Skip to content
AI Policy Generator

ESWhat applies

Spain · Law

Spanish Data Protection and Digital Rights Act (LOPDGDD)

In forceLOPDGDD

Summary

It complements the GDPR in Spain. For AI it matters mainly for three reasons: it requires many sectors to appoint a data protection officer, it limits consent as a basis for processing certain sensitive data, and it regulates workers' digital rights regarding devices, video surveillance and geolocation.

Who it applies to

Any organization processing personal data in Spain.

Penalties

Those of the GDPR (up to EUR 20M or 4% of worldwide turnover); the law classifies infringements and sets limitation periods.

Official name
Ley Orgánica 3/2018, de 5 de diciembre, de Protección de Datos Personales y garantía de los derechos digitales
Official reference
Ley Orgánica 3/2018, BOE núm. 294, de 6 de diciembre de 2018
Regulator
Spanish Data Protection Agency (AEPD) and regional authorities of Catalonia, the Basque Country and Andalusia
Official source
Check the sourceHow we verify sources

Key dates

Obligations and dates

Obligations table
ObligationArticle or citationStatusDateWho it applies toVerification
Appoint a data protection officer and involve them in AI projectsRGPD, arts. 37-39; LOPDGDD, arts. 34-37In forceAlready applicableMandatory for public bodies and for sectors such as banking, insurance, healthcare, education, telecom, energy, private security, profiling-based advertising and credit reference files.Verified in the official source on October 31, 2026
Limits on consent for sensitive dataLOPDGDD, art. 9.1In forceAlready applicableIf your AI processes data on ethnic origin, ideology, union membership, religion, sexual orientation or biometrics.Verified in the official source on October 31, 2026
Workers' digital rights when AI is used for monitoringLOPDGDD, arts. 87-91; Estatuto de los Trabajadores, art. 20 bisIn forceAlready applicableIf you monitor employees with digital tools, cameras, geolocation or biometrics.Verified in the official source on October 31, 2026

Appoint a data protection officer and involve them in AI projects

RGPD, arts. 37-39; LOPDGDD, arts. 34-37In force

Already applicable

When it relates
Mandatory for public bodies and for sectors such as banking, insurance, healthcare, education, telecom, energy, private security, profiling-based advertising and credit reference files.
What the rule provides
  • Appoint the officer and notify the AEPD within ten days.
  • Involve them in every AI project with personal data, especially in the DPIA.
  • Ensure their independence and resources.
Typical evidence
  • Appointment record and proof of notification to the AEPD.
  • The officer's opinion in AI system DPIAs.
Verification
Verified in the official source on October 31, 2026Consolidated text in the BOE (Spain's official gazette). In force since 2018; no new dates to confirm.

Workers' digital rights when AI is used for monitoring

LOPDGDD, arts. 87-91; Estatuto de los Trabajadores, art. 20 bisIn force

Already applicable

When it relates
If you monitor employees with digital tools, cameras, geolocation or biometrics.
What the rule provides
  • Set criteria for using digital devices with the participation of worker representatives, and inform staff.
  • Give prior, express and clear notice of video surveillance and geolocation.
  • Respect privacy and the right to digital disconnection; the AEPD rejects continuous visual monitoring of the whole working day.
Typical evidence
  • Device use policy and staff communication.
  • Monitoring DPIA.
Verification
Verified in the official source on October 31, 2026Consolidated text in the BOE (Spain's official gazette). In force since 2018; no new dates to confirm.

Related rules

Regulatory change alerts by country

Pick the countries you care about and we will email you when we change a rule or an application date for those countries in our registry.

  • Changes to the rules of the countries you pick, when we add them to the registry.
  • New application dates.
  • No more than one email a week. Unsubscribe at any time.

It is a free, informational notice, not a legal monitoring service: it does not necessarily catch every change or within a set time.

Countries · Pick one or more.
US states
Email language
Manage my alerts

Find out what applies to you (free)