Spain. Comprehensive data protection. Act
LOPDGDDOrganic Law 3/2018 of 5 December on Personal Data Protection and Guarantee of Digital Rights (LOPDGDD)
§1Summary
- Synopsis
The LOPDGDD adapts the GDPR in Spain and adds a catalogue of 'digital rights', including the right to disconnect and rules on workplace monitoring. The AEPD is very active on fines.
- Key themes
- Unique features
Age of digital consent (GDPR Art 8): 14. Title X digital rights (disconnect, workplace device/video/geolocation monitoring, digital testament); mandatory DPO for listed sectors (Art 34); data blocking obligation (Art 32); no fines on public administrations.
- SaaS relevance
Applies alongside the GDPR to any SaaS provider established in, or targeting users in, this country; national rules on age of consent, employee data and offences shape onboarding and HR-related features.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Authority 72h; individuals without undue delay (GDPR Arts 33-34)
- DPO
- Yes
- Cross-border transfers
- GDPR Chapter V (adequacy/SCCs/BCRs)
- Maximum penalty
- GDPR Art 83: €20m or 4% global turnover; no fines on public administrations
§3Dates
- Key dates
- Adopted
- In force
- BOE-A-2018-16673
§4Text and authority
- Text
- Authoritative text boe.es
- English text aepd.es
- Authority
- Agencia Española de Protección de Datos (AEPD); regional authorities in Catalonia and Basque Country
§5Where it applies
- Domestic law of
- Spain
§6Sources and verification
- Sources consulted
- Verification
High confidence.
Draft Organic Law on protection of minors in digital environments (raising age to 16) still in Congress as of mid-2026. Spain had not transposed NIS2 by Oct 2026.