GDPR LOPDGDD

The difference between a company that complies with the GDPR and one that merely holds GDPR paperwork shows up the day a breach happens. The first has a procedure, a channel and a person; the second has a generic inbox and a folder untouched since the initial audit.

We work with the business as it actually operates: we map processing activities as they happen, not as written in the template that came with the management software, and we build the system on that reality. What we deliver is a framework that evolves with the company: documents that change when processes change, periodic training, breach drills and continuous review — not a PDF signed once and forgotten.

When an AEPD inspection arrives, or a large client asks for a supplier audit, the work is already done. And when a security breach happens — because sooner or later it does — you know exactly who to call and in what order to act.

The General Data Protection Regulation (EU) 2016/679 has applied directly across the European Union since 25 May 2018 and covers any organisation, public or private, that processes personal data of individuals, regardless of its size or turnover. There is no threshold of staff or revenue that exempts an organisation from compliance: a freelancer with three clients and a multinational are subject to the same text, even though the scale of their obligations — and the real risk — differs greatly.

Spain's Organic Law 3/2018 on Data Protection and Digital Rights Guarantee (LOPDGDD) develops the GDPR within Spanish law: it sets out the cases where a mandatory DPO must be appointed (art. 34), regulates video surveillance (art. 22), marketing opt-out systems, the data of deceased persons, and digital rights in the workplace, and establishes the national penalty regime (arts. 70–78) aligned with the tiers of Article 83 GDPR. The Spanish Data Protection Agency (AEPD) is the competent supervisory authority in Spain and the body that resolves complaints, opens sanctioning procedures, and publishes the sector's reference guidance.

For an SME, complying with the GDPR and the LOPDGDD means, in practice, five things: knowing what personal data it processes and on what legal basis (art. 6), documenting it in a record of processing activities (art. 30), correctly informing individuals (arts. 13–14), keeping a handle on contracts with suppliers that access that data (art. 28), and being ready to respond to both a rights request and a security breach within the legal deadlines.

The GDPR is not solved with a single page or a single document: it is a management system made of specialised pieces that combine depending on the risk and sector of each organisation. This page is the starting point — the map of obligations — and from here we connect to the services that cover each specific front: the outsourced DPO when the appointment is mandatory or strengthens the system, security breach management, bringing video surveillance in line with Article 22 of the LOPDGDD, the procedure for handling data subjects' rights, and the sector variants for healthcare, education and local government.

Not every organisation needs the same pieces of the silo: a five-person consultancy will likely resolve its compliance with base-level adequacy plus a breach channel; a clinic or a school will almost certainly also need an outsourced DPO registered with the AEPD; and a town council or a company installing cameras on its premises adds the video surveillance piece. The initial diagnosis determines which combination applies to your specific case, without selling services that don't fit.

The penalty regime of Article 83 GDPR sets two tiers: up to €10 million or 2% of worldwide annual turnover for less serious infringements (incomplete records of processing, missing processor agreements, failure to appoint a DPO when mandatory), and up to €20 million or 4% of worldwide turnover for more serious ones (absence of a legal basis, breach of processing principles, systematic failure to honour rights). The LOPDGDD, in Articles 72 to 74, transposes these tiers into Spanish law and adds limitation periods depending on the severity of the infringement.

The AEPD does not only act on its own initiative: most sanctioning procedures are opened after a complaint from an individual or the notification of a poorly managed security breach. Having the system documented and operational before an incident happens is, in practice, the difference between a penalty and a dismissed file.