Spain Organic Law 3/2018 on Data Protection and Digital Rights (LOPDGDD) Art. 30: Allocate joint controller duties by actual activities, and make non-EU representatives jointly liable

What does Art. 30 require?

Articles 29 and 30: joint controllers' responsibilities follow the activities each actually performs; where the GDPR applies to a non-EU controller or processor under Article 3.2 for people in Spain, the AEPD or regional authorities may impose GDPR measures on the representative jointly with the controller or processor, and controllers, processors and representatives are jointly and severally liable for damages under GDPR 82.