Spain Organic Law 3/2018 on Data Protection and Digital Rights (LOPDGDD) Art. 72: Know how Spanish law classifies infringements: very serious (3 years), serious (2 years), minor (1 year)

What does Art. 72 require?

Articles 70 to 75: controllers, processors, non-EU representatives, certification bodies and code monitoring bodies are liable (not the DPO); infringements under GDPR 83.4 to 83.6 and this law are classified for limitation purposes as very serious (three years; for example unlawful processing, invalid consent, incompatible purposes, missing information, breach of confidentiality, obstruction of rights, unlawful transfers, failure to block, deliberate re-identification), serious (two years; for example missing DPIA or DPO, no RoPA, no breach notification, inadequate security, no processor contract, no Article 28 assessment) or minor (one year; for example incomplete information or late breach notice); limitation is interrupted by opening proceedings.