DPO for Spanish Companies

Yes. Engage supports both Data Protection Officer work and Article 27 representative work, as two separate products scoped to what you need. See Representative Services.

Under GDPR Article 37, a DPO is required where core activities consist of large-scale regular and systematic monitoring of data subjects, or of large-scale processing of special category data. Spain's LOPDGDD (Organic Law 3/2018) adds its own list of sectors, including health centers legally required to keep patient records (except individual practitioners), credit institutions, insurers, network and electronic-communications operators that habitually and systematically process personal data at large scale, and information society services that profile users at scale, that must appoint a DPO regardless of whether the general GDPR test applies.

DPO appointment is communicated to the AEPD through its online sede electronica, using the dedicated DPO communication form, and includes the DPO's contact details and the identity of the controller or processor. The AEPD maintains a register of communicated DPOs.

Spain's Organic Law 3/2018 transposes GDPR into Spanish law and adds a sector-specific DPO list that goes beyond the general Article 37 test: health centers legally required to keep patient records (except individual practitioners), credit institutions, financial credit establishments, investment firms and insurers, network and electronic-communications operators that habitually and systematically process personal data at large scale, and large-scale user-profiling information society services must appoint a DPO as a matter of Spanish law, independent of the general GDPR criteria.

Generally yes for formal AEPD notifications and most data subject communications. Spanish is expected for formal filings, so a non-Spanish-speaking outsourced arrangement needs to address translation and Spanish-language coordination for those specific touchpoints.

A full-time senior DPO in Spain typically runs €80,000 to €150,000 a year, at the upper end in Madrid and Barcelona, plus several months of recruitment. An outsourced DPO through Engage Compliance starts From €1,000 per month for DPO Foundation, with Privacy Advisory From €600 per month.

Quite possibly. An information society service that builds large-scale user profiles falls inside the LOPDGDD's own sector list and must appoint a DPO under Spanish law, whether or not the general GDPR test is met. Other SaaS companies reach the general Article 37 test as they scale.

The LOPDGDD list is set by sector and activity, not size: health centers legally required to keep patient records (except individual practitioners), credit institutions, financial credit establishments, investment firms and insurers, and network and electronic-communications operators that habitually and systematically process personal data at large scale must appoint a DPO under Spanish law. Many fintechs (for example payment or e-money firms) are not on the list and reach the general Article 37 test instead, so it is the first thing to check.

Yes. The role can be filled on a service contract rather than a hire. Engage Compliance acts as the named DPO for Spanish companies, notified to the AEPD, with the same expert on the account throughout and no junior handoff.

We do. We complete the DPO communication to the AEPD through its sede electronica as part of onboarding and give you the confirmation for your own records. The AEPD keeps a register of communicated DPOs.

A named DPO notified to the AEPD, the same person on your account throughout, a plan for the Spanish-language touchpoints such as formal filings and data subject communications, and insurance behind the engagement. Every Engage engagement carries professional indemnity and cyber insurance.

Our plans are set out in the "What it costs" section on this page next to the cost of a full-time Spanish hire, and the outsourced DPO cost guide has the full comparison, including recruitment time.