We act as outsourced Data Protection Officer (DPO) for private clinics and healthcare centres, professional advisory firms and law offices, insurers and schools across the province of León. We don't keep a permanent office in the León capital, but we travel there on a regular schedule for in-person meetings, staff training and audits, with coverage that also reaches El Bierzo, La Bañeza and Sahagún. Formal registration with the Spanish Data Protection Agency (AEPD), a breach channel answered in under 24 hours, and a DPO you can reach by phone, not a generic inbox.
In León, the obligation to appoint a DPO doesn't depend on being based in the capital or in a rural district: it is set by Article 37 GDPR and Article 34 LOPDGDD, and it mainly affects two types of organisation that handle significant volumes of sensitive data. The first is the private healthcare sector: dental clinics, medical centres, laboratories and practices that complement public healthcare handle health data every day, a special category under Article 9 GDPR that triggers the appointment obligation when its large-scale processing is part of the core activity (Article 37(1)(c) GDPR); in Spain, Article 34.1.l LOPDGDD additionally requires every health centre legally obliged to keep patient medical records to appoint a DPO, the only exception being health professionals practising individually. The second is the advisory firms and law offices in the capital and in El Bierzo, which manage their clients' tax, employment and third-party data and need, even when not strictly required by law, a formal point of contact before the AEPD that reassures their own clients.
Summum Consultoría has no physical office in León — unlike our offices in Burgos, Palencia and Las Palmas de Gran Canaria — but we deliver the service through scheduled, recurring visits to the León capital and to the districts with the highest concentration of clients: El Bierzo and Ponferrada, La Bañeza and Sahagún. These visits cover the initial diagnosis, the yearly staff training and any meeting the client would rather handle face to face; the rest of the service — day-to-day queries, review of the records of processing, handling the breach channel — is provided remotely with the same response times as from any of our physical offices.
The outsourced DPO service does not replace full GDPR adequacy when an organisation is starting from zero: for that, see our data protection service in León, which covers the records of processing, informative clauses and supplier agreements. The outsourced DPO is the layer added on top once the appointment is mandatory for the sector — healthcare, education, insurance, professional associations, local government — or when an organisation wants to strengthen its system with a point of contact formally registered with the AEPD, with duties set out in Articles 37 to 39 GDPR that we explain in detail in our guide to the functions of the DPO (in Spanish).
We use different templates and procedures depending on the sector: the protocol for a clinic handling medical records is not the same as for an advisory firm managing payroll and tax data, nor the same as for a state-subsidised school subject to the reinforced protection criteria for minors. This service is coordinated with our outsourced DPO in Valladolid and with the group's general GDPR compliance framework, so an organisation with centres across several provinces of Castilla y León receives consistent handling at all its sites.
We review your organisation's personal data processing and check whether appointing a DPO is mandatory under Article 37 GDPR and Article 34 LOPDGDD, paying particular attention to health data in the private healthcare sector and to client data managed by advisory firms.
We register the appointment on the Spanish Data Protection Agency's electronic office and notify the DPO's contact details as required by Article 37(7) GDPR, with a first in-person meeting in León, El Bierzo, La Bañeza or Sahagún as suits you.
A breach channel available in under 24 hours, handling of staff queries and periodic remote review of the records of processing, combined with regular in-person visits to the province for yearly training and audits.
One breach drill a year and a compliance review with a written record, so you reach any AEPD inspection with the work already done and documented.
The operational detail: what we deliver as part of the work and what we keep alive afterwards.
Appointment and notification to the AEPD
Formal registration as DPO before the Spanish Data Protection Agency within the ten-day deadline set by Article 34.3 LOPDGDD, and publication of the DPO's contact details as required by Article 37(7) GDPR.
Breach channel under 24h with direct support
A direct line, not a generic form: we respond in under 24 hours and assess whether notification to the AEPD is required within the 72-hour window of Article 33 GDPR.
Review of the records of processing
Maintenance of the Article 30 GDPR document, updated whenever the organisation introduces a new processing activity, with particular care for health data under Article 9.
Yearly training, in person and on schedule
A staff training session, tailored to the sector, delivered during a scheduled visit to León, El Bierzo or La Bañeza, or online for distributed teams.
Liaison with the AEPD
The DPO acts as the single point of contact with the Agency: responding to requests and supporting the organisation if an investigation is opened.
Handling data subjects' rights
Procedure and response templates for access, rectification, erasure, restriction, portability and objection within the timelines of Article 12 GDPR.
The outsourced DPO in León is one more piece of the data protection system Summum Consultoría offers to León-based businesses: it builds on base-level GDPR adequacy and, when the client needs it, coordinates with the equivalent service we provide in Valladolid and with the rest of the group's compliance silo.
Full GDPR and LOPDGDD adequacy for SMEs and sole traders in León: records of processing, informative clauses, processor agreements and training, with regular visits to the capital and the districts.
View service → consultoríaThe group's general GDPR and LOPDGDD compliance framework, with the full map of the data protection silo's services.
View service → consultoríaResponse protocol for personal data security incidents: risk assessment and notification to the AEPD within 72 hours where applicable.
View service →It depends on the sector, not the province: the obligation is set by Article 37 GDPR and Article 34 LOPDGDD (private healthcare, education, professional associations, insurers, local government, among others), regardless of where the organisation is registered. We check this during the free initial diagnosis.
We travel on a regular schedule to the León capital and to the districts of El Bierzo, La Bañeza and Sahagún for the initial diagnosis, staff training and yearly audits. The rest of the service — queries, review of the records of processing, breach channel — is handled remotely with the same response times as from any of our physical offices.
Yes. It's one of our main sector tracks in the province: we apply specific protocols for health data under Article 9 GDPR, including review of the records of processing and training for clinical and administrative staff.
Yes. Advisory firms and law offices managing their clients' tax and employment data are another sector we serve frequently, both in the capital and in El Bierzo, adapting the documentation to the volume and type of data they handle.
GDPR adequacy builds the full compliance system (records, policies, contracts); the outsourced DPO is the formal supervisory role before the AEPD. If your organisation doesn't yet have the system in place, we usually start with GDPR adequacy in León and add the DPO once the sector requires it.
Yes. Our reference office in Castilla y León is in Valladolid, where we also act as outsourced DPO in Valladolid. For organisations with centres in several provinces we apply the same appointment criteria and the same response times at all sites.
Inform and advise the organisation, monitor GDPR compliance, contribute to data protection impact assessments where required, cooperate with the AEPD as a point of contact, and coordinate the handling of security breaches, under Articles 38 and 39 GDPR. We cover this in detail in our guide to the functions of the DPO (in Spanish).
We don't publish a fixed rate because it depends on the organisation's size, the number of processing activities and any sector-specific requirements. We confirm it on the initial call or meeting. You can check the variables that move the price in our article on outsourced DPO pricing (in Spanish).