Agencia Española de Protección de Datos (AEPD)
Spain’s data protection authority, among the EU’s most frequent issuers of GDPR fines.
Overview
Spain’s data protection authority, among the EU’s most frequent issuers of GDPR fines. As a member-state authority it applies EU law within its country alongside national legislation, coordinating with its EU-level counterpart.
Its powers include supervising and examining the organisations it oversees and investigating and imposing penalties.
In Spain (the European Union) it works at member state level. Instruments connected to it in this glossary include GDPR.
Check the official sources below for legal scope, applicable dates and exceptions. This entry is an explanatory reference, not legal advice.
Why it matters
Its examinations and expectations often decide outcomes more than the text of the law.
Who it affects
Organisations in privacy data protection in the European Union.
Where it sits
Ten linked steps connect where you operate to the proof that you complied.
- 01Jurisdiction
- 02Industry
- 03Activity
- 04Authority
- 05Regulation
- 06Requirement
- 07Guidance
- 08Control
- 09Evidence
- 10Enforcement
Connections
The terms most closely tied to AEPD. Select one to open it.
What to do about it
- 1Confirm whether AEPD has power over you, and through which licence, registration, membership or activity.
- 2Follow its rules, guidance and enforcement publications as they are issued.
- 3Map each obligation it creates to a control with a named owner.
- 4Keep examination-ready evidence for its highest-risk obligations.
From requirement to evidence.
Regulation Layer tracks its publications in the change feed, maps its obligations to your controls, and links its enforcement actions to the obligations they cite.
Request early access →