Spain Organic Law 3/2018 on Data Protection and Digital Rights (LOPDGDD)
Spain's Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD) supplements the EU GDPR with national provisions and establishes a catalogue of digital rights. The Spanish Data Protection Agency (AEPD - Agencia Española de Protección de Datos) oversees enforcement. Notable features include digital rights (right to disconnect, digital education, rectification on the internet), age of digital consent (14 years), deceased persons' data rights, and internal whistleblower provisions. AEPD is one of the most active DPAs in Europe.
Spain Organic Law 3/2018 on Data Protection and Digital Rights (LOPDGDD) is a compliance framework from Spain with 13 domains and 24 controls. The largest domains are Governance and Data Protection Officer (3 controls), Lawful Basis and Consent (3 controls), Records, Rights and Retention (3 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (13)
Breach
| Code | Title |
|---|---|
| SPAINLOPDGDD-4 | Breach, Enforcement |
Digital Rights
| Code | Title |
|---|---|
| LOPDGDD-14 | Digital Rights of Citizens and Workers |
| SPAINLOPDGDD-2 | Digital Rights, Spanish Specifics |
Employment and Special Categories
Employment and Special Categories
| Code | Title |
|---|---|
| LOPDGDD-12 | Employee Data and Workplace Monitoring |
| LOPDGDD-13 | Special Categories and Criminal Data |
Governance
| Code | Title |
|---|---|
| SPAINLOPDGDD-3 | DPO, Records, Governance |
Governance and Data Protection Officer
Governance and Data Protection Officer
| Code | Title |
|---|---|
| LOPDGDD-06 | Data Protection Officer Designation |
| LOPDGDD-18 | Audit, Accountability and Evidence |
| LOPDGDD-19 | Training and Awareness on Data Protection |
Lawful Basis and Consent
Lawful Basis and Consent
| Code | Title |
|---|---|
| LOPDGDD-01 | Lawful Basis and Spanish Specifics |
| LOPDGDD-02 | Consent Standards and Minors |
| LOPDGDD-03 | Information Provided to Data Subjects |
Marketing, Cookies and Profiling
Marketing, Cookies and Profiling
| Code | Title |
|---|---|
| LOPDGDD-15 | Marketing, Cookies and Profiling |
Processors and International Transfers
Processors and International Transfers
| Code | Title |
|---|---|
| LOPDGDD-10 | Processor Contracts and Sub-processing |
| LOPDGDD-11 | International Data Transfers |
Public Sector Provisions
Public Sector Provisions
| Code | Title |
|---|---|
| LOPDGDD-16 | Public Sector Specific Provisions |
Records, Rights and Retention
Records, Rights and Retention
| Code | Title |
|---|---|
| LOPDGDD-04 | Records of Processing Activities |
| LOPDGDD-05 | Data Subject Rights Handling |
| LOPDGDD-17 | Records Retention and Erasure |
Sanctions and Cooperation
Sanctions and Cooperation
| Code | Title |
|---|---|
| LOPDGDD-20 | Sanctions, Cooperation and Enforcement Readiness |
Scope
| Code | Title |
|---|---|
| SPAINLOPDGDD-1 | Scope, Lawful Basis, GDPR Implementation in Spain |
Security, Assessment and Breach
Security, Assessment and Breach
| Code | Title |
|---|---|
| LOPDGDD-07 | Security Measures and Risk Based Controls |
| LOPDGDD-08 | Breach Notification to AEPD and Subjects |
| LOPDGDD-09 | DPIA for High Risk Processing |
What is Spain Organic Law 3/2018 on Data Protection and Digital Rights (LOPDGDD) and who does it apply to?
Spain Organic Law 3/2018 on Data Protection and Digital Rights (LOPDGDD) is a compliance framework from Spain with 13 domains and 24 controls. Spain's Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD) supplements the EU GDPR with national provisions and establishes a catalogue of digital rights. The Spanish Data Protection Agency (AEPD - Agencia Española de Protección de Datos) oversees enforcement. Notable features include digital rights (right to disconnect, digital education, rectification on the internet), age of digital consent (14 years), deceased persons' data rights, and internal whistleblower provisions. AEPD is one of the most active DPAs in Europe. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does Spain Organic Law 3/2018 on Data Protection and Digital Rights (LOPDGDD) actually require?
Spain Organic Law 3/2018 on Data Protection and Digital Rights (LOPDGDD) has 24 controls organised across 13 domains. The largest domains are Governance and Data Protection Officer (3 controls), Lawful Basis and Consent (3 controls), Records, Rights and Retention (3 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of Spain Organic Law 3/2018 on Data Protection and Digital Rights (LOPDGDD) do I already cover?
Spain Organic Law 3/2018 on Data Protection and Digital Rights (LOPDGDD) does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.
How do I implement Spain Organic Law 3/2018 on Data Protection and Digital Rights (LOPDGDD)?
Start your Spain Organic Law 3/2018 on Data Protection and Digital Rights (LOPDGDD) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Spain Organic Law 3/2018 on Data Protection and Digital Rights (LOPDGDD) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 24 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 686 frameworks.
Get Started Free →Free forever — no credit card required