What is the Spanish Data Protection Agency (AEPD)?

The Spanish Data Protection Agency (Agencia Española de Protección de Datos, or AEPD) has been operating since 1993. Its mission is to protect the privacy and personal data of citizens in their dealings with the organizations that process their information.

Over the years, it has adapted its work to technological change and to new legislation governing data protection in digital environments.

Today, its role is more important than ever, given the growing weight of cybersecurity.

What is the Spanish Data Protection Agency?

The AEPD is a public-law body with investigative, inspection and sanctioning powers that monitors compliance with personal data protection rules in Spain.

It is an independent authority that safeguards the personal information of citizens and makes sure their privacy is protected in practice, not just on paper. To do so, it runs awareness campaigns with guides, information materials and FAQs so that people know their rights.

It also helps companies and public administrations comply with the rules and, when they fail to do so, imposes the financial penalties provided for by law.

It can act on its own initiative or following a complaint, through an investigation. However, it does not handle compensation claims arising from the processing of personal data: those must be brought before the courts.

Its work is based on the following legal framework:

1. Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the GDPR).
2. Spain’s Organic Law 3/2018 of December 5 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).

What does the Spanish Data Protection Agency do?

The AEPD has its headquarters in Madrid and an online portal where many procedures can be completed.

Its scope is broad: social networks, homeowners’ associations, health, elections, data protection officers and more.

It answers common questions such as:

• Can a GPS tracker be installed in company cars used by employees?
• When must a data protection officer be appointed?
• Is it legal to record my trips with a camera mounted on my motorcycle?
• What precautions should be taken in online classes and online exams?

It works with the organizations that process data, with citizens and with international bodies.

How does it advise organizations that process data?

This includes companies, associations and public administrations. The AEPD:

• Helps them comply with the General Data Protection Regulation (GDPR) in their professional or business activities.
• Provides guidance on transferring data to countries with lower levels of protection.
• Helps them draw up codes of conduct on data protection.
• Warns those that need to take corrective action.

How does it help individuals?

Above all, it protects the rights of access, rectification, erasure (the “right to be forgotten”), restriction, portability and objection, including the right not to be subject to automated decisions.

It pays special attention to minors, with dedicated channels such as the Tú decides en Internet portal and awareness campaigns for schools.

How does it work with other authorities?

• It cooperates internationally and shares information with other data protection authorities to ensure the GDPR is applied consistently.
• It publishes an annual report on its activity.

Common procedures

Among the many procedures the AEPD handles, some stand out for their volume or importance:

• Use and publication of data online: photos on social networks, online shopping, the right to be forgotten, etc.
• Telecommunications: fraudulent contracts and wrongful inclusion in debtor files.
• Removal of sensitive content.
• Advertising: issues such as Spain’s Robinson List (the advertising opt-out list), mediation and withdrawal of consent.
• Video surveillance: legal opinions and compliance requirements, among others.
• Notification of the data protection officer by organizations.

The European Data Protection Board

Alongside the Spanish Data Protection Agency and the authorities of all European Union (EU) member states sits the European Data Protection Board (EDPB). This independent body contributes to the consistent application across the EU of:

• The GDPR.
• The EU directive on data protection in law enforcement.
• Cooperation between EU data protection authorities.

It is based in Brussels and has played a central role in decisions on transfers of personal data from Europe to the United States, notably in the 2023 Meta case.

At Smowltech, we strictly comply with data protection regulations and with the specific requirements of our activity. Learn more about data protection at SMOWL.