Spanish companies operate under GDPR with Spanish-specific implementation through the LOPDGDD (Ley Organica 3/2018). The Agencia Espanola de Proteccion de Datos (AEPD) is the Spanish data protection supervisory authority. For Spanish tech companies, DPO appointment carries both the general GDPR test and a sector-specific Spanish extension.
The short answer: a Spanish company appoints a DPO under GDPR Article 37, or under the LOPDGDD’s own sector list if it falls within one of the named categories, notifies the AEPD through its online portal, and can fill the role on a service contract rather than a hire.
Engage Compliance acts as the named DPO for Spanish companies, notified to the AEPD, with the same senior person on the account throughout. Experience across 100+ startups and enterprises including Amazon, Coinbase, and Robinhood.
Key takeaways
- Spanish companies operate under GDPR plus the LOPDGDD (Organic Law 3/2018), supervised by the AEPD.
- The LOPDGDD adds a sector-specific DPO list (healthcare, financial services, insurance, telecoms, large-scale profiling) beyond the general Article 37 test.
- DPO appointment is notified to the AEPD through its online sede electronica.
- Named DPO tiers start From €1,000 per month, against €60,000 to €100,000 a year for a full-time Spanish hire.
Does a Spanish company need a DPO
Under GDPR Article 37, appointment is required for a public authority, for core activities requiring large-scale regular and systematic monitoring, or for large-scale processing of special category data.
The LOPDGDD’s own list reaches further: healthcare providers, credit institutions and insurers, telecommunications companies, and information society services that build large-scale user profiles must appoint a DPO under Spanish law specifically, whether or not the general GDPR test is met. Many Spanish SaaS, fintech, and healthtech companies fall inside this list directly, or reach the general test as they scale.
AEPD notification
DPO appointment is communicated to the Agencia Espanola de Proteccion de Datos through its online sede electronica, using the dedicated DPO communication form. The filing includes the DPO’s contact details and the identity of the controller or processor. We complete this as part of onboarding and give you the confirmation for your own records.
Spanish language considerations
Formal AEPD filings and most data subject communications are expected in Spanish. For an outsourced arrangement without a Spanish-speaking DPO, translation and Spanish-language coordination need to be addressed for those specific touchpoints; the day-to-day advisory work runs the same as anywhere else.
What it costs
- DPO Foundation, From €1,000 per month.
- DPO Partner, From €2,500 per month.
- DPO Complete, From €4,500 per month.
- Privacy Advisory, From €600 per month, advice without a named appointment.
A full-time senior DPO in Spain typically runs €60,000 to €100,000 a year, higher in Madrid and Barcelona, plus several months of recruitment in a market where privacy specialists are scarce. See the outsourced DPO cost guide for the full comparison.
Why Engage Compliance
You work with a senior DPO directly, the same person throughout, notified to the supervisory authority. Experience across 100+ startups and enterprises including Amazon, Coinbase, and Robinhood. Your DPO is an expert, never a junior handoff. This Spanish engagement follows the same outsourced DPO services model we run everywhere, and every engagement carries professional indemnity and cyber insurance.
Sources and references
- Regulation (EU) 2016/679, General Data Protection Regulation, Articles 37, 38 and 39
- Organic Law 3/2018, of 5 December, on the Protection of Personal Data and guarantee of digital rights, Boletin Oficial del Estado
- Agencia Espanola de Proteccion de Datos (AEPD)