Loading
Loading
We use strictly necessary cookies to run this site, and analytics cookies to understand how it's used. See our Privacy Policy for details.
Spain enforces GDPR through the AEPD and the LOPDGDD. NIS2 transposition remains pending as of September 2026, the draft Cybersecurity Coordination and Governance Act, approved by the Council of Ministers in January 2025, is still in parliamentary process, and the EU has referred Spain to the CJEU over the delay.
Content reviewed 2026-09-08 , informational, not legal advice. Confirm current requirements with the authority linked below or your own counsel.
EU-wide regulation on personal data processing, directly applicable in Spain without transposition.
SourceSpain's national data protection act of 5 December 2018, which adapts GDPR nationally and establishes the AEPD's powers.
Source72 hours
GDPR Article 33 applies uniformly: notify the AEPD without undue delay and, where feasible, within 72 hours of becoming aware of a breach.
Notify: Agencia Española de Protección de Datos (AEPD)
SourcePublished legal maximums, not a personalized estimate, not legal advice.
GDPR Article 83(5)
Up to €20,000,000 or 4% of total worldwide annual turnover of the preceding financial year, whichever is higher
SourceApplicable , as of 2026-09-08
Not yet transposed as of September 2026. Spain missed the 17 October 2024 EU deadline; the draft Ley de Coordinación y Gobernanza de la Ciberseguridad, which would transpose NIS2 and create a new National Cybersecurity Center (CNC), was approved by the Council of Ministers on 14 January 2025 but remained in parliamentary process as of August 2026. The European Commission sent Spain a reasoned opinion in May 2025, and on 8 July 2026 referred Spain (with Ireland, France, and the Netherlands) to the CJEU for failure to notify complete transposition.
SourceAgencia Española de Protección de Datos(AEPD)
Visit authority siteNo, not as of September 2026. The draft Ley de Coordinación y Gobernanza de la Ciberseguridad was approved by the Council of Ministers in January 2025 but remains in parliamentary process. The EU referred Spain to the CJEU on 8 July 2026 over the delay.
The draft law creates a new National Cybersecurity Center (Centro Nacional de Ciberseguridad, CNC) to coordinate cybersecurity policy and act as Spain's point of contact with EU institutions. This body does not yet exist, it will only be established once the law is enacted.
The AEPD (Agencia Española de Protección de Datos), Spain's independent GDPR supervisory authority, which also implements the national LOPDGDD.
Talk to us about scoping an engagement around your specific regulatory context.
