From our office at Fray Luis de León 3, in the heart of Valladolid, we guide SMEs, professional practices and organisations across Castilla y León through compliance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and the LOPDGDD (Organic Law 3/2018 on Data Protection). In-person or remote support, with no generic templates: every project starts from the concrete reality of your organisation.
The business landscape of Valladolid is varied and dynamic: industrial and agri-food SMEs, law firms and tax advisory offices, clinics and health practices, homeowners' associations, real-estate agencies, educational centres and local retailers. All these organisations, regardless of their size or sector, process personal data belonging to customers, employees or suppliers and are subject to the General Data Protection Regulation and Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights. The AEPD (Agencia Española de Protección de Datos — Spanish Data Protection Agency) supervises compliance throughout the national territory and may open investigative proceedings against any entity that has not implemented the technical and organisational measures required by law.
Summum Consultoría has a physical office at Fray Luis de León 3, 2B, 47002 Valladolid, which allows us to provide in-person support to our clients in Valladolid while also working remotely with organisations across the province and throughout Castilla y León. We have spent more than fifteen years guiding SMEs and regional organisations through GDPR compliance processes, and we have first-hand knowledge of both the regional regulatory environment and the economic sectors most prominent in the city: the automotive supply industry, agri-food, services and local retail.
Our starting point is always an honest assessment of the organisation's real situation: what personal data is processed, for what purposes, which third parties — data processors — have access to it, and what technical and organisational measures are already in place. From that assessment we design a compliance plan proportionate to the size and risk of the organisation, develop the mandatory documentation: records of processing activities, information notices, privacy policy, data processing agreements and procedures for handling data subject rights requests; and train the team members who handle personal data in their day-to-day work. We do not stand in for the AEPD or guarantee the outcome of any enforcement proceedings, but we do ensure that the organisation acts in an orderly manner and with the documentation that the regulator expects to find.
We frequently work with advisory firms and professional practices, clinics and health centres, real-estate agencies and property managers, educational and training centres, hospitality businesses and homeowners' associations across the province. We also work with bodies linked to the Junta de Castilla y León and the Diputación Provincial de Valladolid, which as data controllers are subject to the GDPR with the same rigour as the private sector. When the organisation requires it (or when the law makes it mandatory), we also provide an external Data Protection Officer (DPO) service, acting as the point of contact with the AEPD and continuously overseeing the data protection management system.
We analyse all personal data processing activities carried out by the organisation: purposes, legal bases, data categories, internal and external data flows, existing security measures and compliance gaps with respect to the GDPR and the LOPDGDD. The output is a clear situation report that serves as the starting point for the compliance plan.
We design the records of processing activities, the information notices and privacy policy, data processing agreements with external suppliers, and procedures for handling data subject rights requests (access, rectification, erasure, objection, portability and restriction). All documentation is tailored to the sector and to the reality of the organisation.
We train the team members who process personal data: what they may and may not do, how to detect and manage a security breach, and how to handle a rights exercise request. Training can be delivered in person at the organisation's premises in Valladolid or in an online format, and is documented as evidence of compliance.
The GDPR is not a one-off exercise but a living management system: we incorporate regulatory or operational changes, review data processing agreements when suppliers change, update the records of processing activities and remain available to assist with any incident or query. If a security breach occurs, we support the organisation through the risk assessment and, where applicable, the notification to the AEPD within the 72-hour deadline set out in art. 33 GDPR.
The operational detail: what we deliver as part of the work and what we keep alive afterwards.
Records of processing activities
The central document of the data protection system, required by art. 30 GDPR: it sets out all personal data processing activities, their purposes, legal bases, retention periods and security measures applied.
Information notices and privacy policy
Drafting of the legal texts that fulfil the duty to inform under arts. 13 and 14 GDPR: data collection forms, privacy notices on the website, clauses in contracts and communications with customers and employees.
Data processing agreements
Review and drafting of agreements with suppliers that access personal data (art. 28 GDPR): software companies, accounting firms, cloud services, IT maintenance providers and any other external data processor.
External DPO (Data Protection Officer)
Appointment and performance of the Data Protection Officer functions provided for in art. 37 GDPR: system supervision, liaison with the AEPD, internal advisory support and responding to staff queries.
Team training and awareness
Training sessions tailored to the sector and to each employee's role, with attendance records as evidence of compliance before the AEPD. Available in person in Valladolid or in an online format.
Handling data subject rights requests
Design of the internal procedure for managing access, rectification, erasure, objection, portability and restriction requests within the deadlines set out in art. 12 GDPR, with response templates and a log of requests handled.
Data protection in Valladolid is the core of a broader compliance system that includes the external Data Protection Officer, security breach management and sector-specific treatment, tools that Summum Consultoría offers in an integrated manner from its office in the Castilian capital.
Full GDPR compliance for any type of organisation: records of processing activities, legal bases, data processing agreements, information notices and a privacy management system built from scratch or reviewed from an existing one.
View service → consultoríaExternal Data Protection Officer service for organisations that require it by law or wish to strengthen their privacy system: continuous supervision and direct liaison with the AEPD from Valladolid.
View service → consultoríaIncident response protocol for personal data security breaches: risk assessment, notification to the AEPD within 72 hours (art. 33 GDPR) and communication to affected individuals when the risk is high.
View service →Yes. The GDPR applies to any organisation — public or private, large or small — that processes personal data of natural persons in the European Union, regardless of its size or sector. This includes self-employed individuals, micro-businesses, homeowners' associations, associations and non-profit organisations. The LOPDGDD (LO 3/2018) transposes the GDPR into Spanish law and reinforces information obligations and citizens' rights. There is no turnover or headcount threshold that exempts an organisation from compliance.
Art. 37 GDPR establishes three mandatory scenarios: when the controller or processor is a public authority or body; when the core activities consist of processing operations that require regular and systematic monitoring of data subjects on a large scale; and when special categories of data are processed on a large scale (health, ideology, sexual orientation, criminal data, etc.). The LOPDGDD extends these scenarios in its art. 34, including among others educational centres, insurance companies, financial entities and telecommunications operators. Outside the mandatory scenarios, appointing an external DPO remains a good practice that strengthens the credibility of the system.
The enforcement framework of art. 83 GDPR establishes two tiers. Less serious infringements (such as failures relating to records of processing activities, art. 30, or data processing agreements, art. 28) may result in fines of up to €10 million or 2% of total annual worldwide turnover, whichever is higher. More serious infringements — violations of the principles of processing, lack of a legal basis or failure to uphold data subject rights — may reach €20 million or 4% of global turnover. The AEPD takes into account as mitigating factors cooperation with the regulator, the adoption of corrective measures and prior diligence demonstrated.
The timeframe depends on the size of the organisation, the number of processing activities it carries out and its starting point. For a medium-sized SME with between five and twenty employees and standard processing activities (customers, employees, suppliers), full compliance typically takes between four and eight weeks. In organisations with more complex processing — such as healthcare centres, educational institutions or companies with large volumes of customer data — the timeframe may be longer. In any case, starting as early as possible reduces the risk of being exposed to an AEPD investigation without the minimum required documentation in order.
Yes. Summum Consultoría has an office at Fray Luis de León 3, 2B, 47002 Valladolid, where we can meet for the initial assessment, documentation review and team training sessions. For clients who prefer to work remotely, or for organisations located in other provinces of Castilla y León, we also provide fully online support with no limitations on service delivery. The combination of local presence and remote working allows us to adapt to each client's needs.