When we can help
- Your business, practice or clinic handles data about clients, patients or staff and you want to know if it complies.
- You have received a request from the Spanish Data Protection Agency.
- Someone has exercised a right over their data (access, erasure, objection) and you are not sure how to respond.
- You have had a security breach or lost personal information.
How we help
- Reviewing what data is handled, on what basis and for how long, and documenting it.
- Drafting privacy policies, information notices, processor contracts and records of processing.
- Assessing a breach and, where required, notifying the authority and the people affected.
- Answering rights requests and defending you in proceedings before the Agency and the courts.
What to have at hand
- A simple description of what data you collect and why.
- Any policies, notices and supplier contracts you already have.
- Communications from the Agency or from individuals, with the date you received them.
- For a breach: what happened, when you found out and which systems are affected.
Frequently asked questions
Do I have to comply if I am self-employed or a small business?
The rules apply to anyone who handles personal data in their activity, whatever their size. Which measures are needed depends on the data and how it is used. We assess this at the first consultation.
What should I do if I have had a data breach?
Where the authority must be told, the deadline is 72 hours from becoming aware (art. 33 GDPR). Contact us as soon as possible so we can assess it and record what happened.
What documentation does the GDPR require from a business?
It depends on the activity, but typically: a record of processing activities (art. 30 GDPR, with exceptions for small organisations), privacy information for data subjects (arts. 13 and 14), contracts with processors (art. 28), a breach protocol, a procedure for handling data-subject rights and, for high-risk processing, an impact assessment (art. 35). We review what applies to you.
Am I required to have a data protection officer?
Only in the cases set out in art. 37 GDPR: public authorities, processing that requires regular and systematic monitoring of individuals on a large scale, or large-scale processing of sensitive data. The Spanish data protection act (LOPDGDD, art. 34) lists further cases. If it is not mandatory, you can appoint one voluntarily. It is assessed case by case according to your activity.
How long do I have to respond to a data access or erasure request?
One month from receiving the request, extendable by two further months if it is complex or there are many requests, informing the person within the first month (art. 12.3 GDPR). If you will not comply, you must explain why and mention the right to complain to the Spanish data protection authority (AEPD). Keep an internal procedure and record the dates of receipt and reply.
What should I do if the AEPD opens proceedings or asks me for information?
Read the notice carefully: it states the time limit to reply, which runs from the date of notification. Gather the documentation on the processing in question and do not reply without advice. A well-documented reply can be decisive; penalties are graded according to the circumstances of the case (art. 83 GDPR). Seek advice as soon as possible.
Does my website need a cookie notice and a privacy policy?
If you use cookies that are not strictly necessary (analytics, advertising), you must inform users and obtain prior consent, with a clear option to accept or reject (art. 22.2 of the Spanish e-commerce act, LSSI, and AEPD guidance). If you collect data through forms, you must provide information under arts. 13 and 14 GDPR. And if you carry out an economic activity, the site must show the owner's details (art. 10 LSSI).
How much does it cost to bring my business into line with data protection law?
It depends on the size of the business, the data it handles and what is already in place. We provide a written quote before starting, after reviewing your situation, so you know what is and is not included. How the first consultation works is explained when you request it.
General information, not advice. Each case needs individual study. Deadlines and rules may change.