The business fabric of León — industrial SMEs in El Bierzo, hospitality businesses along the Camino de Santiago, professional firms in the provincial capital — processes personal data of customers, employees and suppliers subject to Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 (LOPDGDD, Spain's national data protection act). Summum Consultoría guides companies and self-employed professionals in León through compliance with current regulations: gap assessment, documentation, training and ongoing review, with periodic on-site visits and full remote support.
León is home to one of the most active business ecosystems in north-western Castilla y León. SMEs in the agri-food sector — cecina de Vegacervera, botillo del Bierzo, wines with the Bierzo Denominación de Origen designation — hospitality and tourism businesses serving the French Route of the Camino de Santiago, the industrial cluster of the Polígono de Onzonilla and the healthcare centres that complement the Complejo Asistencial Universitario de León (CAULE, León University Care Complex) all share a common reality: they process personal data on a daily basis and are subject to the obligations of the GDPR and the LOPDGDD. Non-compliance can lead to fines of up to €20 million or 4% of total annual worldwide turnover under Article 83 of the GDPR.
GDPR compliance goes well beyond publishing a legal notice on a website. The data controller must draw up the Record of Processing Activities required by Article 30 of the GDPR, implement information clauses at every data-collection point, enter into data processing agreements with processors — accountancy firms, software providers, maintenance companies — ensure that data subjects can exercise their rights within statutory deadlines, and document the security measures adopted. The Agencia Española de Protección de Datos (AEPD, the Spanish Data Protection Authority) has full jurisdiction to investigate and sanction any organisation established in Spain, regardless of its size.
The Federación Leonesa de Empresarios (FELE, León Employers' Federation) and professional associations based in León have in recent years promoted awareness initiatives on data protection, in line with sector-specific guides published by the AEPD. Nevertheless, many SMEs in León still lack up-to-date privacy documentation or a designated person to handle data subject rights requests. Anyone can file a complaint directly with the AEPD, which makes compliance an operational necessity rather than a mere formal obligation.
Summum Consultoría supports companies and self-employed professionals in León throughout the entire process: initial gap assessment, design of the data protection system, drafting of legal documentation, staff training and periodic review. We travel regularly to the provincial capital and to the districts of El Bierzo, La Bañeza and Sahagún for on-site meetings, and provide full remote support for all other matters. We do not act as the AEPD nor do we guarantee the outcome of any enforcement proceeding, but we do ensure that the organisation has a coherent, documented system that accurately reflects how it processes personal data in practice.
We analyse all data processing activities carried out by the organisation: data categories, purposes, legal bases, retention periods and data flows involving third parties. The result is a data map that allows the most critical compliance actions to be prioritised and the most relevant risks for the specific organisation in León to be identified.
We draw up the Record of Processing Activities (Art. 30 GDPR), information clauses for customers, employees and suppliers in accordance with Articles 13 and 14 of the GDPR, data processing agreements under Article 28 and internal privacy and security policies tailored to the sector and size of the organisation.
We support the practical integration of procedures: clauses in web forms and paper contracts, a system for handling data subject rights requests, a security breach management protocol and staff training adapted to each employee's role and responsibilities.
Regulations evolve as the AEPD publishes new guides, the European Data Protection Board (EDPB) issues new decisions and the organisation's activities change. We carry out periodic reviews to keep the system up to date and are available for queries and incident support throughout the year.
The operational detail: what we deliver as part of the work and what we keep alive afterwards.
Record of Processing Activities
Drawing up and maintaining the inventory of processing activities required by Article 30 of the GDPR: purposes, legal bases, data categories, recipients, retention periods and security measures applied.
Information clauses and consents
Drafting of information notices for customers, employees and suppliers in accordance with Articles 13 and 14 of the GDPR, and design of consent-collection mechanisms where consent is the applicable legal basis.
Data processing agreements
Formalisation of Article 28 GDPR contracts with vendors that access personal data: accountancy firms, management software providers, cloud services, maintenance and cleaning companies, among others.
Data subject rights management
Implementation of a system for handling, within the statutory deadlines, requests for access, rectification, erasure, objection, restriction and portability (Arts. 15 to 22 GDPR), including response templates and a log of requests handled.
Security breach management protocol
Design and implementation of the procedure for detecting, assessing and notifying security incidents in accordance with Articles 33 and 34 of the GDPR, including the 72-hour notification deadline to the AEPD where applicable.
Team training and awareness
On-site or online training sessions tailored to the sector and staff level: GDPR obligations, best practices in personal data processing and identification of security incidents.
Data protection in León is best addressed with a comprehensive system: general GDPR compliance forms the foundation, on top of which specialised services — external DPO, breach management, CCTV/video surveillance — are delivered by Summum Consultoría in a coordinated manner for businesses in León.
Full GDPR and LOPDGDD compliance for organisations in any sector: record of processing activities, information clauses, data processing agreements and a documented privacy management system.
View service → consultoríaExternal Data Protection Officer (DPO): a mandatory role for certain organisations and the primary point of contact with the AEPD in the event of complaints or security incidents involving personal data.
View service → consultoríaGDPR security breach response protocol: risk assessment, notification to the AEPD within 72 hours and direct communication to data subjects when the risk is high.
View service →Yes. Regulation (EU) 2016/679 applies to any natural or legal person, public authority or private entity that processes personal data, regardless of its size or sector. A food shop, a guesthouse along the Camino de Santiago, an accountancy firm or a dental clinic in León is subject to the GDPR and the LOPDGDD from the moment it handles data of customers, employees or suppliers. The AEPD has full jurisdiction to investigate and sanction any organisation established in Spain.
The Record of Processing Activities (RAT, from the Spanish Registro de Actividades de Tratamiento) is the documented inventory of all data processing activities carried out by an organisation: purposes, legal bases, data categories, recipients and retention periods. Article 30 of the GDPR requires it to be kept up to date in writing. The exemption for organisations with fewer than 250 employees is limited and does not apply where special categories of data or high-risk processing activities are involved, which covers the majority of SMEs in León that handle health data, data relating to minors or employee monitoring.
Article 37 of the GDPR and Article 34 of the LOPDGDD set out the cases where appointment is mandatory: public authorities and bodies, organisations that process special categories of data on a large scale (health, biometric, trade union data) or that systematically monitor individuals on a large scale. In León, healthcare centres, schools, insurance companies and private security firms are common examples where a DPO is required. For other organisations, appointment is voluntary but strengthens a proactive accountability posture vis-à-vis the regulator.
Article 12 of the GDPR sets a general deadline of one month for responding to any request to exercise rights — access, rectification, erasure, objection, restriction, portability. The deadline may be extended by a further two months in complex cases, provided the data subject is informed within the first month. Failure to respond in time may lead to a direct complaint to the AEPD. The organisation must have a documented system that records the date of receipt of each request and the responses provided.