SpainLOPDGDD Título VI, International Transfers, Layered on GDPR Chapter V
Regulation (EU) 2016/679, Arts. 44-49, 83(5); LOPDGDD, Arts. 40-43, 72.1(l)
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force since 25 May 2018, effective 7 December 2018.
A cross border transfer rule binding public and private bodies.
As of 24 August 2026.
What it requires
- Rely on an adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data of a person in Spain outside the EEA, and check whether LOPDGDD Articles 41-43 require AEPD authorization or prior notice for the specific transfer.
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
A transfer of personal data outside the EEA requires an adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation, backed by the Article 83(5) top fine tier. LOPDGDD Titulo VI (Arts. 40-43), confirmed against the article headings, adds a national administrative-procedure layer: cases the AEPD may itself authorize, cases requiring AEPD prior authorization, and cases requiring prior notice to the competent authority.
LOPDGDD Article 72.1(l) separately makes an unauthorized international transfer its own "muy grave" national infraction category.
When LexLint raises it
crawls_webtrains_models
Read the law
GDPR Arts. 44-49, 83(5)
LOPDGDD Arts. 40-43, 72.1(l)
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.