SpainLey Orgánica 3/2018 (LOPDGDD), GDPR-Aligned Comprehensive Regime
In force since .
A comprehensive regime rule binding public and private bodies.
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- Establish a General Data Protection Regulation (GDPR) Article 6 lawful basis before processing personal data of a person in Spain, and rely on a statute-rank Spanish or EU norm rather than mere regulation if the basis is public interest or legal obligation, per LOPDGDD Article 8.NIST Privacy FrameworkCT.PO-P1
- Follow LOPDGDD Titulo V's controller and processor obligations, including its DPO qualification rule at Article 35.NIST Privacy FrameworkGV.PO-P3
These lines are LexLint's reading of the law's text. Also read by: Agencia Española de Protección de Datos, Gabinete Jurídico (legal report 0077/2023) (guidance, recorded ); Sentencia 76/2019, de 22 de mayo, del Pleno del Tribunal Constitucional (recurso de inconstitucionalidad 1405-2019) (recorded ).
In the frameworks
- NIST Privacy Framework
- GV.PO-P3Roles and responsibilities for the workforce are established with respect to privacy.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Case link
- https://hj.tribunalconstitucional.es/es/Resolucion/Show/25942
- Guidance link
- https://www.aepd.es/documento/2023-0077.pdf
- Case citation
- Sentencia 76/2019, de 22 de mayo, del Pleno del Tribunal Constitucional (recurso de inconstitucionalidad 1405-2019)
- Guidance body
- Agencia Española de Protección de Datos, Gabinete Jurídico (legal report 0077/2023)
- Open questions
- Which competence rules meet Article 8(2) of the LOPDGDD, 'cuando derive de una competencia atribuida por una norma con rango de ley', when a public task rests on a general statutory competence and the data processed are fixed only by a lower-ranking regulation?
What it makes you log
Who may demand the log
Regulator
Logging duty
Controllers and processors keep the record of processing activities that Article 30 of the Regulation requires, unless the Article 30(5) exception applies. Public bodies listed in Article 77(1) also publish an inventory of their processing activities (Article 31(2)).
- Kind
- Explicit
- As of
- Provision
- LOPDGDD, Art. 31(1), applying Regulation (EU) 2016/679, Art. 30
- Trigger
- personal_data_processing
Why the legislator wanted it
- As of
- Quote
- Each controller and processor should be obliged to cooperate with the supervisory authority and make those records, on request, available to it, so that it might serve for monitoring those processing operations.
- Source link
- https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng
- Source kind
- Recital
- Purpose
- accountability_demonstration
- regulator_supervision
What this law does
Spain gives the General Data Protection Regulation (GDPR) domestic effect through the Ley Organica 3/2018 (LOPDGDD, Organic Law on the Protection of Personal Data and the Guarantee of Digital Rights), in force since .
Unlike a bare implementing act, the LOPDGDD carries substantial national additions, confirmed against the BOE text: a freestanding Titulo X on digital rights (Arts. 79-97), a Titulo VI chapter on international transfers (Arts. 40-43) layered on GDPR Chapter V, and a Titulo IX administrative sanctioning regime (Arts. 70-78) calibrated onto GDPR Article 83's fine tiers.
Article 8, read verbatim, tightens rather than loosens GDPR's public-interest and legal-obligation bases: such processing is valid only where a Union-law norm or a Spanish statute-rank norm so provides.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .