Regulation and data
AEPD (Spanish Data Protection Agency)
The AEPD, the Spanish Data Protection Agency, is the independent administrative authority that enforces the GDPR and the LOPDGDD in Spain: it handles complaints, inspects and sanctions, receives breach notifications and the appointment of data protection officers, and publishes guides and tools.
Also known asAgencia Española de Protección de Datos · Spanish supervisory authority · AEPD
How it reaches a centre
It acts with full independence from the public authorities (art. 44 of the LOPDGDD), and anyone can lodge a complaint with it if they believe their data are being mishandled (art. 77 of the GDPR). For a colegio mayor (a Spanish hall of residence with a formative programme) or a student residence, contact usually starts in one of these ways:
- A complaint from a resident or their family. Before admitting it, the Agency may pass it to the centre's data protection officer or, if there is none, to the centre itself, which then has one month to reply (art. 65.4).
- A breach the centre notifies through the Agency's online office, within the 72 hours of art. 33 of the GDPR: see personal data breach.
- Notice of the data protection officer, within ten days of their appointment or removal (art. 34.3).
- A prior consultation, when an impact assessment shows a high risk the centre cannot bring down (art. 36 of the GDPR).
Worth knowing
It is not always the competent authority. The regional data protection authorities, in the autonomous communities that have one, supervise processing by their public sector and by those who provide services on its behalf (art. 57). A private residence generally answers to the AEPD; a centre that depends on a public university may answer to the authority of its region. The AEPD's website holds the forms, the list of notified data protection officers and its guides by subject.
Sources
Related terms
- LOPDGDDThe LOPDGDD is Spain's Organic Act 3/2018 of 5 December on the Protection of Personal Data and the guarantee of digital rights. It does not replace the GDPR: it adapts Spanish law to it, fills in what the regulation leaves to each State and recognises digital rights. It has been in force since 7 December 2018.
- Personal data breachA personal data breach is any breach of security that results in the accidental or unlawful destruction, loss or alteration of personal data, or to their unauthorised disclosure or access (art. 4.12 of the GDPR). Losing a staff phone with residents' data, or sending a list by mistake, are breaches.