Iberian Lawyer TV: Data Protection Rules And Cloud Computing Creating New Risks

In June 2017, the Spanish government published a preliminary draft of the Organic Law's 78 Articles on the Protection of Personal Data, which would repeal the Spanish Data Protection Law...

On September 11, AEPD issued a final decision against a social media company in connection with its data processing activities and issued a fine of €1.2 million.

A draft bill promotes minors' positive use of digital environments in areas such as education or social interaction

On November 12, 2015, the Spanish Supreme Court prohibited (source document in Spanish) the maintenance and transfer of files blacklisting workers.

In March, the Spanish DPA (Agencia Española de Protección de Datos) adopted a resolution on the Right To Be Forgotten.

The Spanish government has decided to pass this Royal Decree-law as an interim measure which is permitted by the GDPR.

On June 19, the Spanish DPA published the guidelines for managing security breaches and providing notification in compliance ...

El Tribunal de Justicia de la Unión Europea examina los límites del tratamiento de datos personales en el contexto de las sanciones antidopaje, analizando cuándo la publicación de nombres de deportistas sancionados, las sustancias prohibidas utilizadas y los detalles de las infracciones constituye un tratamiento de datos de salud. La sentencia establece criterios específicos sobre la ponderación individual que deben realizar los responsables del tratamiento antes de publicar es

The Final First Provision of Organic Law 15/1999, of 13 December for Protection of Personal Data (LOPD) contemplates the competence of the Government to approve or modify the reglementary provisions necessary for application and development of the Law. Eight years have had to pass for us to see, at least, a draft Royal Decree which – under the aegis of the above mentioned Final Provision – approves the Regulation developing the LOPD.

On February 23 2026, the Spanish supervisory authority (AEPD) published an article containing recommendations on operational sovereignty when processing personal data. This follows a major incident on October 20 2025, where a cloud provider experienced technical issues in the United States which affected services globally.