. Commission Regulation (EU) 611/2013 gives providers of public electronic communications services 24 hours from detection to send a first notice. It applies directly and is easy to miss, because it sits outside the main European privacy rules. Deadline three, cyber. Real Decreto 43/2021, together with Real Decreto-ley 12/2018, covers operators of essential services and digital service providers. The national instruction sets the timetable. The first notice is immediate for CRITICAL, VERY HIGH and HIGH incidents. The interim report is due at 24 to 48 hours for critical incidents, or 72 hours for very high ones. The final report is due at 20 days for critical, or 40 days for very high. You report through the National Platform for Cyber Incident Notification. That goes to the National Cryptologic Centre for public bodies, or INCIBE for private operators. The overlap is where people fail. A ransomware attack on a Spanish telecoms operator sets off all three at once, on three different forms, to two or three different bodies.

1. Age of consent. Ley Organica 3/2018 sets it at fourteen. Below fourteen you need a parent or guardian. Most global products are built to sixteen or thirteen. Both are wrong for Spain. 2. Blocking. The same law says data you correct or erase must be identified, set aside and made unavailable to everything except courts, prosecutors and regulators. It stays that way for as long as someone could still bring a claim. Only then do you destroy it. If your system cannot do this, you must write that down and fix it at the next major overhaul. 3. Compulsory data protection officers. The law lists sixteen kinds of organisation on top of the European test. They are professional colleges, all schools and universities, telecoms operators handling data at large scale, online services that profile users at large scale, credit institutions, financial credit establishments, insurers and reinsurers, investment firms, electricity and gas retailers and distributors, credit-scoring and fraud-prevention file operators, advertising and market research firms that profile people, health centres that keep clinical records, commercial-report issuers, and electronic gambling operators. 4. Criminal liability. The Criminal Code punishes taking, using or altering another person's private personal data held in any file, to their harm. The penalty is one to four years in prison plus a fine. The Code also makes the company itself liable. This is a prosecution, not an administrative fine, and it attaches to named individuals. 5. Handing over encryption. Ley 11/2022 lets the state require an electronic communications operator to hand over the algorithms or any encryption method it uses. It must also hand over cipher equipment free of charge. This applies where essential state security, public security or a criminal investigation justifies it. One more trap. Real Decreto-ley 14/2019 limited the use of blockchain systems in dealings with Spanish public bodies. That covers using blockchain to identify people and to sign. It is allowed only if the central government acts as an intermediate authority. Teams building blockchain identity for Spanish public-sector work walk into this without warning.

Confirmed gaps and dates: - Europe's second network and information security directive: we searched the official gazette's consolidated national legislation on 18 August 2026. We found no Spanish law bringing it in. What binds today is Real Decreto-ley 12/2018 and Real Decreto 43/2021. When the new law lands it will expand the list of covered industries, add personal liability for managers, and change the reporting deadlines. Treat today's comfort as temporary. - No Spanish artificial intelligence governance act appears in the gazette either. The supervisory agency AESIA is up and running and coordinating with the privacy regulator as of July 2026. The EU AI Act's transparency duties started on 2 August 2026 anyway. - No law on protecting children in digital environments appears in the gazette as at 18 August 2026. If it passes, it is expected to move the fourteen-year consent age. - Data Act (EU) 2023/2854: cloud switching charges and data export fees must be zero from 12 January 2027. Powers the government can use today, with no new law: 1. Ley 11/2022 lets the government take over the direct running of electronic communications services or networks, for public and national security. This is meant to be exceptional and temporary. There is no notice and no consultation. 2. Real Decreto 1613/2011 lets the gambling regulator require an operator to place named secondary systems inside Spain. It is not used as a general rule today. If it were used, it would force data into Spain overnight. 3. Ley 11/2022 lets the state demand the encryption algorithms and methods an operator uses. 4. The four-category rule in Ley 40/2015 is built around public security and is expressly temporary, 'until progress is made within the European Union'. It could be widened by another decree-law with immediate effect, exactly as it was created. 5. At European level, the EU-US Data Privacy Framework is still valid. But on 31 July 2026 the European Data Protection Board formally asked the Commission to examine whether it should stand. Any Spanish setup that relies on it alone should have a backup plan.