Spain

Article 23(1) of Ley 15/2022 provides that public administrations will favour mechanisms so that the algorithms involved in the decisions they take account of criteria of bias minimisation, transparency and accountability, wherever technically feasible. Under article 23(1) the Act also promotes impact assessments to determine possible discriminatory bias in those algorithms.

Under article 23(2), public administrations will give priority to transparency in the design and implementation of those algorithms and to the ability to interpret the decisions they adopt. Under article 23(3), public administrations and companies will promote ethical, trustworthy artificial intelligence that respects fundamental rights. Article 23(4) provides that a quality seal for algorithms will be promoted. The Act entered into force on 14 July 2022, the day after its publication in the Boletín Oficial del Estado.

Real Decreto 729/2023 approves the Statute of the Agencia Española de Supervisión de Inteligencia Artificial. Under article 4(1) the Agency carries out supervision, advice, awareness and training tasks aimed at public and private law entities for the proper implementation of all national and European rules on the use and development of artificial intelligence systems, more specifically algorithms.

The Agency also has the functions of inspection, verification, sanction and any others that the applicable European rules give it, in particular on artificial intelligence. Within the competence of the State, article 4(2) makes the Agency the authority responsible for supervising and, where appropriate, sanctioning artificial intelligence systems, in order to eliminate or reduce risks to integrity, privacy, equal treatment and non-discrimination and other fundamental rights.

Among the Agency's purposes is the promotion of real test environments for artificial intelligence systems, to strengthen user protection and avoid discriminatory bias. The decree enters into force on the day after its publication in the Boletín Oficial del Estado.

A works council has the right to be informed by the company of the parameters, rules, and instructions on which an algorithm or artificial intelligence system that affects decisions on working conditions, access to employment, or continued employment is based, including profiling, per new Article 64.4.d) of the Estatuto de los Trabajadores. The obligation first applied under Real Decreto-ley 9/2021, which entered into force on 12 August 2021.

Ley 12/2021, which came from the parliamentary processing of that decree-law, tacitly replaced it and carries the same Article 64.4.d) text forward.

Ley 10/2025 applies to all companies, established in Spain or in any other State, that effectively carry out basic services of general interest offered or provided in Spanish territory, namely water, gas and electricity supply and distribution, passenger transport, postal services, electronic communications and financial services. Article 8(1) prohibits the use of answering machines or similar means as the exclusive means of customer service.

Article 8(2) requires the use of answering machines, conversational bots or similar means to offer customers the possibility of requesting personalised attention from the options in their main menu, at any time of the interaction, from its start. Personalised attention is attention offered directly by a natural-person operator who answers the customer in real time and must in every case identify themselves at the start of the conversation.

The company must provide personalised attention as soon as possible after the request, ensuring that on average 95 percent of requests for it are attended within less than three minutes of the request. Companies must adapt their customer service to the Act within twelve months of its entry into force. The Act entered into force on 28 December 2025.

Final provision 1 of Ley 10/2025 adds a new paragraph 9 to article 27 of Ley 3/1991 on Unfair Competition. Article 27 of Ley 3/1991 treats as unfair, because deceptive, the practices that it lists. The new paragraph 9 covers practices addressed to consumers individually and personalised on the basis of automated decision-making, without informing them of the parameters used for the personalisation or, for offers on contracts for financial products or services, of the data sources used.

Final provision 3 changes article 20(1)(c) of the consolidated General Law for the Defence of Consumers and Users so that, in contracts concluded at a distance or away from the business premises, the trader gives clear and comprehensible information on the price when it has been personalised on the basis of automated decision-making. That personalisation may not lead to increases in the final sale price when demand rises in contexts of urgency, risk or need of the consumer.

A context of urgency, risk or need is one arising from any situation that can be classified as a civil protection emergency under Ley 17/2015 on the National Civil Protection System. Ley 10/2025 entered into force on 28 December 2025.

A controller must notify the AEPD without undue delay and, where feasible, not later than 72 hours after becoming aware of a personal-data breach, and notify the affected individual without undue delay where the breach is likely to result in a high risk. Under Titulo IX, failing to notify the AEPD of a breach, or failing to inform the affected person when the AEPD has required it, is a serious infraction (Art. 73(r)-(s)). A late, incomplete or defective notification of a breach to the AEPD is a minor infraction (Art. 74(m)).

Spain gives the General Data Protection Regulation (GDPR) domestic effect through the Ley Organica 3/2018 (LOPDGDD, Organic Law on the Protection of Personal Data and the Guarantee of Digital Rights), in force since 7 December 2018.

Unlike a bare implementing act, the LOPDGDD carries substantial national additions, confirmed against the BOE text: a freestanding Titulo X on digital rights (Arts. 79-97), a Titulo VI chapter on international transfers (Arts. 40-43) layered on GDPR Chapter V, and a Titulo IX administrative sanctioning regime (Arts. 70-78) calibrated onto GDPR Article 83's fine tiers.

Article 8, read verbatim, tightens rather than loosens GDPR's public-interest and legal-obligation bases: such processing is valid only where a Union-law norm or a Spanish statute-rank norm so provides.

A transfer of personal data outside the EEA requires an adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation, backed by the Article 83(5) top fine tier. LOPDGDD Titulo VI (Arts. 40-43), confirmed against the article headings, adds a national administrative-procedure layer: cases the AEPD may itself authorize, cases requiring AEPD prior authorization, and cases requiring prior notice to the competent authority.

LOPDGDD Article 72.1(l) separately makes an unauthorized international transfer its own "muy grave" national infraction category.

General Data Protection Regulation (GDPR) Article 22 gives a person in Spain the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them, unless the decision is necessary for a contract with them, authorised by a law that safeguards their rights, or based on their explicit consent.

Where it rests on a contract or consent, the controller must at least let the person obtain human intervention, express their point of view and contest the decision.

Under Article 22(4), such a decision may not rest on the special categories of personal data in Article 9(1) unless the person gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of proportionate Union or Member State law, with suitable safeguards in place.

Articles 13(2)(f), 14(2)(g) and 15(1)(h) require the controller to tell the person that such decision-making takes place, with meaningful information about the logic involved and its significance and envisaged consequences for them, at collection, within the Article 14(3) period where the data came from another source, and on an access request.

The LOPDGDD adds no authorisation of its own under Article 22(2)(b); its Article 11(2) requires a controller that uses a person's data for profiling to state, in the basic information it gives them, that they may object to a solely automated decision where Article 22 gives that right.

LOPDGDD Titulo III (Arts. 11-18) mirrors General Data Protection Regulation (GDPR) Articles 12-22 domestically: transparency, access, rectification, erasure, restriction, portability, and objection.

Titulo X then layers freestanding rights with no GDPR counterpart, confirmed against the article titles: Article 93's right to be forgotten against internet search engines, Article 94's equivalent against social-network services, Article 95's social-network portability right, and Article 96's right to a digital will governing a deceased person's digital accounts.

A patient has the right of access to the documentation in the clinical record and to obtain a copy of the data in it. Health centres must regulate a procedure that ensures a patient's right of access to the clinical record is observed. A patient's right of access to the clinical record may also be exercised through a duly accredited representative.

A patient's right of access to the clinical record may not be exercised to the detriment of third persons' right to confidentiality of data recorded in the patient's therapeutic interest, and the professionals who took part in preparing it may withhold their subjective notes. Health centres and individual practitioners give access to the clinical record of a deceased patient only to persons connected to the patient for family or de facto reasons, unless the deceased expressly prohibited it.

A patient has the right to have health centres establish a mechanism of active and diligent custody of clinical records.

The AEPD is Spain's supervisory authority; LOPDGDD Titulo IX (Arts. 70-78) sorts infractions into muy graves, graves, and leves, each defined by direct cross-reference to a General Data Protection Regulation (GDPR) Article 83 tier rather than an independent Spanish fine scale, confirmed against the text. GDPR Article 82 arms an individual with a direct private right of action.

LOPDGDD's Disposicion final septima only amends Article 15 bis of the Civil Procedure Act, on the intervention of authorities in competition and data-protection proceedings, and does not create a class-action mechanism.

Article 5 of Ley 14/2007, the Biomedical Research Law, requires the protection of personal privacy and the confidential treatment of the personal data that result from biomedical research activity. The same guarantees apply to biological samples that are a source of personal information. Disclosing personal data to third parties outside the medical-care activity or a biomedical research requires the express written consent of the person concerned.

Using data about a person's health for purposes other than those for which consent was given is prohibited. Anyone who accesses personal data in the exercise of their functions in a medical-care activity or a biomedical research is bound by a duty of secrecy that persists after the activity has ended. Where research results cannot be published without identifying a participant or sample donor, they may be published only with that person's prior and express consent.

Ley 41/2002 (the Basic Law on Patient Autonomy and Clinical Information) regulates the rights and obligations of patients, users, professionals and public and private health centres over clinical information and documentation. Every person has the right to have the confidentiality of data about their health respected, and no one may access that data without prior authorization backed by law. Health centres must adopt the measures needed to guarantee the confidentiality of patients' health data.

Administrative and management staff of a health centre may access only the clinical-record data related to their own functions. Staff who access clinical-record data in the exercise of their functions are bound by a duty of secrecy.

Access to a clinical record for judicial, epidemiological, public-health, research or teaching purposes must, as a rule, keep the patient's identifying data separate from the clinical data so that anonymity is ensured, unless the patient has consented to keeping them together, subject to the exceptions the article sets out.

Health centres must keep clinical documentation in conditions that ensure its correct maintenance and security, for at least five years from the date of discharge from each care process.

Accessing or facilitating access to all or part of an information system, or remaining in it against the will of whoever has the legitimate right to exclude the actor, is a crime carrying six months to two years' imprisonment, but only where the actor breaches security measures established to prevent that access and lacks due authorization.

Intercepting non-public data transmissions to, from, or within an information system by technical means, without authorization, carries a separate penalty of three months to two years' imprisonment or a fine. Because the offense in the first paragraph requires vulnerating an established security measure, accessing a page with no access control in place, the ordinary case of public-web crawling, does not fall within Article 197 bis on the text of the article alone.

Contracts concluded by electronic means produce all the effects the legal order provides for, where consent and the other requirements for validity are present. Electronic contracts are governed by Title IV of the Act, the Civil and Commercial Codes and the other civil or commercial rules on contracts. No prior agreement of the parties on the use of electronic means is needed for a contract to be validly concluded by electronic means.

Before the contracting procedure begins, a service provider must make the general conditions of the contract available to the recipient in a way that lets the recipient store and reproduce them.

Standard terms are pre-drafted clauses whose incorporation into the contract one party imposes, drafted to be incorporated into a plurality of contracts. The Act applies to contracts containing standard terms made between a professional, the predisponente, and any natural or legal person, the adherent. The adherent may also be a professional. Standard terms become part of the contract when the adherent accepts their incorporation and all the contracting parties sign it.

Acceptance of incorporation cannot be understood to exist where the predisponente has not expressly informed the adherent of the existence of the terms and has not given the adherent a copy of them. Standard terms are not incorporated into the contract where the adherent had no real opportunity to know them in full when the contract was made.

Standard terms that are illegible, ambiguous, obscure or incomprehensible are not incorporated, subject to the exception in article 7(b) for terms the adherent expressly accepted in writing that conform to the transparency rules of the sector concerned. Standard terms that contradict this Act or any other mandatory or prohibitive rule to the detriment of the adherent are void.

No authorization from an intellectual-property rights holder is needed for reproductions of legitimately accessible works made for text and data mining purposes, per Article 67(1). That exception does not apply where rights holders have expressly reserved the use of their works through machine-readable means or other adequate means, per Article 67(3), an opt-out a crawler must honor to keep the general exception available.

A separate provision in Article 67(4) covers research organizations and cultural-heritage institutions carrying out text and data mining for scientific research: their reproductions are stored with an adequate level of security and may be kept to verify the research results, and the reservation in Article 67(3) is expressed to displace paragraph 1 only.

Press publishers and news agencies established in Spanish territory hold the exclusive right to reproduce a press publication, in whole or in part, and to make it available to the public, for online use by information society service providers. The reproduction or making available to the public by third-party users of any text, image, photographic work or mere photograph covered by that right is subject to authorization.

The right does not apply to the private or non-commercial use of press publications by individual users, or to acts of hyperlinking. It does not apply to individual words or very short or insignificant extracts of press publications used online by information society service providers, where that use does not harm the investments of the publishers and news agencies and does not affect the effectiveness of the right. The right lasts two years, counted from 1 January of the year after the date of publication of the press publication.

A database maker who shows a substantial investment, evaluated qualitatively or quantitatively, in obtaining, verifying, or presenting its content may prohibit the extraction or reuse of the whole or a substantial part of that content, per Article 133.1. The right runs for 15 years counted from 1 January after completion of the database, or after it was first made available to the public if that happens before the term expires, per Article 136.

A legitimate user may extract or reuse a substantial part without authorization for private, non-electronic use, or for illustrative teaching or scientific-research purposes within the limits justified by the non-commercial aim and citing the source, per Article 135.1.

The Act applies to conduct carried out in the market with competitive purposes. The Act applies to businesses, professionals and any other natural or legal person who takes part in the market. The application of the Act cannot depend on a competitive relationship between the person who acts and the person affected. Any conduct that is objectively contrary to the requirements of good faith is deemed unfair.

Imitation of the business or professional performances and initiatives of others is free unless an exclusive right recognized by law protects them. Imitation of the performance of a third party is deemed unfair when it is suited to generate association among consumers with the performance or involves undue exploitation of the reputation or effort of another.

Inducing workers, suppliers, clients and other obliged persons to breach the basic contractual duties they have undertaken to competitors is deemed unfair. Taking advantage of the contractual breach of another is deemed unfair only when the breach is known and aims at the dissemination or exploitation of an industrial or business secret, or is accompanied by circumstances such as deception or the intention to eliminate a competitor from the market.

The actions available against unfair acts include a declaration of unfairness and cessation of the conduct or a prohibition of its repetition. Compensation for the damage caused by the unfair conduct is available where the agent acted with intent or fault. Any natural or legal person who takes part in the market and whose economic interests are directly harmed or threatened by the unfair conduct may bring those actions.

A trade secret is information or knowledge that is secret, has business value because it is secret, and has been subject to reasonable measures by its holder to keep it secret. Obtaining a trade secret is lawful when done by independent discovery or creation, or by observing, studying, dismantling or testing a product or object made available to the public, unless the person is subject to an obligation that validly prevents obtaining it that way.

Obtaining a trade secret without the consent of its holder is unlawful when done by unauthorized access to, appropriation of or copying of documents, objects, materials, substances, electronic files or other media that contain the secret or from which it can be deduced, or by any other conduct considered contrary to fair commercial practices.

Using or disclosing a trade secret without the consent of its holder is unlawful when done by a person who obtained it unlawfully, who breached a confidentiality agreement or another obligation not to disclose it, or who breached a contractual or other obligation limiting its use.

Obtaining, using or disclosing a trade secret is also unlawful when the person, at that time, knows or in the circumstances should have known that it came directly or indirectly from someone using or disclosing it unlawfully. The actions and measures of the Act do not lie against acts of obtaining, using or disclosing a trade secret done in exercise of the right to freedom of expression and information.

Against acts of violation of trade secrets the holder may seek, among other things, cessation of the acts or their prohibition. Compensation for damages may be sought where the infringer acted with intent or fault.

Article 3.3 of Real Decreto 188/2016 lists requirements that radio equipment must meet where the Commission's delegated acts apply them to its category: that it does not harm the network or its functioning or misuse network resources, that it contains safeguards that protect personal data and the privacy of the user and subscriber, and that it is compatible with functions that protect against fraud.

Delegated Regulation (EU) 2022/30 applies point (d) to any radio equipment that can communicate itself over the internet, whether it communicates directly or via any other equipment. Delegated Regulation (EU) 2022/30 applies point (e) to internet-connected radio equipment, radio equipment designed or intended exclusively for childcare, radio equipment covered by the toy safety directive and wearable radio equipment, where the equipment can process personal data, traffic data or location data.

Delegated Regulation (EU) 2022/30 applies point (f) to internet-connected radio equipment that enables the holder or user to transfer money, monetary value or virtual currency. Delegated Regulation (EU) 2023/2444 set 1 August 2025 as the date from which Delegated Regulation (EU) 2022/30 applies. Delegated Regulation (EU) 2022/30 does not apply points (d), (e) and (f) to radio equipment that Regulation (EU) 2017/745 or Regulation (EU) 2017/746 also covers.

A manufacturer that places radio equipment on the market must ensure that it has been designed and manufactured in accordance with the essential requirements in article 3. A breach of the regulation is sanctioned under Title VIII of Ley 9/2014 or Title V of Ley 21/1992, as the case may be.

Article 63.1 requires operators of public electronic communications networks and of publicly available electronic communications services to manage the security risks to their networks and services and to adopt technical and organisational measures that are appropriate, proportionate and in line with the state of the art, which may include encryption.

Article 63.2 requires operators of public electronic communications networks to guarantee the integrity of those networks so as to ensure the continuity of the services that use them. Article 107 classes failure to meet the obligations on integrity and security in providing services or supplying electronic communications networks as a grave infringement.

Article 13 of Ley 8/2011 requires critical operators, whether public or private, to produce an Operator Security Plan and a Specific Protection Plan for each infrastructure the Catalogue lists as critical, and to certify the implementation of the measures the competent authority requires. Critical operators must also designate a Security and Liaison Officer and a Security Delegate for each critical infrastructure, and facilitate the inspections of the competent authorities.

Real Decreto 704/2011 requires a critical operator to submit its Operator Security Plan to the CNPIC within six months of notification of its designation. The Operator Security Plan must set out a risk analysis methodology that guarantees the continuity of the services the operator provides, covering the physical and logical threats to each type of asset. Operators must review their Operator Security Plans every two years, and the CNPIC approves the reviews.

A critical operator must produce a Specific Protection Plan for each critical infrastructure within four months of the approval of its Operator Security Plan. Critical operators are the public or private operators that meet the conditions of article 13 of Ley 8/2011.

Article 2.3 applies the National Security Scheme to the information systems of private-sector entities, including the duty to have the security policy that article 12 describes, where they provide services or supply solutions to public-sector entities for those entities' exercise of their administrative competences and powers under a contractual relationship.

The tender specifications of public-sector contracts must contain the requirements needed to ensure conformity with the Scheme, such as the filing of declarations or certifications of conformity, and the requirement extends to the contractors' supply chain as far as necessary under the risk analysis. A private-sector entity's security policy is approved by the body that holds the highest executive competences.

Information systems within the scope of the royal decree undergo a regular audit at least every two years, and an extraordinary audit after substantial modifications that may affect the required security measures.

The national security scheme for 5G networks and services applies to 5G operators, 5G suppliers and 5G corporate users, and to public administration entities that install, deploy and operate 5G networks or provide 5G services unless their activities are mainly in national security, public security, national defence or law enforcement. A 5G operator must analyse the risks to its 5G networks and services, detecting the vulnerabilities and threats that affect them.

A 5G operator must carry out a new risk analysis and send it to the Ministry for Digital Transformation and the Civil Service before 1 October 2024, and then every two years. A 5G operator must also submit to a security audit at its own cost at least every two years. A 5G supplier must analyse the risks of the telecommunications equipment, hardware, software and ancillary services involved in operating 5G networks.

A 5G supplier must meet security standards from the design of its equipment, products and services to their commissioning, and must strengthen software integrity and manage updates and patches. A 5G supplier must also carry out a security audit of its equipment, products and services. The sanctions regime of articles 30 and 31 of Real Decreto-ley 7/2022 applies to breaches.

Article 16 requires an operator of essential services (a public or private entity identified under Article 6 that provides a service in one of the strategic sectors defined in the annex to Ley 8/2011) and a digital service provider under this Real Decreto-ley to adopt adequate and proportionate technical and organisational measures to manage the risks to the networks and information systems used in providing the services the Real Decreto-ley covers.

A digital service provider must additionally address, at minimum, the security of its systems and facilities, incident management, business-continuity management, monitoring, auditing and testing, and compliance with international standards. Real Decreto 43/2021 develops this duty: an operator of essential services must designate a responsable de la seguridad de la informacion within three months of its designation as an operator of essential services.

It must also send the competent authority a Declaracion de Aplicabilidad of the security measures it applies within six months of that designation, and review it at least every three years. This transposes the original NIS Directive (Directive (EU) 2016/1148) and remains in force, with no repeal recorded in the consolidated text, pending the NIS2 transposition described on this jurisdiction's Anteproyecto rows.

Article 66.1 requires payment service providers to establish a framework, in accordance with what the Banco de España provides, with mitigation measures and control mechanisms to manage the operational and security risks of the payment services they provide, including effective incident management procedures to detect and classify major operational and security incidents.

Article 66.2 requires payment service providers to give the Banco de España, at least once a year and in the form it determines, an updated and comprehensive assessment of the operational and security risks of their payment services and of the adequacy of the mitigation measures and control mechanisms they apply. Payment service providers and their directors and managers are subject to the sanctions regime of Title IV of Ley 10/2014 and to Real Decreto 2119/1993. Titles II and III of the Real Decreto-ley apply three months after its publication in the Boletín Oficial del Estado.

Real Decreto-ley 7/2022, de 29 de marzo, published in the Boletín Oficial del Estado of 30 March 2022, sets requirements to guarantee the security of fifth-generation (5G) electronic communications networks and services, and applies under Article 4 to 5G operators, 5G suppliers and 5G corporate users.

Article 12(1) requires 5G operators to guarantee the secure installation, deployment and operation of public 5G networks and the secure provision of 5G services available to the public, and Article 12(2) lists security obligations that include technical and operational measures for the physical and logical integrity of the networks, using only certified products, resources, services and systems to operate them, and submitting at the operator's own cost to a security audit.

An operator that owns or operates critical elements of a public 5G network must also design a supply-chain diversification strategy under which the access network's equipment, systems and resources come from at least two different suppliers (Article 12(3)).

Article 13 requires 5G suppliers to guarantee the security of the telecommunications equipment, hardware, software and ancillary services they provide for use in 5G networks and services, with obligations that include security by design, software integrity, update and patch management, certification of products and services, and a security audit of their equipment, products and services.

Article 15 requires a corporate user with rights to use the radio spectrum for a private 5G network to guarantee that network's secure installation, deployment and operation. Under Article 17(2) a public administration that installs or operates 5G networks, or provides 5G services, may not use equipment, products and services from suppliers classified as high-risk or medium-risk for reasons of national security.

Under Article 30(4), a failure to meet Article 12, 13, 15 or 17 is a serious infringement, and a failure by an operator that owns or operates critical elements to meet Article 12(3) is a very serious one, sanctioned under Title VIII of Law 9/2014. Articles 12, 13, 15, 16 and 17 enter into force one month after publication, and the rest of the decree-law the day after publication.

Article 4 of Real Decreto-ley 8/2023, de 27 de diciembre, published in the Boletín Oficial del Estado of 28 December 2023, requires payment system operators, payment scheme operators, electronic payment arrangement operators, payment processors and other technology or technical service providers that provide services in Spain to comply with the obligations in Chapter II of Regulation (EU) 2022/2554 (DORA), and reads the Regulation's references to financial entities as references to them.

Under Article 4(2) the Banco de España is the competent authority to supervise compliance and sanction breaches. Under Article 4(3) a breach is an infringement for the purposes of Article 92(f) of Law 10/2014. Article 4(4) does not apply to payment system operators that the European Central Bank considers systemically important.

The decree-law entered into force on 29 December 2023, and DORA's requirements for credit, payment and e-money institutions become fully enforceable from 17 January 2025.

Article 63.3 requires operators that supply public networks or provide publicly available electronic communications services to notify the Ministry of Economic Affairs and Digital Transformation of security incidents that have had a significant impact on the supply of the networks or services.

The parameters for judging the significance of an incident include the number of users affected, its duration, the geographic area affected, the extent to which the network or service was affected and the scale of the impact on economic and social activities, where they are available. The Ministry may inform the public, or require operators to do so, where it considers that disclosure of the security incident is in the public interest.

Article 63.4 requires operators, where there is a particular and significant threat of a security incident, to inform the users who may be affected about the possible protective measures or solutions they can adopt and, where appropriate, about the threat itself. Article 107 classes failure to meet the obligations on integrity and security in providing services or supplying electronic communications networks as a grave infringement.

The ninth additional provision requires information society service providers, domain name registries and registrars established in Spain to cooperate with the competent CERT in resolving cybersecurity incidents that affect the internet and to act on the security recommendations it indicates.

Those providers must supply the competent CERT and the competent authorities with the information needed to manage cybersecurity incidents, including the IP addresses that may be compromised or involved, while respecting the secrecy of communications. Under the codes of conduct, providers must identify the users affected by cybersecurity incidents that the CERT notifies to them and tell those users what they must do and by when.

Where users do not act within the recommended period, providers must isolate the equipment or service from the network at the request of the CERT until the malicious activity ends. Ley 9/2014 introduced the ninth additional provision into Ley 34/2002.

Article 19 requires an operator of essential services to notify the competent authority, through its reference computer security incident response team (CSIRT), of an incident that may have a significant disruptive effect on its service, and requires a digital service provider to notify an incident with a significant disruptive effect on its service, limited to cases where the provider has access to the information needed to assess the incident's impact.

Article 22 sets an initial notification made without undue delay (sin dilacion indebida), followed by interim and final notifications.

Real Decreto 43/2021's own national incident-notification and management instruction (its Anexo) fixes the clock by severity: for a CRITICO-severity incident, the initial notification is immediate, the interim notification is due within 24 to 48 hours and the final notification within 20 days; for a MUY ALTO-severity incident, the interim notification is due within 72 hours and the final notification within 40 days; an ALTO-severity incident requires only an immediate initial notification, and the instruction sets no reporting window for a MEDIO- or BAJO-severity incident.

This is a looser, severity-gated clock than the fixed 24-hour early warning and 72-hour notification Directive (EU) 2022/2555 itself sets, and it remains in force pending the NIS2 transposition described on this jurisdiction's Anteproyecto rows.

Article 67.1 requires payment service providers to notify the Banco de España immediately, in the form it determines, of major operational or security incidents. Where a security incident affects or may affect the financial interests of the users of its payment services, the provider must inform them without undue delay of the incident and of all the mitigation measures they can take.

Article 67.4 requires payment service providers to give the Banco de España, in the form and at the intervals it determines and at least annually, statistical data on fraud relating to different means of payment. Payment service providers and their directors and managers are subject to the sanctions regime of Title IV of Ley 10/2014 and to Real Decreto 2119/1993. Titles II and III of the Real Decreto-ley apply three months after its publication in the Boletín Oficial del Estado.

Article 20(1) requires commercial communications made by electronic means to be clearly identifiable as such, and the person on whose behalf they are made to be clearly identifiable. Article 20(2) requires promotional offers, such as those that include discounts, prizes and gifts, and promotional contests or games, to be clearly identified as such, with their conditions of access and participation easily accessible and expressed clearly and unequivocally.

Article 20(3) leaves untouched the rules issued by autonomous communities with exclusive consumer-protection powers. Article 20(4) prohibits sending commercial communications that disguise or conceal the identity of the sender on whose behalf the communication is made, that contravene article 20, or that induce recipients to visit Internet pages that contravene it.

A failure to comply with article 20 for commercial communications, promotional offers and contests is a minor infraction under article 38(4)(c). A minor infraction is fined up to 30,000 euros under article 39(1)(c).

Article 21(1) prohibits sending advertising or promotional communications by e-mail or another equivalent electronic means that the recipients have not previously requested or expressly authorized.

Article 21(2) lifts that prohibition where a prior contractual relationship exists, the provider lawfully obtained the recipient's contact data, and the provider uses it to send commercial communications about products or services of its own company that are similar to those originally contracted with the customer.

In every case the provider must offer the recipient a simple and free way to object to the processing of their data for promotional purposes, both when the data is collected and in each commercial communication. For e-mail, that means including a valid e-mail or other electronic address where the right can be exercised, and sending communications without that address is prohibited. Article 21(2) was amended by final provision 2.4 of Ley 9/2014, de 9 de mayo.

Article 22(1) lets the recipient revoke at any time the consent given to receive commercial communications by simply notifying the sender, and requires providers to set up simple and free procedures for that. Providers must also give accessible information by electronic means on those procedures. Mass sending of commercial communications, or insistent or systematic sending to the same recipient, that does not meet the requirements of article 21 is a serious infraction under article 38(3)(c).

Any other sending that does not meet the requirements of article 21 is a minor infraction under article 38(4)(d). A significant breach of the duty in article 22(1) to provide procedures for revoking consent is a serious infraction under article 38(3)(d). A breach of that duty that is not a serious infraction is a minor infraction under article 38(4)(h). A serious infraction is fined from 30,001 to 150,000 euros and a minor infraction up to 30,000 euros under article 39(1).

The Agencia Española de Protección de Datos imposes the sanctions for the infractions in article 38(3)(c) and (d) and article 38(4)(d) and (h).

Article 23(1) makes lawful the processing of personal data whose purpose is to avoid sending commercial communications to people who have expressed their refusal or opposition to receiving them. It allows general or sectoral information systems to be created by the associations and bodies referred to in Article 40(2) of Regulation (EU) 2016/679 that have high representativeness, in which only the data indispensable to identify the people concerned are included.

These systems may also include preference services through which people limit the commercial communications they receive to those from certain companies. Article 23(3) requires a controller, when a person tells it they do not want their data processed to send them commercial communications, to inform them of the existing advertising exclusion systems.

Article 23(4) requires anyone who intends to carry out direct marketing communications to consult first the advertising exclusion systems that may affect their action, and to exclude from the processing the data of the people who have expressed their opposition or refusal. Consulting the systems included in the list published by the competent supervisory authority is enough to meet that duty.

The consultation is not necessary when the person has consented, under the Organic Law, to receive the communication from whoever intends to send it. Final provision 4 of Ley 10/2025, de 26 de diciembre, rewrote article 23(1). Ley 10/2025 entered into force on 28 December 2025.

Article 96(1) requires every distance commercial communication to show its commercial nature unequivocally. Article 96(4) gives the consumer and user the right to object to receiving unwanted commercial offers by telephone, fax or other equivalent means. Within a pre-existing relationship, article 96(4) also gives the consumer and user the right to object to receiving commercial communications by e-mail or another equivalent electronic means.

Article 96(4) requires each commercial communication to inform the consumer and user of the simple and free means of objecting to receiving them. Article 94 applies the specific rules on information society services and electronic commerce to commercial communications by e-mail or other electronic means in addition to the consumer title, and gives those rules priority where the two conflict, except for the second paragraph of article 97(7).

Article 47(s) lists as an infraction the use of communication techniques that require the consumer's prior express consent or the absence of opposition, where that circumstance is missing. Article 48(2)(b) qualifies the infractions of article 47(s) as serious, unless they count as very serious under the third paragraph of article 48.

Article 49(1)(b) fines a serious infraction between 10,001 and 100,000 euros, and the fine may exceed that range up to four to six times the unlawful benefit obtained.

Article 76(1) gives end users the right to access information and content through their internet access service, to distribute them, to use and supply applications and services, and to use the terminal equipment of their choice, regardless of the location of the end user or the provider or of the origin or destination of the information.

Article 76(2) provides that agreements between internet access providers and end users on commercial and technical conditions, and any commercial practice of the provider, do not limit the exercise of those rights.

Article 76(3) requires internet access providers to treat all traffic equally, without discrimination, restriction or interference, regardless of the sender and receiver, the content accessed or distributed, the applications or services used or provided, or the terminal equipment used. Article 76(3) allows reasonable traffic management measures, which must be transparent, non-discriminatory and proportionate, and may not rest on commercial considerations.

Article 76(3) bars internet access providers from blocking, slowing down, altering, restricting, interfering with, degrading or discriminating between specific content, applications or services, except where necessary and only for as long as necessary to comply with law or court judgments, preserve the integrity and security of the network, or prevent imminent congestion.

Article 107(40) makes a failure to meet the obligations of article 76, and of Regulation (EU) 2015/2120, a serious infraction. A serious infraction is fined up to 2,000,000 euros under article 109(1)(c).

Article 114(1)(c) gives the Secretary of State for Telecommunications and Digital Infrastructures the sanctioning power in all cases other than those assigned to the Comisión Nacional de los Mercados y la Competencia and the Agencia Española de Protección de Datos, and over the infractions assigned to them where they fall within its own material scope.

Article 22(2) lets service providers use data storage and retrieval devices on recipients' terminal equipment on condition that the recipients have given their consent after being given clear and complete information about their use, in particular about the purposes of the data processing. The text refers to Ley Orgánica 15/1999 for the data-processing rules.

Ley Orgánica 3/2018 repealed Ley Orgánica 15/1999, without prejudice to its fourteenth additional provision and its fourth transitional provision. When technically possible and effective, the recipient's consent to accept the data processing may be given through the appropriate settings of the browser or other applications.

The consent rule does not prevent technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network or, to the extent strictly necessary, for providing an information society service the recipient expressly requested. Article 22(2) was amended by final provision 2.5 of Ley 9/2014, de 9 de mayo.

Using storage and retrieval devices without having provided the information or obtained the consent that article 22(2) requires is a minor infraction under article 38(4)(g). A repeat of that minor infraction, declared by a final decision within the three years before the sanction proceeding opens, is a serious infraction under article 38(3)(i). A minor infraction is fined up to 30,000 euros and a serious infraction from 30,001 to 150,000 euros under article 39(1).

Where the infraction is due to installing such devices through a provider's cession of its own spaces for displaying advertising, the advertising network or agent that manages the placement of the advertisements directly with the provider is also responsible if it has not taken measures to require the provider to meet the duties to inform and to obtain the user's consent.

The Agencia Española de Protección de Datos imposes the sanctions for the infractions in article 38(4)(g) and article 38(3)(i).

Article 197(1) punishes whoever, to discover another person's secrets or violate their privacy and without their consent, seizes their papers, letters, e-mail messages or any other documents or personal effects, intercepts their telecommunications, or uses technical devices for listening, transmission, recording or reproduction of sound or image, or of any other communication signal. The penalty is imprisonment of one to four years and a fine of twelve to twenty-four months.

Article 197(3) raises the prison term to two to five years if the data or facts discovered or the images captured are disseminated, revealed or ceded to third parties. Article 197(6) raises the penalties to their upper half if the acts are carried out for profit. Article 197 quinquies punishes a legal person that is responsible under article 31 bis for the offences in articles 197, 197 bis and 197 ter with a fine of six months to two years.

Article 201 makes a complaint by the aggrieved person or their legal representative necessary to prosecute these offences, and the complaint is not required when the offence affects general interests, a plurality of persons, or a minor or a person with a disability in need of special protection.

Article 2(1) applies the Act to companies that effectively carry out the listed basic services of general interest in Spain, namely water, gas and electricity supply and distribution, passenger transport by air, rail, sea and inland waterway and by bus or coach, postal services, electronic communications services and financial services.

Article 2(2) also applies the Act to other companies and groups that sell goods or provide services mainly to consumers and users in Spain and that, in the previous financial year, employed at least 250 people, exceeded 50 million euros of annual turnover or exceeded 43 million euros of balance. Article 2(6) makes the Act supplementary for the customer service of electronic communications services, which sectoral rules govern first.

Article 2(7) also applies the Act to the Administración General del Estado and its dependent bodies and companies. Article 16(3) requires that, where customer service is provided by telephone, the service have a specific numeric code, different from the code used to provide commercial services through the telephone channel, which is also specific to those services.

Article 16(4) requires the operator that receives the call to block voice calls from special-rate or smart-rate numbers assigned to services other than those in paragraph 3.

It also requires the operator that originates or receives a call to block, on its own initiative or at the request of the competent authority, any voice communication from a telephone number with indications of originating commercial calls without a specific numeric code or without complying with article 66(1) of Ley 11/2022.

Operators may use technical systems to identify such calls only after express authorization by reasoned resolution of the Secretaría de Estado de Telecomunicaciones e Infraestructuras Digitales. Operators must notify that Secretaría de Estado of the criteria they use to detect irregular traffic within one month of the Act's entry into force. Companies must adapt their customer service to the Act within twelve months of its entry into force.

For retail suppliers of electricity, gas and telephone services, article 16(2) to (4) does not apply as long as the company, or the group it belongs to, does not reach a 5 percent national market share and does not belong to the category of companies defined in article 2(2). A breach of the Act is sanctioned as a consumer infraction under the general consumer sanctions regime.

Article 65(1)(o) gives end users the right to prevent, by a simple and free procedure, the presentation of the identification of their line in the calls they make, or to the user who calls them. End users cannot exercise the right in article 65(1)(o) for emergency communications to the number 112 or to the emergency entities a royal decree determines.

Article 65(1)(p) gives end users the right to prevent, by a simple and free procedure, the presentation of the originating line identification on incoming calls, and to reject incoming calls on which that line does not appear identified.

Operators of number-based interpersonal communications services, and operators of public electronic communications networks, must meet the conditions a royal decree sets on the display, restriction and suppression of the originating and connected line identification. Article 107(30) makes a violation of the rights of consumers and end users set out in Title III a serious infraction. A serious infraction is fined up to 2,000,000 euros under article 109(1)(c).

Article 114(1)(c) gives the Secretary of State for Telecommunications and Digital Infrastructures the sanctioning power in all cases other than those assigned to the Comisión Nacional de los Mercados y la Competencia and the Agencia Española de Protección de Datos, and over the infractions assigned to them where they fall within its own material scope.

Article 66(1)(a) gives end users of publicly available number-based interpersonal communications services the right not to receive automated calls without human intervention, or fax messages, for commercial communication without having given their prior consent.

Article 66(1)(b) gives them the right not to receive unwanted calls for commercial communication, unless the user gave prior consent to receive such communications or the communication can rest on another legal basis listed in Article 6(1) of Regulation (EU) 2016/679. Article 66(5) applies the article without prejudice to Regulation (EU) 2016/679 and Ley Orgánica 3/2018, in particular the concept of consent in that legislation.

Final provision 6(2) brings the right in article 66(1)(b) into force within one year from the publication of the Act. A violation of the rights of consumers and end users set out in Title III is a serious infraction under article 107(30). A serious infraction is fined up to 2,000,000 euros under article 109(1)(c). Article 108(11) makes a failure to meet the public-law obligations set out in Title III a minor infraction. A minor infraction is fined up to 100,000 euros under article 109(1)(d).

The Agencia Española de Protección de Datos holds the sanctioning power for the serious infractions of article 107(30) and the minor infractions of article 108(11) when the data protection and privacy rights of end users recognized in article 66 are violated.

Article 96(2) requires the business, at the start of any telephone conversation with the consumer and user, to state its identity, or the identity of the person on whose behalf it calls, and the commercial purpose of the call. Article 96(2) also bars commercial telephone calls before 09:00, after 21:00, on public holidays and on weekends.

Article 96(3) makes the use by the business of an automated calling system without human intervention, or of fax, subject to the prior express consent of the consumer and user.

Article 96(3) gives the consumer and user the right not to receive commercial calls made by other systems without consent, where the consumer chose not to appear in the electronic communications directories, exercised the right that the data there not be used for advertising or commercial prospecting, or asked to join the common files excluding commercial communications. Article 96(5) requires an unwanted commercial offer made by telephone to be made from an identifiable telephone number.

Article 96(5) requires the caller to inform the consumer and user, on the first commercial offer, of the right to object to new offers and to obtain the reference number of the objection. Article 96(5) requires the sender to keep for at least one year the data of the users who objected, with the reference number given to each, and to make it available to the competent authorities.

Article 47(s) lists as an infraction the use of communication techniques that require the consumer's prior express consent or the absence of opposition, where that circumstance is missing. Article 48(2)(b) qualifies the infractions of article 47(s) as serious, unless they count as very serious under the third paragraph of article 48.

Article 49(1)(b) fines a serious infraction between 10,001 and 100,000 euros, and the fine may exceed that range up to four to six times the unlawful benefit obtained.

Article 62(1) presumes that there is no will to contract, and makes the contract void, in contracts concluded by telephone in breach of the rules on unsolicited calls. In any case, it deems that there is no consent to the call that leads to the contract if that consent was not obtained or renewed expressly in the two years before the communication.

For loans or credits with financial entities where the contract has been perfected and the sums lent delivered, a breach of the rules on unsolicited calls instead applies the statutory rate of interest to the contract, and an agreed rate that is lower is kept. Final provision 3 of Ley 10/2025, de 26 de diciembre, rewrote article 62(1). Ley 10/2025 entered into force the day after its publication.

Article 16(1) exempts providers of an intermediary service that consists of hosting data supplied by the recipient of the service from liability for information stored at the recipient's request, provided they have no actual knowledge that the activity or the stored information is unlawful or injures the goods or rights of a third party that can be compensated, or, if they have knowledge, act diligently to remove the data or make access to it impossible.

The article treats the provider as having actual knowledge when a competent body has declared the data unlawful, ordered its removal or the disabling of access to it, or declared that the injury exists, and the provider knew of that resolution. Article 16(2) withholds the exemption where the recipient of the service acts under the direction, authority or control of the provider. Final provision 2.18 of Real Decreto-ley 9/2024, de 23 de diciembre, suppressed the article.

A resolution of 22 January 2025 published the agreement of the Congreso de los Diputados repealing that decree-law, and the consolidated text records that the suppression has no effect.

Article 17(1) exempts providers of information society services that provide links to other content, or include directories or search tools for content, from liability for the information they direct recipients to, provided they have no actual knowledge that the activity or information they refer to or recommend is unlawful or injures the goods or rights of a third party that can be compensated, or, if they have knowledge, act diligently to delete or disable the link.

The article treats the provider as having actual knowledge on the same terms as article 16(1), when a competent body has declared the data unlawful, ordered its removal or the disabling of access to it, or declared that the injury exists, and the provider knew of that resolution. Article 17(2) withholds the exemption where the content provider that is linked to or located acts under the direction, authority or control of the provider that supplies the location.

Final provision 2.18 of Real Decreto-ley 9/2024, de 23 de diciembre, suppressed the article, and the agreement of the Congreso de los Diputados repealing that decree-law was published by a resolution of 22 January 2025.

Article 2(13) defines a video-sharing platform service as a service whose principal purpose, or that of a separable part, or whose essential functionality, is to provide the general public, over electronic communications networks, with programs, user-generated videos or both, over which the platform provider has no editorial responsibility, and whose organization the provider determines, among other means with automatic algorithms.

Article 89(1) requires providers of the service to take measures to protect minors and the general public from the audiovisual content that article 88 names. Article 88 names content that may harm the physical, mental or moral development of minors, and content that breaches article 4(2) or article 4(4) for the general public.

Article 4(2) bars audiovisual communication that incites violence, hatred or discrimination against a group or its members on grounds such as age, sex, disability, sexual orientation, gender identity, race, ethnic or social origin, language, religion, political opinion, nationality or birth.

Article 4(4) bars audiovisual communication that publicly provokes the commission of a crime, in particular a terrorism offence, child pornography or incitement to hatred, hostility, discrimination or violence on racist, xenophobic, sex, gender or disability grounds, as the Criminal Code provides. Article 89(1)(a) requires the provider to include the article 88 obligations in the terms of service of the platform and put them into practice.

Article 89(1)(b) to (d) require transparent, easy-to-use mechanisms for users to notify the provider of content that breaches the article 88 obligations, systems through which the provider explains to users what became of those notifications, and easy-to-use systems for users to rate content that may breach them.

Article 89(1)(g) to (i) require transparent, effective and easy-to-use procedures for handling users' complaints, effective media-literacy measures and tools, and access for users with an unresolved complaint to an out-of-court consumer dispute resolution procedure. Article 89(1)(e) requires age-verification systems for users, and article 89(1)(f) requires parental-control systems managed by the end user, in each case for content that may harm the physical, mental or moral development of minors.

Article 89(3) leaves the liability regime of article 73 of Real Decreto-ley 24/2021 and of Ley 34/2002 unaffected. Final provision 9 brings articles 88 to 91 into force three months after the Act's own entry into force. The Comisión Nacional de los Mercados y la Competencia (CNMC) supervises compliance with the Title V duties of video-sharing platform providers. A failure to take the measures in article 89(1)(a) to (d) and (f) to (i) is a serious infraction under article 158(4). The sections this entry groups came into force on different days.

Article 73(1) treats an online content-sharing service provider as carrying out an act of communication to the public when it offers the public access to protected works or other subject matter that its users uploaded, and so requires it to obtain the rightholders' authorization first.

Article 66(6) defines such a provider as an information society service provider whose main purpose, or one of whose main purposes, is to store and give the public access to protected works or other subject matter, in large number or with a high level of audience in Spain, uploaded by its users, which the service organizes and promotes for direct or indirect profit.

The same paragraph excludes services such as online encyclopedias without direct or indirect profit, scientific or educational repositories without profit, open-source software platforms, electronic communications providers, online marketplaces and business-to-business and cloud services that let users upload content for their own use.

An authorization the provider obtains also covers, within its scope and on the same terms, acts by its users that fall under article 20 of the Intellectual Property Act, provided the users do not act commercially or their activity does not generate significant revenue. A provider that is liable under article 73 does not benefit from the limitation of liability in article 16 of Ley 34/2002.

Where the rightholder grants no authorization, the provider is liable for unauthorized acts of communication to the public unless it shows that it made its best efforts to obtain an authorization, made its best efforts under strict industry standards of professional diligence to ensure that works for which rightholders supplied relevant and necessary information are unavailable, and acted expeditiously on a sufficiently substantiated notice to disable access to the notified works or remove them and made its best efforts to prevent their future upload.

For live content, the provider must disable access to it or remove it from its website during the broadcast of the live event. A lighter test applies to a new provider that has operated in the Union for less than three years and has annual turnover below 10,000,000 euros. Cooperation between providers and rightholders must not prevent users from uploading content that does not infringe, or that is used for quotation, analysis, commentary or criticism, review, illustration, parody or pastiche.

Providers have no general monitoring obligation, and must give rightholders who ask adequate information every six months on how their cooperation practices work. Providers must set up an agile and effective complaint and redress mechanism for users whose uploaded works are disabled or removed, and works under complaint are not kept accessible while it runs.

Complaints must be handled within 10 working days, and decisions to disable access to uploaded content or remove it are subject to review by people, without automated intervention. Rightholders who ask for access to specific works to be disabled or for the works to be removed must duly justify their request. The First Section of the Intellectual Property Commission mediates or arbitrates disputes over access to and removal of works under the article.

Where a provider is liable for unauthorized acts of communication to the public, the actions and procedures of articles 138 and following of the Intellectual Property Act apply, without prejudice to any criminal liability of the provider. Article 138 of the Intellectual Property Act lets the holder of the rights it recognizes seek an end to the unlawful activity and compensation for material and moral damages. Article 73 sits in Book Four of the decree-law, which transposes Directive (EU) 2019/789 and Directive (EU) 2019/790.

Article 135 makes producers liable for the damage the defects of the products they make or import cause. Article 136 defines a product as any movable good, even when attached to or incorporated in another movable or immovable good, together with gas and electricity. A 2023 article in Cuadernos de Derecho Transnacional says that authors are divided on the legal classification of software.

Article 137(1) treats a product as defective when it does not offer the safety that could legitimately be expected, taking account of its presentation, its reasonably foreseeable use and the time it was put into circulation. Article 137(2) treats a product as defective in any case if it does not offer the safety normally offered by the other units of the same series.

Article 138(1) makes the manufacturer or importer into the European Union of a finished product, of any element integrated in a finished product, or of a raw material a producer, in addition to the producer defined in Article 5. Article 138(2) treats the supplier as the producer where the producer cannot be identified, unless the supplier names the producer or its own supplier to the injured person within three months.

Article 146 makes a supplier liable as if it were the producer when it supplied the product knowing of the defect. Article 139 requires the injured person to prove the defect, the damage and the causal link between them.

Article 140(1) excuses the producer who proves that it did not put the product into circulation, that the defect probably did not exist when it did, that the product was not made for sale or any other form of distribution with an economic purpose and was not made, imported, supplied or distributed in the course of a professional or business activity, that the defect arose from compliance with mandatory rules, or that the state of scientific and technical knowledge when it put the product into circulation did not allow the defect to be discovered.

Article 140(3) denies the development-risk defense for medicines and for food and food products meant for human consumption. Article 129(1) covers personal damage, death included, and material damage only where it affects goods or services objectively intended for private use or consumption and used mainly by the injured person.

Article 141 deducts a franchise of EUR 500 from compensation for material damage and caps the producer's overall liability for death and personal injury caused by identical products with the same defect at EUR 63,106,270.96. Article 141(a) was modified by disposición final 17.2 of Ley 15/2015, in force from 23 July 2015. Article 143(1) sets a limitation period of three years from the date the injured person suffered the harm, provided the person responsible is known.

Article 144 extinguishes the injured person's rights ten years after the specific product that caused the damage was put into circulation, unless judicial proceedings began within that period. Article 130 makes clauses that exclude or limit the civil liability under the Book ineffective against the injured person. Article 132 makes the persons responsible for the same damage jointly and severally liable to the injured persons.

Article 142 excludes compensation under the chapter for material damage to the defective product itself. Article 128 leaves intact the injured person's other rights to compensation for contractual or non-contractual liability. Article 147 separately makes providers of services liable for damage to consumers and users, unless they prove that they met the regulatory requirements and the care the nature of the service demands.

The preamble to the consolidated text says that Book III harmonizes the civil liability regime for defective products set out in Ley 22/1994. Ley 22/1994 gave effect in Spanish law to Directive 85/374/EEC. Real Decreto Legislativo 1/2007 repealed Ley 22/1994. The preamble also says that Ley 22/1994 does not apply to products put into circulation before 8 July 1994.

Title I of Ley 11/2023 applies to consumer general-purpose computer hardware and operating systems, payment terminals, cash machines, ticketing and check-in machines, interactive information terminals, queue-management terminals, consumer terminal equipment for electronic communications and audiovisual access, and e-readers. Article 3(1) requires all products to meet Sections I and II of Annex I, and self-service terminals to meet Section I only.

Article 7(1) requires manufacturers to ensure that products are designed and manufactured in conformity with the accessibility requirements of Article 3. Article 7(2) requires manufacturers to draw up technical documentation and apply the conformity assessment procedure of Annex IV before placing a product on the market, and then to draw up an EU declaration of conformity and affix the CE marking.

Article 7(3) requires manufacturers to keep the technical documentation and the EU declaration of conformity for five years after the product is placed on the market. Article 7(7) requires the instructions and safety information to be in at least Castilian and the official language of the territory where the product is marketed, in clear language.

Article 7(8) requires a manufacturer that has reason to think a product is non-conforming to take corrective measures at once, withdraw it where appropriate, and inform the competent supervisory authority. Article 8 lets manufacturers appoint an authorized representative, whose mandate excludes the Article 7(1) duty and the drawing up of the technical documentation.

Article 9 requires importers to place only conforming products on the market and to check beforehand that the manufacturer applied the conformity assessment procedure and that the product bears the CE marking. Article 10 requires distributors to act in accordance with Title I and to check before marketing a product that it bears the CE marking and is accompanied by the necessary documents.

Article 11 treats an importer or distributor that places a product on the market under its own name or trademark, or modifies a product already on the market so that conformity may be affected, as the manufacturer. Article 12 requires economic operators to identify, on request, the operators that supplied them and those they supplied, for five years.

Article 16(1) allows an exception where compliance would require a significant change that substantially modifies the basic nature of the product or would impose a disproportionate burden, and the operator must still make the product as accessible as possible. Article 16(3) requires the assessment to be documented and kept for five years from the last marketing of the product.

Article 16(4) exempts microenterprises dealing with products from documenting their assessment, while they must give the authority the relevant information on request. Article 16(7) requires an operator that relies on the exception to send information to the authorities of the Member State where the product is placed on the market.

Article 17(1) presumes that products conforming to harmonized standards published in the Official Journal of the European Union meet the accessibility requirements of Article 3, to the extent those standards cover them. Article 22(1) requires a supervisory authority that finds a non-conforming product to ask the operator for corrective measures within a reasonable period and to require withdrawal from the market only if the operator has not taken them.

Article 22(4) requires the authorities to take provisional measures to prohibit or restrict marketing of the product, or to withdraw it, where the operator takes no adequate corrective measures in time. The transitional provision lets service providers keep using self-service terminals lawfully used before 28 June 2025 until the end of their economic life, and never beyond ten years after they were put into operation.

Article 32(2) of the Directive left Member States the option of a period as long as 20 years after the terminals' entry into use. Article 27(3) leaves it to the autonomous communities and the cities of Ceuta and Melilla to determine their supervisory authorities within their competences. Article 30(1) punishes breaches under the infringement and sanction regime of the relevant sectoral legislation and, where that legislation is silent, under Title III of Real Decreto Legislativo 1/2013.

Title I implements Directive (EU) 2019/882. The supervisory authorities act without prejudice to the powers that other authorities hold by virtue of complementary rules on the goods and services within Title I (Article 27(3)).

Real Decreto 143/2026 gives the technical support and coordination unit to the Dirección General de Derechos de las Personas con Discapacidad, which acts as supervisory authority where none has been designated and is the point of contact for receiving complaints and claims about compliance with Title I (Articles 2, 3(g) and 3(h)).

Where no harmonized standard has been published, Article 17(2) presumes conformity for products and services that meet the technical specifications the Commission adopts by implementing acts. Article 9(5) requires importers to supply instructions and safety information that meet easy-read criteria, and Article 10(2) requires distributors to check that the instructions are also offered in formats accessible to persons with disabilities where physically possible.

Article 29(2) lets consumers and their representatives, public bodies, associations and other legal persons with a legitimate interest go to the administrative bodies and courts to enforce the obligations of Title I.

Title I of Ley 11/2023 implements Directive (EU) 2019/882. Article 3(1) requires the services within Title I to meet the universal accessibility requirements of Sections III and IV of Annex I. Article 2(2) applies Title I to electronic communications services, services giving access to audiovisual media services, elements of passenger transport services, consumer banking services, e-books and their dedicated software, and e-commerce services provided to consumers.

The passenger transport elements are websites, mobile services, electronic tickets, transport information and interactive terminals, and urban, suburban and regional transport services come within Title I only for the interactive terminals element.

Article 2(4) excludes pre-recorded time-based media and office file formats published before 28 June 2025, online maps where the essential navigation information is accessible, third-party content outside the provider's funding, development and control, and archive content.

Article 13(1) requires service providers to guarantee that they design and provide services in conformity with the accessibility requirements of Title I. Article 13(2) requires them to include in their general conditions, or an equivalent document, the information that evaluates how the service meets the requirements of Article 3.

Article 13(7) requires a provider of a non-conforming service to take the necessary corrective measures and to inform the competent authorities of the Member States where it provides the service. Article 14(2) keeps the provider responsible for accessibility where a service or part of a service is subcontracted to a third party. Article 15 requires providers to ensure adequate and continuing training of their staff on the use of accessible products and services.

Article 3(3) exempts microenterprises that provide services from the service requirements and from any obligation relating to compliance with them. Article 16(1) allows an exception where compliance would require a significant change that substantially modifies the basic nature of the service or would impose a disproportionate burden, and the provider must still make the service as accessible as possible.

Article 16(7) requires a provider that relies on the exception to send information to the authorities of the Member State where the service is provided. Article 16(5) requires a provider that relies on the disproportionate burden exception to renew its assessment for each category or type of service when the service changes, when the authorities ask, and in any case every five years.

Article 16(6) bars the disproportionate burden exception for an operator that receives funding from sources other than its own resources to improve accessibility. Article 17(1) presumes that services conforming to harmonized standards published in the Official Journal of the European Union meet the accessibility requirements of Article 3, to the extent those standards cover them.

The transitional provision lets providers, until 28 June 2030, keep providing services with the products they lawfully used to provide similar services before that date, and lets service contracts concluded before 28 June 2025 continue unchanged until they expire, for no longer than five years from that date.

Article 4 treats a service that meets the accessible-information requirements of the European passenger rights regulations and of the railway interoperability acts as meeting the corresponding requirements of Title I, and applies any additional requirement of Title I in full. Article 29(1) requires the supervisory authorities to guarantee adequate and effective means of compliance through the procedures for suggestions, complaints and reports of breaches of the accessibility requirements.

Article 29(2) lets consumers and their representatives, public bodies, associations and other legal persons with a legitimate interest go to the administrative bodies and courts to enforce the obligations of Title I. Article 27(3) leaves it to the autonomous communities and the cities of Ceuta and Melilla to determine their supervisory authorities within their competences.

Article 30(1) punishes breaches under the infringement and sanction regime of the relevant sectoral legislation and, where that legislation is silent, under Title III of Real Decreto Legislativo 1/2013. The supervisory authorities act without prejudice to the powers that other authorities hold by virtue of complementary rules on the goods and services within Title I (Article 27(3)).

Real Decreto 143/2026 gives the technical support and coordination unit to the Dirección General de Derechos de las Personas con Discapacidad, which acts as supervisory authority where none has been designated and is the point of contact for receiving complaints and claims about compliance with Title I (Articles 2, 3(g) and 3(h)).

Where no harmonized standard has been published, Article 17(2) presumes conformity for products and services that meet the technical specifications the Commission adopts by implementing acts. Annex I, Section III, also requires the products used to provide the service to be accessible and any support services to give information on the service's accessibility in accessible modes of communication.

For electronic communications services, Section IV(a) requires emergency communications to be synchronized and transmitted to the most appropriate public safety answering point; for e-commerce, Section IV(g) requires identification methods, electronic signatures and payment services to be perceivable, functional, understandable and robust; and for e-books, Section IV(f) requires accessibility metadata.

Article 13(6) requires providers to give information showing that the process of providing and monitoring the service keeps it conforming, and Article 16(3) requires an economic operator to give the authority a copy of its assessment on request.

Article 2(2) of Directive (EU) 2019/882 lists electronic communications, audiovisual access, passenger transport, consumer banking, e-books and e-commerce services. Article 2(2)(g) to (i) of Ley 11/2023 adds the websites and mobile applications of electricity, water and gas supply to consumers, the websites and mobile applications of travel agencies and tour operators, and social networks.

Article 3(1) applies the universal accessibility requirements of Sections III and IV of Annex I to all services within Title I, and Section IV only to urban, suburban and regional transport services. The third additional provision requires the websites within Title I to meet at least the intermediate level of the generally recognized web content accessibility criteria, with standard UNE 139803 or its successor as the reference.

Article 3(2) requires the built environment used by clients of the services to meet the requirements of Annex III, in accordance with the sectoral legislation in force. Article 4(4) of the Directive lets Member States decide that the built environment used by clients of the services must meet the requirements of Annex III.

Article 15 requires providers to ensure adequate and continuing training of their staff on the use of accessible products and services, including the supply of information, advice, advertising and attention to diversity. Article 3(3) exempts microenterprises that provide services from the service requirements and from any obligation relating to compliance with them.

Article 27(3) leaves it to the autonomous communities and the cities of Ceuta and Melilla to determine their supervisory authorities within their competences. The supervisory authorities act without prejudice to the powers that other authorities hold by virtue of complementary rules on the goods and services within Title I (Article 27(3)).

Real Decreto 143/2026 gives the technical support and coordination unit to the Dirección General de Derechos de las Personas con Discapacidad, which acts as supervisory authority where none has been designated and is the point of contact for receiving complaints and claims about compliance with Title I (Articles 2, 3(g) and 3(h)). Article 3(2), Article 15 and the third additional provision reach every service within Title I, not only the services Article 2(2)(g) to (i) adds.

The eighteenth final provision brings the Law into force the day after its publication, with exceptions that do not include the third additional provision, so that provision has been in force since 10 May 2023; the websites it reaches are those within the scope of Title I. The single repealing provision repeals the fifth additional provision of Ley 34/2002 on information society services and electronic commerce.

Article 101(1) requires audiovisual communication service providers to improve the accessibility of their services progressively and continuously. Article 101(1) requires providers to develop accessibility plans of continuous improvement and to report them each year to the Comisión Nacional de los Mercados y la Competencia. Article 101(1) requires providers to guarantee that their websites, the content of those sites and their mobile applications become accessible gradually.

Article 101(3) guarantees the right of persons with disabilities to have emergency information broadcast in a clear, understandable and accessible way. Article 101(4) exempts providers with a low turnover and a low audience, in the terms regulations set.

Until those regulations exist, the fourth transitional provision treats annual revenues below two million euros as a low turnover and an audience below two per cent for linear television, and below one per cent for on-demand television, as a low audience. Article 102(1) requires free-to-air linear television providers to subtitle at least eighty per cent of their programmes and, in any case, those broadcast in prime time.

Article 102(1) requires them to broadcast at least five hours a week of programmes in sign language. Article 102(1) requires them to broadcast at least five hours a week of audio-described programmes. Article 102(2) requires public service free-to-air television providers to subtitle at least ninety per cent of the programmes they broadcast. Article 102(2) requires public service free-to-air television providers to broadcast at least fifteen hours a week of programmes that include sign language.

Article 102(2) requires public service free-to-air television providers to broadcast at least fifteen hours a week of audio-described programmes. Article 103(1) requires conditional access linear television providers to subtitle at least thirty per cent of their programmes. Article 104(1) requires on-demand television providers to subtitle at least thirty per cent of the programmes in their catalog.

Article 105(1) requires providers that broadcast third-party programmes to keep the accessibility measures those programmes carry when interoperable formats agreed in the self-regulation codes are used. Article 106 makes the Comisión Nacional de los Mercados y la Competencia the body that monitors compliance with these obligations for state-level services.

Article 158(11) classes as a serious infringement a failure, over an uninterrupted month, to meet the accessibility obligations of Article 102. Chapter II of Title VI of the Act enters into force one year after the Act's own entry into force.

Real Decreto 1494/2007 approves the regulation on the basic conditions for access by persons with disabilities to information society technologies, products and services and to the media. Article 2 binds the public administrations, telecommunications operators, information society service providers and the owners of media that provide services under Spanish jurisdiction.

Article 3(1) requires operators to make the reasonable adjustments that give persons with disabilities access to customer service. Article 3(2) requires operators to give subscribers with a visual disability who ask for it, in accessible conditions and formats, their contracts, invoices and the other information given to all subscribers. Articles 5 to 7, on website accessibility criteria and the certification of websites, are repealed.

The transitional provision makes the obligations enforceable from 4 December 2009 for all new products and services and from 4 December 2013 for existing ones that can be made subject to reasonable adjustments. For information or communication through the internet, Article 3(2) applies the regulation's rules for the pages of public administrations or with public funding, and Real Decreto 1112/2018 repealed Articles 5 to 7, which carried those rules.

Article 3 still refers to the regulation approved by Real Decreto 424/2005, to Ley 51/2003 and to Ley 32/2003, the General Telecommunications Law of 2003.

Article 9 of the regulation approved by Real Decreto 1494/2007 requires the trust services provided, and the products for end users used to provide them, to be accessible to elderly persons and persons with disabilities. Exceptionally, the duty does not apply where the trust product or service has no technological solution that allows its accessibility.

The first final provision of Real Decreto 1112/2018 gave Article 9 its current wording, and that decree entered into force the day after its publication, with exceptions that reach only websites and mobile applications. The article names no technical standard.

Article 95(3)(e) of Real Decreto Legislativo 1/2013 classes as serious, in the State's competence, a failure to comply with the accessibility rules for technologies and for products and services available to the public that obstructs or limits their regular use by persons with disabilities.

Real Decreto 1544/2007 sets the basic accessibility and non-discrimination conditions for access by persons with disabilities to the modes of transport. Article 8(4) requires platforms and intermediaries in the contracting of taxis to have an accessible means of communication through the web and a customer telephone number accessible through text.

Article 8 bis(6) requires intermediaries in the contracting of hired vehicles with driver to have the same accessible web channel and text-accessible telephone number. The second final provision of Real Decreto 193/2023 added both paragraphs, and Real Decreto 193/2023 entered into force the day after its publication. Neither paragraph names a technical standard.

The fourth additional provision makes a breach of the decree sanctionable under the legislation on infringements and sanctions in universal accessibility and non-discrimination. The sixth final provision of Real Decreto 193/2023 sets a later calendar for the basic conditions that decree establishes, and its text does not say whether that calendar reaches the paragraphs it added to Real Decreto 1544/2007.

Real Decreto 193/2023 regulates the basic accessibility and non-discrimination conditions for access to and use of goods and services available to the public. Article 3 applies it to relations between natural or legal persons, public or private, whose object is the provision of goods or the supply or provision of services available to the public.

Article 3 applies it in any case to goods and services that consumer law treats as of common, ordinary and general use or consumption and as durable goods. Article 4 excludes goods and services that, as public, public-utility or general-interest services, have a specific regulation that sufficiently guarantees non-discrimination and universal accessibility. The fifth additional provision keeps Real Decreto 1544/2007 and the European passenger rights regulations applicable to transport modes.

Article 14(1) requires suppliers of goods and services available to the public to give users and customers with disabilities information on their goods and services in accessible formats suited to their needs, whatever the channel.

Article 14(2) requires the owners of websites and mobile applications not funded from public money whose content concerns goods and services available to the public to incorporate the accessibility criteria of Real Decreto 1112/2018, and in particular priority A and AA requirements of standard UNE 139803.

Article 14(3) requires companies that provide services to the public in general of special economic importance and have publicly open websites to guarantee universal accessibility and to state the degree of accessibility of their goods and services. Article 14(4) defines those companies by reference to Article 2(2) of Ley 56/2007.

Article 14(5) guarantees persons with disabilities accessible access to information on the processing of their personal data and on the exercise of their data protection rights. Article 16(4) requires customer service and information services to be accessible to persons with disabilities.

Article 16(1) requires suppliers to offer persons with disabilities, in accessible format, the information on their consumer rights, including the right to complain, and where applicable the commercial offer, the contract and the invoice. Article 17(1) requires manufacturers of vending machines to facilitate accessibility, by universal design or by adapting machines already in use that are not at the end of their life.

Article 17(4) requires shops above a size threshold that offer electronic or technological equipment to customers to guarantee its accessibility, where no real impossibility exists and the adaptation is a proportionate reasonable adjustment. Article 18(2) requires the cash machines and other service terminals of financial and credit institutions to meet the accessibility requirements of the law transposing Directive (EU) 2019/882.

Article 18(3) requires the telephone and electronic customer service of financial, banking and credit institutions, insurers and insurance intermediaries to be accessible to persons with disabilities. Article 28 requires postal operators to guarantee accessibility and reasonable adjustments in collection, admission, distribution and delivery and in information, customer attention and complaints, including interactive self-service terminals and mobile applications.

Article 6 makes the accessibility obligations enforceable for goods and services that already exist, and requires reasonable adjustments where compliance is not possible. The sixth final provision makes the conditions enforceable on 1 January 2029 for the other new privately owned goods and services. For the other existing privately owned goods and services that can be made subject to reasonable adjustments, the adjustments are due before 1 January 2030.

Article 15 sanctions breaches in accordance with Title III of Real Decreto Legislativo 1/2013. Article 11(2) requires specific customer services to be accessible and staff to give personal guidance and help on request, and Article 11(3) requires that staff to be trained in attending persons with disabilities. Article 16(3) requires accredited consumer alternative dispute resolution entities to make their procedures and information and attention services universally accessible.

Article 21(5) requires private education centers and providers of non-formal education to make their training offer, materials and supports accessible to persons with disabilities.

Real Decreto 193/2023 regulates the basic accessibility and non-discrimination conditions for access to and use of goods and services available to the public. Article 3 applies it to relations between natural or legal persons, public or private, whose object is the provision of goods or the supply or provision of services available to the public.

Article 3 applies it in any case to goods and services that consumer law treats as of common, ordinary and general use or consumption and as durable goods. Article 4 excludes goods and services that, as public, public-utility or general-interest services, have a specific regulation that sufficiently guarantees non-discrimination and universal accessibility. The fifth additional provision keeps Real Decreto 1544/2007 and the European passenger rights regulations applicable to transport modes.

Article 14(1) requires suppliers of goods and services available to the public to give users and customers with disabilities information on their goods and services in accessible formats suited to their needs, whatever the channel.

Article 14(2) requires the owners of websites and mobile applications not funded from public money whose content concerns goods and services available to the public to incorporate the accessibility criteria of Real Decreto 1112/2018, and in particular priority A and AA requirements of standard UNE 139803.

Article 14(3) requires companies that provide services to the public in general of special economic importance and have publicly open websites to guarantee universal accessibility and to state the degree of accessibility of their goods and services. Article 14(4) defines those companies by reference to Article 2(2) of Ley 56/2007.

Article 14(5) guarantees persons with disabilities accessible access to information on the processing of their personal data and on the exercise of their data protection rights. Article 16(4) requires customer service and information services to be accessible to persons with disabilities.

Article 16(1) requires suppliers to offer persons with disabilities, in accessible format, the information on their consumer rights, including the right to complain, and where applicable the commercial offer, the contract and the invoice. Article 17(1) requires manufacturers of vending machines to facilitate accessibility, by universal design or by adapting machines already in use that are not at the end of their life.

Article 17(4) requires shops above a size threshold that offer electronic or technological equipment to customers to guarantee its accessibility, where no real impossibility exists and the adaptation is a proportionate reasonable adjustment. Article 18(2) requires the cash machines and other service terminals of financial and credit institutions to meet the accessibility requirements of the law transposing Directive (EU) 2019/882.

Article 18(3) requires the telephone and electronic customer service of financial, banking and credit institutions, insurers and insurance intermediaries to be accessible to persons with disabilities. Article 28 requires postal operators to guarantee accessibility and reasonable adjustments in collection, admission, distribution and delivery and in information, customer attention and complaints, including interactive self-service terminals and mobile applications.

Article 6 makes the accessibility obligations enforceable for goods and services that already exist, and requires reasonable adjustments where compliance is not possible. The sixth final provision makes the conditions enforceable on 1 January 2025 for new privately owned goods and services that the public administrations contract or supply. For existing goods and services of that kind that can be made subject to reasonable adjustments, the adjustments are due before 1 January 2026.

Article 15 sanctions breaches in accordance with Title III of Real Decreto Legislativo 1/2013. Article 11(2) requires specific customer services to be accessible and staff to give personal guidance and help on request, and Article 11(3) requires that staff to be trained in attending persons with disabilities. Article 16(3) requires accredited consumer alternative dispute resolution entities to make their procedures and information and attention services universally accessible.

Article 21(5) requires private education centers and providers of non-formal education to make their training offer, materials and supports accessible to persons with disabilities.

Article 2(4) of Ley 15/2022 applies its obligations to the public sector and to private natural and legal persons who reside, are or act in Spanish territory. Article 2(1) lists disability among the grounds on which nobody may be discriminated against. Article 3(1)(n) applies the Act to the internet, social networks and mobile applications. Article 3(1)(k) applies the Act to the access, offer and supply of goods and services available to the public outside private and family life.

Article 17(1) bars administrations, entities, businesses and individuals that offer goods and services to the public in a commercial or professional activity from discriminating in access to them on the grounds the Act lists. Article 6(1)(a) treats a denial of reasonable adjustments for persons with disabilities as direct discrimination.

Article 17(3) provides that websites and software applications are to tend to meet the accessibility requirements that secure equality and non-discrimination in access for users, in particular persons with disabilities and older persons. Article 27(1) requires whoever causes discrimination to repair the damage by compensation and, where possible, by restoring the victim to the situation before the incident. Article 27(1) presumes moral damage once discrimination is established.

Article 27(2) makes employers and providers of goods and services liable for discrimination within their organization when they have not met the obligations of Article 25(1). Article 30(1) requires the defendant, once the claimant provides well-founded indications of discrimination, to supply an objective and reasonable justification, sufficiently proved, of its measures and their proportionality.

Article 46(2) applies to persons with disabilities, in every case, the infringement and sanction regime of Real Decreto Legislativo 1/2013. Article 40 creates the Autoridad Independiente para la Igualdad de Trato y la No Discriminación to protect and promote equal treatment in the public and the private sector. Ley 15/2022 entered into force on the day after its publication in the Boletín Oficial del Estado.

Article 78 makes the infringement and sanction regime of Title III of Real Decreto Legislativo 1/2013 basic, leaves the autonomous communities to define infringements and sanctions in their own competence, and applies the State regime where a community has none. Article 79 applies the regime to the natural or legal persons responsible for the infringement.

Article 81(3)(b) classes as a serious infringement a failure to meet accessibility requirements and a refusal to adopt reasonable adjustments. Article 81(3)(a) classes as serious discriminatory acts or omissions that treat a person with a disability less favorably than another person in a comparable situation. Article 81(3)(c) classes as serious the failure to comply with a specific administrative requirement from the competent bodies.

Article 81(3)(e) classes as serious the public exposure of a person on account of disability, including in digital environments, to provoke mockery, when it is not a criminal offence. Article 81(4) classes disability-related harassment as very serious, as well as repeated failure to meet specific administrative requirements and any pressure on the authorities.

Article 83 sets fines from a minimum of EUR 301 to a maximum of EUR 1,000,000, with minor infringements not exceeding EUR 30,000 and serious infringements not exceeding EUR 90,000. Article 84 grades sanctions by criteria including intent, negligence, turnover or income, the number of persons affected, recidivism and the economic benefit obtained.

Article 85(1) requires the competent bodies to propose, beside the sanction, a ban on applying for official aid in the sector, for a period of one year at most for a serious infringement and two years at most for a very serious one. Article 94 gives the central State administration the power to sanction where the conduct extends beyond the territory of one autonomous community.

Article 96 sets the fine bands for conduct within the central State administration's competence at three degrees for each class of infringement. Article 95(3)(e) classes as serious, in the State's competence, the failure to comply with the accessibility rules for technologies, communication media and products and services available to the public that obstructs or limits their regular use by persons with disabilities.

Article 95(4)(f) classes as very serious, in the State's competence, a failure to comply with the legal accessibility rules in the planning and design of products and services available to the public that prevents their free and regular use by persons with disabilities. Article 82 sets the limitation periods for infringements at one year for minor, three years for serious and four years for very serious ones.

Article 85(2) adds for a very serious infringement the proposed withdrawal, cancellation or suspension of official aid already granted in the sector. Article 92 lets the authority publish a final sanction for a serious or very serious infringement, with the name of the infringer. Article 95(3)(i) makes three identical minor infringements within three months a serious one, and Article 95(4)(h) makes three serious infringements within a year a very serious one.

Article 95(4)(g) classes as very serious, in the State's competence, a failure to comply with the legal accessibility rules that prevents or seriously hinders the exercise of fundamental rights by persons with disabilities. Article 102 lets the competent body, for a very serious infringement that gravely endangers the health or liberty of persons with disabilities, order the temporary closure of the establishment or the suspension of the service as a precautionary measure.

The procedure starts ex officio, including on a complaint (Article 101(1)), and persons with disabilities, their families and their representative organizations are interested parties in it (Article 89(1)).

Article 71(1)(b) of Ley 9/2017 bars from contracting with public sector entities a person finally sanctioned for a serious infringement in equal opportunities and non-discrimination of persons with disabilities, and Article 72(2) has the scope and duration of the bar set by the sanctioning resolution or, where it is silent, by a procedure held for the purpose.

Article 29(1) obliges every natural or legal person that, in the public or the private sector, supplies goods or services available to the public to observe equal opportunities for persons with disabilities and to avoid direct or indirect discrimination. Article 29(2) leaves freedom of contract unaffected, including the choice of the other party, provided the choice is not determined by disability.

Article 29(3) admits differences of treatment justified by a legitimate purpose where the means are appropriate, proportionate and necessary. Article 63 treats a failure to meet accessibility requirements and to make reasonable adjustments as a violation of the right to equal opportunities. Article 2(m) provides that failing to make a reasonable adjustment is discrimination on grounds of disability.

Article 66(2) judges whether an adjustment is reasonable by its costs, the discriminatory effect of not adopting it, the structure and characteristics of the person or entity that must implement it, and the possibility of public funding or other aid.

Article 24 and the third additional provision, paragraph 1(a), set 4 December 2009 for new ones and 4 December 2013 for existing ones that can be made subject to reasonable adjustments as the latest dates from which the basic accessibility and non-discrimination conditions for information society technologies, products and services and for any social communication medium are enforceable.

For goods and services available to the public that are privately owned and not contracted or supplied by the administrations, the third additional provision, paragraph 2, sets 4 December 2015 for new ones and 4 December 2017 for existing ones that can be made subject to reasonable adjustments as the latest dates of enforceability. Article 86 gives a person who suffers disability discrimination in access to goods and services a right to compensation for the damage suffered.

Article 75(2) provides that the compensation is not limited by a ceiling fixed in advance and that moral damage is compensated even without economic loss. Article 76 lets legal persons authorized to defend collective rights and interests act in a proceeding on behalf of the persons who authorize them.

Article 77(1) requires the defendant, once the claimant shows well-founded indications of discrimination, to supply an objective and reasonable justification of its conduct that is sufficiently proved. Article 74(1) lets consumers and users with disabilities submit equal-opportunity and non-discrimination complaints in consumer matters voluntarily to the consumer arbitration system.

Real Decreto 193/2023, which regulates those conditions for goods and services available to the public, makes them enforceable for the other new privately owned goods and services on 1 January 2029 (sixth final provision).

Article 126(3) requires that, where a contract is intended for use by natural persons, whether the public or the staff of the contracting administration, the technical specifications be drafted, except in duly justified cases, so as to take into account the United Nations Convention on the rights of persons with disabilities and the criteria of universal accessibility and universal design.

Where the specifications cannot be defined to take those criteria into account, Article 126(3) requires sufficient reasons to be given. Where mandatory accessibility requirements exist under a legal act of the European Union, Article 126(3) requires the specifications to be defined by reference to them.

Article 25(1) of Ley 11/2023 makes the accessibility requirements of Annex I mandatory accessibility requirements under Article 126.3 of Ley 9/2017 for the products and services within Title I. The transitional provision applies Article 25(1) to tenders whose call is published after Title I came into force, and to procedures with no call only where the contracting body starts the procedure after that day.

Article 25(1) of Ley 11/2023 gives the Annex I requirements the same status under Article 45.2(a) of Real Decreto-ley 3/2020, which governs public procurement in certain sectors.

Book One of Real Decreto-ley 3/2020 regulates the award of works, supply and service contracts by public and private entities that carry out activities in the water, gas and heating, electricity, transport, ports and airports, postal and extraction sectors, above set value thresholds.

Article 45(2)(a) requires the technical specifications to be defined, as far as possible, taking into account the accessibility criteria for persons with disabilities or design for all users, except in duly justified cases. Where mandatory accessibility requirements are set by a legal act of the European Union, Article 45(2)(a) requires the technical specifications to be defined by reference to them.

Additional provision 4 requires the admissible means of communication, the design of the instrumental elements and the conduct of the procedure to take universal accessibility and design for all into account, as those terms are defined in Real Decreto Legislativo 1/2013.

A video-sharing platform provider must set up and operate age verification systems for users, with respect to content that can harm the physical, mental or moral development of minors, that in every case prevent minors from reaching the most harmful audiovisual content, such as gratuitous violence or pornography. The provider must also offer parental control systems managed by the end user for that content.

Personal data of minors collected or generated under these measures may not be processed for commercial purposes, such as direct marketing, profiling or behavioral advertising. The Act took effect on the day after its publication in the Boletín Oficial del Estado. Its articles 88 to 91 took effect once a period of three months had passed from the Act taking effect. Failing to take the age verification measure is a very serious infringement.

A very serious infringement by a video-sharing platform service carries a fine of up to 60,000 euros for a service with revenue under 2 million euros, and up to 3 percent of its revenue in the Spanish audiovisual market, capped at 1,500,000 euros, for a service with revenue of 50 million euros or more. The Comisión Nacional de los Mercados y la Competencia supervises compliance.

Classifies unsolicited access to pornography as a form of violence against minors and requires public administrations to develop educational campaigns on the risks of pornography exposure and to promote parental control mechanisms, but does not impose a direct age verification obligation on pornography providers themselves.

Sets 14 as the minimum age at which a minor can independently consent to processing of personal data for an information society service, including registering for a social media account. Parental or guardian consent is required for processing based on consent for users under 14.

Press publishers and news agencies established in Spain hold an exclusive reproduction and making-available right over their press publications for online use by information-society service providers, per Article 129 bis(1). The right does not reach hyperlinking, per Article 129 bis(6)(b).

It also does not reach the use of single words or very short, insignificant extracts that does not harm the publishers' investment and does not affect the effectiveness of the rights, per Article 129 bis(6)(c). The rights last two years counted from 1 January of the year following the date of publication of the press publication, per Article 130(3).

Negotiated authorizations must follow good-faith, due-diligence, transparency and free-competition principles, and disputes go to the Comisión de Propiedad Intelectual rather than a designated bargaining process.

Periodic compilations of press articles in the form of reviews or press digests are treated as quotations, but where a compilation consists essentially of mere reproduction of articles and is made for commercial purposes, an author who has not expressly objected is entitled to equitable remuneration, and where the author has expressly objected the activity is not covered by this limit, per Article 32.1.

Since the 2021 amendment, a content-aggregation service provider that makes press text or text fragments available to the public needs the Article 129 bis authorization from the rights holder, per Article 32.2. A search engine's keyword-search tool is exempt from authorization and remuneration when its display is strictly limited to what is needed for non-commercial search results and includes a link to the source page.

No authorization from an intellectual-property rights holder is needed for reproductions of legitimately accessible works made for text and data mining purposes, per Article 67(1) of Real Decreto-ley 24/2021's own Fourth Book. That general exception does not apply where rights holders have expressly reserved the use of their works through machine-readable means or other adequate means, per Article 67(3), which is the opt-out.

Article 67(4) provides that reproductions made by research organizations and cultural-heritage institutions for text and data mining for scientific research are stored with an adequate level of security and may be kept to verify research results.