The briefing .

DPO Certification (AEPD-ENAC Scheme): What It Is and What It Guarantees

The AEPD's DPO Certification Scheme, with bodies accredited by ENAC, is a serious but voluntary credential: Article 37.5 of the GDPR requires qualification, not a certificate. This guide explains what it actually certifies, how the accreditation works, and what should really matter when choosing an external DPO.

How to Choose an External DPO Provider: 10 Criteria Before You Sign

Choosing an external DPO should not come down to comparing quotes. This guide gives ten objective criteria —conflict of interest, qualification, sector specialisation, proximity, contractual deliverables, 72-hour breach response and price transparency— to filter any proposal before signing, without naming competitors.

How to Notify a DPO to the AEPD: A Step-by-Step Communication Guide

Appointing a DPO does not end with signing the designation letter: Article 37.7 of the GDPR requires notifying the AEPD and publishing the DPO's contact details. This guide explains the step-by-step procedure on the Electronic Office, the deadlines, the most common mistakes and what you risk by delaying.

Record of Processing Activities (RAT): who must keep one and how to do it

Many SMEs believe they are exempt from keeping a Record of Processing Activities because they have fewer than 250 employees. Article 30.5 of the GDPR says otherwise: the exemption only protects a handful of very specific cases. This guide debunks the myth and explains, field by field, how to build a RAT as controller and as processor.

Fines for Not Having a DPO: What You Risk Under the GDPR and Spain's LOPDGDD

Not having a DPO when the law requires one is not an administrative oversight: it is a codified infringement that the AEPD can sanction under Article 83.4 of the GDPR, and one that Spain's LOPDGDD grades within its own penalty regime. This guide explains exactly what is being sanctioned, at what amounts, when it lapses, and how to avoid it.

GDPR in human resources: what employee data your company may process

The GDPR and the LOPDGDD (Spain’s Organic Law on Personal Data Protection and Digital Rights Guarantee) establish a specific framework for processing employee data that goes far beyond payroll: legal bases, digital rights at work, working-time records and special categories of data are the pillars every company must understand in order to comply with the regulations.

Candidate Data in Recruitment Processes: What the GDPR Requires

Whenever a company receives a CV, runs a recruitment process or views a candidate's LinkedIn profile, it is processing personal data subject to the GDPR; understanding the specific obligations—legal basis, retention period, required information and social-media limits—is essential to avoid infringements.

Time tracking and GDPR: how to record working hours without breaching data protection

Article 34.9 of the Workers' Statute requires companies to record the daily working hours of each employee, but that record generates personal data that must be processed in compliance with the GDPR: minimisation, legal basis, biometrics as a special category and retention periods.

Fleet and Company Vehicle Geolocation: GDPR Limits

Installing a GPS system in company vehicles involves processing employees' personal data: article 90 of the LOPDGDD (Organic Law on Data Protection and Guarantee of Digital Rights) sets the rules, and the AEPD (Spanish Data Protection Authority) has declared unlawful those processing operations that failed to provide prior information or that tracked employees outside working hours.

Derechos digitales en el trabajo: que obliga el articulo 88 de la LOPDGDD

How to respond to a data access request (GDPR right of access)

The right of access allows any individual to find out what personal data your company holds about them, for what purpose and for how long; knowing how to respond correctly within the legal deadline can make the difference between compliance and a penalty.

Right to Erasure and Right to Be Forgotten in Spain: How to Apply Them

Article 17 of the GDPR grants every individual the right to have their personal data erased without undue delay, but that does not mean every request must be honoured: there are significant exceptions when the organisation has a legal obligation to retain the information.

Time limit for responding to a data subject rights request: the one-month rule under Article 12 GDPR

When a data subject requests access to, rectification of, or erasure of their personal data, the controller has one month to respond; failure to do so opens the door to a complaint before the AEPD (Agencia Española de Protección de Datos, Spain's data protection authority).

ARSULIPO Rights: what they are and how to manage them in your organisation

The General Data Protection Regulation expanded citizens' rights beyond the old ARCO framework: we now speak of ARSULIPO — six rights of the acronym, together with additional GDPR rights, each with specific deadlines, conditions and obligations for any organisation that processes personal data.

Consent vs. legitimate interest: the six lawful bases under Article 6 GDPR

Choosing the wrong lawful basis for a data processing activity is not a minor mistake: it invalidates the processing, exposes the organisation to penalties, and forces a restart from scratch. This article explains when each of the six bases under Article 6(1) GDPR applies and how to document the decision correctly.

AEPD Fines: How GDPR Infringements Are Graded

The GDPR's penalty regime sets two fine tiers that can reach €20 million or 4 % of global annual turnover, but the final amount depends on up to eleven grading criteria that the AEPD weighs in each case.

Data retention periods by processing type: a regulatory guide for businesses

The storage limitation principle of article 5.1.e of the GDPR prohibits retaining data longer than necessary, but determining that limit requires cross-referencing data protection law with the sector-specific legislation that applies to each processing activity.

What to Do During an AEPD Inspection: A Step-by-Step Companion Guide

Receiving a communication from the AEPD (Spain's Data Protection Agency) triggers a process with strict deadlines and significant legal consequences. Understanding the phases, knowing your rights, and having the right documentation ready makes the difference between responding with authority or being caught at a disadvantage.

International data transfers: Standard Contractual Clauses (SCC) after Schrems II

Every time a Spanish company sends data to a cloud service provider based in the United States, it transfers personal data outside the EEA — an act governed by Chapter V of the GDPR that requires a lawful transfer mechanism before the data crosses the border.

AI and GDPR: chatbots and automated processing in your company

The use of chatbots and artificial intelligence systems in business raises specific data protection obligations: legal basis, user information, the right not to be subject to automated decisions, and simultaneous compliance with the GDPR and the AI Act.

Video surveillance in homeowners' associations: what the AEPD allows

Installing cameras in the common areas of a homeowners' association requires compliance with the GDPR, the LOPDGDD and the Spanish Horizontal Property Act: from the general meeting resolution to the information notice, the maximum thirty-day retention period and strict control of access to recordings.

Video surveillance zone: sign requirements and information according to the AEPD

If you install cameras on your business premises, regulations require you to display a video surveillance zone sign with precise information about the data controller, the purpose of processing and the rights of data subjects; we explain exactly what it must contain and where to place it.

The 72-hour deadline for a data breach: when does the clock start? (art. 33 GDPR)

The 72-hour clock does not start when the security breach occurs, but when the data controller becomes aware of it. This article explains in detail how that deadline is calculated, what role the preliminary internal investigation plays, when the justified delay under Article 33(1) applies and when to use phased notification under Article 33(4) GDPR.

When to Notify Individuals of a Data Breach (Art. 34 GDPR)

Notifying the AEPD (Spanish Data Protection Authority) within 72 hours is only one part of the legal duty: when the incident poses a high risk to individuals' rights, art. 34 of the GDPR also requires direct communication to the people affected.

Security incident management protocol for companies

Knowing what to do in the first hours after detecting a security incident makes the difference between an orderly response and a crisis that spirals out of control: we walk you through the phases of a real protocol, from detection to lessons learned.

Retention period for CCTV recordings: what the law requires

The law limits to one month the time that images captured by security cameras may be kept, but there are incident-blocking scenarios and exceptions that every business must know before configuring its CCTV system.

Encargado vs. responsable del tratamiento: diferencias y contrato (art. 28)

Privacy by Design and by Default: Article 25 of the GDPR

Article 25 of the GDPR (Regulation (EU) 2016/679) obliges organisations to embed data protection from the very first blueprint of any system — not as an afterthought. This is how privacy by design and by default works in business practice.

Right to data portability and right to object: how to apply them in your organisation

The right to data portability and the right to object are two of the GDPR instruments that generate the most uncertainty in organisations: when they apply, how to process them, and what distinguishes portability from the right of access.

What is the GDPR and who does it apply to? A clear guide for Spanish businesses

Does your business process data from customers, employees or suppliers? The GDPR applies from the very first data point. We explain what it is, who it covers and what non-compliance means.

LOPD, LOPDGDD and GDPR: what each law means and which one applies to your company

Many businesses still talk about 'the LOPD' when they have actually been bound by the GDPR for years. Understanding the difference is not a technicality — it determines your obligations, your supervisory authority and the fines you face.

How to bring your company into GDPR compliance step by step: a practical guide for SMEs

Most SMEs know the GDPR exists, but few are clear about which specific measures they must implement and in what order. This guide structures the compliance process into manageable phases, without unnecessary jargon.

How to Report a Data Breach to the Spanish DPA within 72 Hours

When a security breach occurs, the clock starts from the moment you become aware of the incident. The General Data Protection Regulation sets a 72-hour deadline to notify the Spanish Data Protection Agency (AEPD), and not every organisation knows what steps to take or in what order.

What is a personal data breach: types, examples and GDPR obligations

Losing a laptop with client files, suffering a ransomware attack or sending an email to the wrong recipient are all data breaches that the GDPR requires you to manage within strict deadlines. Many SMEs do not know what to do in the first few hours.

GDPR-compliant CCTV notice: what it must include

Installing cameras without an adequate information notice is one of the most common CCTV infringements sanctioned by Spain's data protection authority, the AEPD. We explain what the notice must include, where to place it, how long images may be retained, and the key differences between cameras in public-facing areas and in the workplace.

CCTV cameras in the workplace: what Article 89 LOPDGDD requires

Installing cameras on business premises without complying with Article 89 LOPDGDD and the GDPR exposes the company to fines of up to EUR 20 million or 4% of global annual turnover. Here we explain what the law requires and how to comply.

AEPD Cookie Guide: how to have a compliant banner in 2025

The AEPD Cookie Guide sets precise rules on banners, reject buttons and consent records. Non-compliance can result in fines of up to 2 % of global annual turnover. Here is exactly what you must do.

Functions of the Data Protection Officer (DPO): a complete guide

The Data Protection Officer (DPO) is not a paperwork exercise: the regulation gives this figure genuine independence and clearly defined responsibilities. This guide explains what a DPO does, what they cannot do, and when their designation is mandatory under the GDPR and the Spanish LOPDGDD.

External DPO pricing: variables and indicative range in 2026

The cost of an external DPO in Spain ranges from €80 to €600 per month depending on sector, data volume and service intensity. We break down the real variables and what your contract must include.

Internal vs. external DPO: which should you choose and why?

The GDPR allows you to appoint a Data Protection Officer from within your own staff or through an external professional. The choice is not purely financial: it affects independence, specialisation and accountability before the supervisory authority.

Transparency advisory for SMEs in Valladolid: how to comply without bureaucracy

The Transparency Act does not only apply to public bodies: many SMEs that work with public funds or provide services to certain private entities need to demonstrate transparency policies. Here we explain what the law requires and how to address it efficiently.

Public Procurement in Castilla y León: How Service Companies Win Regional Contracts

Everything a service company needs to know to bid on regional public contracts in Castilla y León: requirements, platforms and keys to scoring well.

Legal audit of an online store for SMEs: what it covers and when to do it

A legal audit of your online store detects gaps in LSSI, GDPR, terms of sale and cookies before the AEPD or a dissatisfied customer does.

Advisor fees in a company sale: fixed and success fee structure explained

A practical guide to M&A advisor fee structures: monthly retainer, success fee, and the factors that determine how much it costs to sell an SME.

CE Marking for Industrial Machinery: Deadlines, Approximate Cost and Process for SME Manufacturers

Everything an SME manufacturer needs to know about CE marking for machinery: current regulations, real deadlines, approximate cost and how to avoid the most common mistakes.

Digital Operational Resilience under DORA: a practical roadmap for financial entities

DORA has been mandatory since January 2025. Here is the roadmap with phases, priorities and the traps that most delay institutions that start late.

AML/CFT Consultancy in Valladolid: What the Service Includes and How It Is Priced

A practical guide to what an AML/CFT consultancy includes, which businesses are subject to obligations, and how the budget is structured according to company size and sector.

Pay equity audit step by step: how to detect and correct the gender pay gap in your company

Complete methodology to carry out the mandatory pay equity audit, interpret the results and correct the gender pay gap without mistakes.

Digital working time records in Spain: when will it be mandatory and what technical requirements will it demand?

The new digital working time recording regulation tightens the technical requirements for the system: here are the deadlines, requirements, and what your company must do now.

How much does GDPR compliance cost for a Spanish SME in 2026?

A guide with indicative market prices for GDPR compliance in a Spanish SME: from the initial gap analysis to ongoing annual maintenance.

External DPO for private medical clinics: when is it mandatory and how much does it cost in 2026

The GDPR and Spain's LOPDGDD make a mandatory DPO compulsory for almost every private clinic that processes health data: here are the exact criteria, real fines, and market price ranges for the external service.

Industrial SMEs and R&D: how to access grants without an in-house research department

Without a laboratory or researchers on the payroll, many industrial SMEs let tens of thousands of euros in R&D grants slip by every year — grants they are fully entitled to.

Is my AI system high-risk under the AI Act? A practical classification guide

The AI Act is already in force: we explain how to determine whether your AI system is high-risk, which categories Annex III covers and what you must do if it applies.

CSRD and SME suppliers: why it affects you even if you're not listed on the stock exchange

If you manufacture, distribute, or provide services to a large company, CSRD is already knocking at your door: we explain what ESG information they will request and how to get ahead of it.

External DPO for dental clinics: GDPR obligations and how to comply

Dentists process special-category data every day: clinical records, X-rays, diagnoses. The GDPR requires the appointment of a Data Protection Officer, and the AEPD has already fined practices that ignored this obligation.

External DPO for state-funded private schools: children's data and GDPR

State-funded private schools process children's data at scale and are required by law to appoint a DPO: here is what that means in practice.

Data protection in hospitality: GDPR for bars, hotels and restaurants

CCTV cameras, online bookings, loyalty cards and guest Wi-Fi: the hospitality sector collects far more personal data than it realises, and the AEPD knows it.

Compliance checklist for SMEs: what obligations you have in 2026

A complete map of the compliance obligations affecting your SME in 2026: from criminal liability programmes to the NIS2 directive, with application criteria by size and sector.

R&D Tax Deduction: How to Apply It Without Risk

The R&D tax deduction can return up to 42% of research and innovation expenditure, but applying it without adequate documentary support turns the saving into a fiscal risk.

Registering a Trademark in Spain: Steps, Timelines and Costs

Everything you need to know to register your trademark in Spain: the procedure with the OEPM, current fees, the opposition period and when it makes sense to move to an EU trade mark.

How to bid for public contracts as an SME

Public procurement is a real opportunity for SMEs, but the process can be daunting. We explain how it works, what the law requires and how to prepare a winning bid.

Data protection in clinics: GDPR guide for the healthcare sector

Health data is the most protected category under the GDPR. Discover the specific obligations your clinic must meet, what fines you risk and how to get compliant.

GDPR in schools: children's data and obligations of educational centres

Educational centres process particularly sensitive data about minors: academic performance, health, images. Find out what the GDPR requires and how to comply without errors.

Working time records 2026: what the law requires and how to comply

Digital time tracking is now mandatory for all companies. We analyse what the law requires in 2026, which systems are valid and what the penalties for non-compliance are.

Transparency Law: which entities are obliged and what must they publish

Law 19/2013 goes beyond public administrations: political parties, trade unions and private entities receiving grants are also obliged. We explain who, what and how.

CE Marking: how to declare product conformity

CE marking is not a quality seal: it is a legal requirement to place certain products on the European Economic Area market, and getting it wrong can lead to market withdrawal and penalties.

Corporate governance in SMEs: boards, minutes and good governance

Corporate governance is not just for large listed companies: SMEs that properly structure their governing bodies, minutes and good-governance policies gain better access to financing, close better deals and reduce their legal exposure.

Mandatory whistleblowing channel: is my company required by Law 2/2023?

Law 2/2023 requires all companies with 50 or more employees to have an operative whistleblowing channel. Since September 2025, the AIPI can already issue sanctions. Are you covered?

Entities subject to AML/CFT obligations: is your business on the list?

Law 10/2010 imposes very specific obligations on dozens of sectors. Do you know whether your business is on the list and what you must have in place?

Mandatory Equality Plan: which companies must have one, deadlines and registration?

From 50 employees onwards it is mandatory. We explain which companies must have an equality plan, what it must include and how to register it correctly.

EU AI Act 2026: obligations for businesses step by step

The AI Act already has active obligations: we explain what applies to your business, which deadlines are real after the Digital Omnibus, and where to start.

NIS2 in Spain: who it applies to and transposition deadlines — Summum Consultoria

The NIS2 Directive extends cybersecurity obligations to 18 sectors and more than 100,000 entities across Europe: find out whether your company is included.

Legal requirements for an online store: LSSI and GDPR checklist — Summum Consultoria

Launching an online store without complying with the LSSI, the GDPR and consumer regulations can cost you from €3,000 to €600,000 in fines. Here is the complete map.

External DPO: when is it mandatory and what does it cost in 2026 — Summum Consultoría

The GDPR makes the DPO mandatory in three specific cases, but the AEPD recommends voluntary appointment in many more. We explain when it is obligatory, when it is advisable, and what market price ranges look like.

DPIA: when to carry out a Data Protection Impact Assessment — Summum Consultoría

A DPIA is mandatory when a data processing activity is likely to result in a high risk to individuals. This guide explains when that obligation is triggered and how to address it correctly.

Sustainability: Carbon-Neutral Transition for Businesses

Carbon footprint, renewable energy and circular economy.

Compliance: regulatory and internal corporate compliance

Regulation, robust policies and periodic internal audit.

Lean Manufacturing: Systematic Waste Elimination

5S tools, kanban, added value and efficiency.

Outsourcing: When and How to Outsource Services

Supplier evaluation and strategic outsourcing management.

M&A: fusiones y adquisiciones, due diligence integral

Financial, legal and operational analysis in complex transactions.

CSR and Sustainability: Measurable Corporate Social Impact

SDGs, sustainability reports and international certifications.

Project Methodology: Agile and Waterfall integrated

Project management frameworks, modern tools and phases.

Innovation Management: Systematic Management of Ideas

Open innovation methodology and agile prototyping.

Customer Service: retention and loyalty strategies that deliver

SLA, NPS and strategic VIP customer programmes.

Sales: pipeline management and effective prospecting

Sales funnel, strategic CRM and opportunity closing.

Marketing: strategic brand positioning and differentiation

Unique value proposition, segmentation and market differentiation.

Information systems: ERP and advanced business intelligence

Selection, implementation and operation of IT management systems.

Negotiation: better margins and commercial relationships

Effective negotiation techniques and lasting commercial agreements.

Expansion: Strategy for International Markets

Feasibility analysis, market entry and localisation in new markets.

Risk Management: Contingency Plans and Resilience

Identification, assessment and mitigation of business risks.

Internal and External Communication: An Integrated Strategy

Effective channels, messages and a positive corporate reputation.

Human Resources: Role Structure and Key Competencies

Functional org chart, professional profiles and career development.

Corporate Finance: Budgeting and Management Control

Financial analysis, cash flow and return on investment.

Company Culture: Building Corporate Values

Corporate purpose and strategic alignment of teams.

Annual Strategic Planning: A Practical, Effective Guide

Objective setting, KPIs and systematic monitoring.

Leadership: Building High-Performance Teams

Leadership styles and group dynamics for maximum productivity.

Change Management: Effective Leadership in Transitions

Communication, resistance management and adoption of organisational change.

Business Process Optimisation: Advanced BPM Methodology

Process redesign to improve operational efficiency and reduce costs.

Competitive Analysis: Strategic Tools and Methods

SWOT matrix, Porter's model and direct competitive analysis in target markets.

Digital Transformation Strategy: a Business Roadmap

Steps to digitalise processes without losing operational efficiency.