Spain Organic Law 3/2018 on Data Protection and Digital Rights (LOPDGDD)
Spain's Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights (LOPDGDD): the national complement to the GDPR (consent from 14, law-rank bases, presumptions for business contacts, credit files, video surveillance and Robinson lists, data blocking, a sector list of mandatory DPOs, AEPD procedures and a three-tier infringement classification, no fines for public bodies) and Title X digital rights, including workplace device privacy, disconnection, camera and geolocation limits, the right to be forgotten in search engines and social networks, and digital testament.
Spain Organic Law 3/2018 on Data Protection and Digital Rights (LOPDGDD) is a compliance framework from Spain with 9 domains and 48 controls. The largest domains are Controllers, processors and the DPO (Title V) – Spain Organic Law 3/2018 on Data Protection and Digital Rights (LOPDGDD) (8 controls), Digital rights (Title X) – Spain Organic Law 3/2018 on Data Protection and Digital Rights (LOPDGDD) (8 controls), Lawful processing, consent and special data (Titles I and II) – Spain Organic Law 3/2018 on Data Protection and Digital Rights (LOPDGDD) (8 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (9)
Additional provisions – Spain Organic Law 3/2018 on Data Protection and Digital Rights (LOPDGDD)
| Code | Title |
|---|---|
| spain-organic-law-32018-on-data-protection-and-digital-rights-lopdgdd::DA 1 | Public sector controllers and their contractors: apply the ENS security measures to personal data processing |
| spain-organic-law-32018-on-data-protection-and-digital-rights-lopdgdd::DA 16 | Do not use aggressive data protection sales practices such as posing as the AEPD or threatening fines |
| spain-organic-law-32018-on-data-protection-and-digital-rights-lopdgdd::DA 17 | Health research: follow the rules on broad consent, compatible reuse, pseudonymisation separation and ethics committee review |
| spain-organic-law-32018-on-data-protection-and-digital-rights-lopdgdd::DA 7 | Publish administrative acts identifying people by name plus four random ID digits, never name with full ID number |
Complaints, infringements and sanctions (Titles VIII and IX) – Spain Organic Law 3/2018 on Data Protection and Digital Rights (LOPDGDD)
| Code | Title |
|---|---|
| spain-organic-law-32018-on-data-protection-and-digital-rights-lopdgdd::Art. 65 | Answer complaints forwarded by the AEPD within one month and show corrective measures |
| spain-organic-law-32018-on-data-protection-and-digital-rights-lopdgdd::Art. 72 | Know how Spanish law classifies infringements: very serious (3 years), serious (2 years), minor (1 year) |
| spain-organic-law-32018-on-data-protection-and-digital-rights-lopdgdd::Art. 76 | Expect GDPR fines graduated by Spanish aggravating and mitigating factors, published above one million euros |
| spain-organic-law-32018-on-data-protection-and-digital-rights-lopdgdd::Art. 77 | Public bodies: infringements are declared and corrected, with disciplinary action and published reprimands, not fined |
Controllers, processors and the DPO (Title V) – Spain Organic Law 3/2018 on Data Protection and Digital Rights (LOPDGDD)
| Code | Title |
|---|---|
| spain-organic-law-32018-on-data-protection-and-digital-rights-lopdgdd::Art. 28 | Assess the Article 28 higher-risk factors before choosing measures and deciding on a DPIA |
| spain-organic-law-32018-on-data-protection-and-digital-rights-lopdgdd::Art. 30 | Allocate joint controller duties by actual activities, and make non-EU representatives jointly liable |
| spain-organic-law-32018-on-data-protection-and-digital-rights-lopdgdd::Art. 31 | Keep the record of processing, tell the DPO of changes, and publish an inventory if a public body |
| spain-organic-law-32018-on-data-protection-and-digital-rights-lopdgdd::Art. 32 | Block data on rectification or erasure and keep it only for liability claims, then destroy |
| spain-organic-law-32018-on-data-protection-and-digital-rights-lopdgdd::Art. 33 | Treat a processor that acts in its own name or uses data for its own ends as a controller; settle data return at contract end |
| spain-organic-law-32018-on-data-protection-and-digital-rights-lopdgdd::Art. 34 | Appoint a DPO where the GDPR or the Article 34 sector list requires it and notify the authority within ten days |
| spain-organic-law-32018-on-data-protection-and-digital-rights-lopdgdd::Art. 36 | Protect the DPO's independence and access, and let them resolve complaints first |
| spain-organic-law-32018-on-data-protection-and-digital-rights-lopdgdd::Art. 38 | Comply with adhered codes of conduct and submit rejected complaints to the code's monitoring body |
Digital rights (Title X) – Spain Organic Law 3/2018 on Data Protection and Digital Rights (LOPDGDD)
| Code | Title |
|---|---|
| spain-organic-law-32018-on-data-protection-and-digital-rights-lopdgdd::Art. 80 | Internet providers: offer neutral, non-discriminatory service and inform users of their security rights |
| spain-organic-law-32018-on-data-protection-and-digital-rights-lopdgdd::Art. 83 | Education system and public employers: build digital competence and data protection into curricula and entrance exams |
| spain-organic-law-32018-on-data-protection-and-digital-rights-lopdgdd::Art. 85 | Social networks and digital media: provide rectification protocols and add update notices to outdated news |
| spain-organic-law-32018-on-data-protection-and-digital-rights-lopdgdd::Art. 92 | Schools and activity organisers: protect minors' data online and get consent before posting on social networks |
| spain-organic-law-32018-on-data-protection-and-digital-rights-lopdgdd::Art. 93 | Search engines: delist name-based results that are inadequate, inaccurate, irrelevant, outdated or excessive |
| spain-organic-law-32018-on-data-protection-and-digital-rights-lopdgdd::Art. 94 | Social networks: delete on request data the user posted, and third-party posts meeting the forgetting criteria |
| spain-organic-law-32018-on-data-protection-and-digital-rights-lopdgdd::Art. 95 | Social networks: let users receive and move the content they provided to another provider |
| spain-organic-law-32018-on-data-protection-and-digital-rights-lopdgdd::Art. 96 | Online services: honour digital testament instructions and relatives' requests about deceased users' content and profiles |
Digital rights at work (Title X) – Spain Organic Law 3/2018 on Data Protection and Digital Rights (LOPDGDD)
| Code | Title |
|---|---|
| spain-organic-law-32018-on-data-protection-and-digital-rights-lopdgdd::Art. 87 | Employers: set device-use criteria with worker representatives and limit access to monitoring compliance and integrity |
| spain-organic-law-32018-on-data-protection-and-digital-rights-lopdgdd::Art. 88 | Employers: adopt an internal digital disconnection policy after hearing worker representatives |
| spain-organic-law-32018-on-data-protection-and-digital-rights-lopdgdd::Art. 89 | Employers: inform workers before using cameras for monitoring; never in rest areas; audio only for serious security risk |
| spain-organic-law-32018-on-data-protection-and-digital-rights-lopdgdd::Art. 90 | Employers: tell workers in advance about geolocation systems and their rights |
International transfers (Title VI) – Spain Organic Law 3/2018 on Data Protection and Digital Rights (LOPDGDD)
| Code | Title |
|---|---|
| spain-organic-law-32018-on-data-protection-and-digital-rights-lopdgdd::Art. 42 | Obtain AEPD authorisation for transfers on non-standard clauses or non-binding public-sector arrangements |
| spain-organic-law-32018-on-data-protection-and-digital-rights-lopdgdd::Art. 43 | Inform the authority and data subjects before a transfer based on compelling legitimate interests |
Lawful processing, consent and special data (Titles I and II) – Spain Organic Law 3/2018 on Data Protection and Digital Rights (LOPDGDD)
| Code | Title |
|---|---|
| spain-organic-law-32018-on-data-protection-and-digital-rights-lopdgdd::Art. 10 | Process criminal conviction data outside law enforcement only under EU law, statute or for lawyers' client work |
| spain-organic-law-32018-on-data-protection-and-digital-rights-lopdgdd::Art. 3 | Handle requests about deceased persons' data from relatives, heirs and designated persons |
| spain-organic-law-32018-on-data-protection-and-digital-rights-lopdgdd::Art. 4 | Keep data accurate; inaccuracy from the data subject or a public register is not imputed if promptly corrected |
| spain-organic-law-32018-on-data-protection-and-digital-rights-lopdgdd::Art. 5 | Bind everyone involved in processing to confidentiality that survives the end of the relationship |
| spain-organic-law-32018-on-data-protection-and-digital-rights-lopdgdd::Art. 6 | Obtain specific consent for each purpose and never tie a contract to unrelated consents |
| spain-organic-law-32018-on-data-protection-and-digital-rights-lopdgdd::Art. 7 | Rely on a minor's own consent only from age 14; below that obtain the parent's or guardian's |
| spain-organic-law-32018-on-data-protection-and-digital-rights-lopdgdd::Art. 8 | Ground legal-obligation and public-task processing in EU law or a norm with the rank of law |
| spain-organic-law-32018-on-data-protection-and-digital-rights-lopdgdd::Art. 9 | Do not rely on consent alone to process data aimed at identifying ideology, union membership, religion, sexual orientation, beliefs or ethnicity |
Specific processing situations (Title IV) – Spain Organic Law 3/2018 on Data Protection and Digital Rights (LOPDGDD)
| Code | Title |
|---|---|
| spain-organic-law-32018-on-data-protection-and-digital-rights-lopdgdd::Art. 19 | Process business contact data of employees, sole traders and professionals under the legitimate interest presumption |
| spain-organic-law-32018-on-data-protection-and-digital-rights-lopdgdd::Art. 20 | Report debts to credit information systems only under the Article 20 conditions |
| spain-organic-law-32018-on-data-protection-and-digital-rights-lopdgdd::Art. 21 | Share data for mergers and business transfers only as needed, and erase at once if the deal fails |
| spain-organic-law-32018-on-data-protection-and-digital-rights-lopdgdd::Art. 22 | Run video surveillance proportionately: minimal public-street capture, one-month deletion, visible notice sign |
| spain-organic-law-32018-on-data-protection-and-digital-rights-lopdgdd::Art. 23 | Consult published advertising exclusion (Robinson) lists before direct marketing, unless the person consented |
| spain-organic-law-32018-on-data-protection-and-digital-rights-lopdgdd::Art. 24 | Process whistleblower data under the GDPR, this law and the whistleblower protection law |
Transparency and data subject rights (Title III) – Spain Organic Law 3/2018 on Data Protection and Digital Rights (LOPDGDD)
| Code | Title |
|---|---|
| spain-organic-law-32018-on-data-protection-and-digital-rights-lopdgdd::Art. 11 | Inform in layers: basic information up front with easy access to the rest |
| spain-organic-law-32018-on-data-protection-and-digital-rights-lopdgdd::Art. 12 | Offer accessible, free means to exercise rights and keep proof of every response |
| spain-organic-law-32018-on-data-protection-and-digital-rights-lopdgdd::Art. 13 | Answer access requests, optionally through permanent secure remote access; repeat requests within six months may be excessive |
| spain-organic-law-32018-on-data-protection-and-digital-rights-lopdgdd::Art. 15 | Handle rectification, erasure and restriction: mark restriction in systems and keep only suppression identifiers after marketing objection |
What is Spain Organic Law 3/2018 on Data Protection and Digital Rights (LOPDGDD) and who does it apply to?
Spain Organic Law 3/2018 on Data Protection and Digital Rights (LOPDGDD) is a compliance framework from Spain with 9 domains and 48 controls. Spain's Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights (LOPDGDD): the national complement to the GDPR (consent from 14, law-rank bases, presumptions for business contacts, credit files, video surveillance and Robinson lists, data blocking, a sector list of mandatory DPOs, AEPD procedures and a three-tier infringement classification, no fines for public bodies) and Title X digital rights, including workplace device privacy, disconnection, camera and geolocation limits, the right to be forgotten in search engines and social networks, and digital testament. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does Spain Organic Law 3/2018 on Data Protection and Digital Rights (LOPDGDD) actually require?
Spain Organic Law 3/2018 on Data Protection and Digital Rights (LOPDGDD) has 48 controls organised across 9 domains. The largest domains are Controllers, processors and the DPO (Title V) – Spain Organic Law 3/2018 on Data Protection and Digital Rights (LOPDGDD) (8 controls), Digital rights (Title X) – Spain Organic Law 3/2018 on Data Protection and Digital Rights (LOPDGDD) (8 controls), Lawful processing, consent and special data (Titles I and II) – Spain Organic Law 3/2018 on Data Protection and Digital Rights (LOPDGDD) (8 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of Spain Organic Law 3/2018 on Data Protection and Digital Rights (LOPDGDD) do I already cover?
Spain Organic Law 3/2018 on Data Protection and Digital Rights (LOPDGDD) does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.
How do I implement Spain Organic Law 3/2018 on Data Protection and Digital Rights (LOPDGDD)?
Start your Spain Organic Law 3/2018 on Data Protection and Digital Rights (LOPDGDD) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Spain Organic Law 3/2018 on Data Protection and Digital Rights (LOPDGDD) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 48 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,049 frameworks.
Get Started Free →Free forever, no credit card required