Companies and entities in Palencia are subject to Regulation (EU) 2016/679 — the GDPR — and to Organic Law 3/2018 — the LOPDGDD (Spanish Data Protection Act) — regardless of their size or sector. At Summum Consultoría we support Palencia's business community in achieving regulatory compliance, implementing technical and organisational measures, and managing privacy on an ongoing basis, both on-site and remotely.
Palencia combines a significant industrial hub — the Renault plant and its network of auxiliary suppliers — with a dense SME landscape spanning services, retail and hospitality in the city and across the province. This diverse business fabric shares a common obligation: GDPR compliance. Any entity that processes personal data of natural persons — customers, employees, patients, students — is subject to the regulation, with no exemption based on size or sector. The Diputación Provincial de Palencia (Provincial Council) and the City Council are additionally required by law to designate a Data Protection Officer, in accordance with art. 37 of the GDPR and art. 34 of the LOPDGDD.
Genuine compliance goes beyond a privacy notice on a website. It requires drawing up the record of processing activities established by art. 30 of the GDPR, identifying the legal basis for each processing activity, formalising contracts with data processors under art. 28, establishing channels to handle data subject rights — access, rectification, erasure, portability, restriction and objection, governed by arts. 15 to 22 of the GDPR — and adopting security measures proportionate to the risk. Breach of these obligations is subject to the sanctions regime under art. 83 of the GDPR: fines of up to €10 million or 2% of total global turnover, and up to €20 million or 4% for the most serious infringements.
At Summum Consultoría we have been supporting organisations across Castilla y León since 2007. In Palencia we work both on-site and remotely, adapting to the pace and resources of each client: from the small retailer or dental practice that needs to bring its documentation in order, to the industrial company managing multiple employee data processing activities and external processors. The starting point is always a genuine assessment of the actual situation — not a generic report — to serve as a roadmap for effective, documented compliance before the AEPD (Spanish Data Protection Agency).
We analyse what personal data the organisation processes, for what purposes, on what legal bases and with what security measures. The outcome is a gap report — identifying shortfalls against the GDPR and the LOPDGDD — that serves as a roadmap for compliance.
We draft or review the record of processing activities (art. 30 GDPR), privacy notices, information clauses for employees, data processor agreements (art. 28 GDPR) and the security policy. We recommend technical measures proportionate to the risk of each processing activity.
Where the organisation is required to designate a Data Protection Officer — or chooses to do so voluntarily — we take on the role as external DPO, registered with the AEPD and genuinely available. We manage the data subject rights request channel and coordinate responses to regulator enquiries or investigations.
We train staff on the basic data protection obligations relevant to their role, and periodically review documentation to reflect regulatory changes, new processing activities or organisational changes. GDPR compliance is a living system, not a one-off project.
The operational detail: what we deliver as part of the work and what we keep alive afterwards.
Record of processing activities
Inventory of processing activities required by art. 30 of the GDPR, covering purposes, legal bases, data categories, recipients and retention periods for each activity carried out by the Palencia-based organisation.
External DPO for Palencia
External Data Protection Officer registered with the AEPD and genuinely available. Mandatory for entities covered by art. 37 of the GDPR and advisable for any organisation carrying out large-scale or sensitive data processing.
Data processor agreements
Review and drafting of contracts or clauses with suppliers that access personal data — IT providers, accountants, cleaning or security services — in accordance with the requirements of art. 28 of the GDPR.
Data subject rights handling
Design of the internal procedure to receive, process and resolve within the statutory deadline requests for access, rectification, erasure, portability, restriction and objection, in accordance with arts. 15 to 22 of the GDPR.
Privacy notices and information clauses
Drafting or updating of website notices, form clauses and employment contracts, in line with the information requirements of arts. 13 and 14 of the GDPR and the guidelines of the European Data Protection Board (EDPB).
Staff training
Sessions tailored to the sector and team level: what personal data is, when it may be processed, how to handle a rights request and what to do in the event of a security incident involving personal data.
Data protection in Palencia is part of the broader GDPR compliance system, which connects the role of the Data Protection Officer, the management of data subject rights and the response to security breaches. Summum Consultoría addresses these services in an integrated way.
Full GDPR compliance for any type of organisation: the comprehensive compliance framework that underpins all data protection activity in Palencia and throughout Castilla y León.
View service → consultoríaExternal Data Protection Officer registered with the AEPD and genuinely available: privacy system oversight, regulatory liaison and incident management when they arise.
View service → consultoríaProcedure to handle and resolve within the statutory deadline data subject rights requests from customers and employees: one of the most operational aspects of day-to-day GDPR compliance in any organisation.
View service →Yes. The GDPR sets no minimum size or turnover threshold: any company, self-employed professional or entity that processes personal data of natural persons is obliged to comply. Art. 30.5 of the GDPR provides a limited exemption from the record of processing activities for organisations with fewer than 250 employees where processing is not carried out on a regular basis or does not involve special categories of data, but that exemption does not remove the remaining obligations.
The sectors with the highest exposure are those that process special categories of data or large volumes of personal data. In Palencia these include the healthcare sector — clinics, pharmacies —, industrial companies using video surveillance or employee access control systems, professional firms — tax advisers, accountants, lawyers — and educational centres. Engaging suppliers who access data — IT providers, payroll, ancillary services — also creates data processor agreement obligations under art. 28 of the GDPR.
Designation is mandatory in the cases set out in art. 37 of the GDPR: public authorities and bodies, entities that carry out large-scale processing of special categories of data, or entities that carry out systematic monitoring of individuals. Art. 34 of the LOPDGDD extends these cases in Spain to include healthcare centres, schools and financial institutions, among others. Outside the mandatory cases, voluntary designation is advisable for organisations with data-intensive processing activities.
The most common are failure to comply with the duty to inform (arts. 13 and 14 GDPR), processing without a legal basis, absence of data processor agreements and insufficient security measures. Art. 83 of the GDPR establishes two tiers of sanctions: up to €10 million or 2% of total global annual turnover, and up to €20 million or 4% for the most serious infringements. The AEPD treats the existence of prior compliance measures as a mitigating factor.
Summum Consultoría provides services throughout Castilla y León with both on-site and remote attendance. For clients in Palencia city and province we combine on-site visits — for the assessment and training phases — with remote work during documentary and maintenance phases. We have been supporting organisations in the region since 2007, which gives us a deep understanding of Palencia's business fabric and allows us to tailor solutions to each client's reality without generic off-the-shelf proposals.