News in the Spanish Data Protection Law

31 May 2023

On May 9, a modification of the Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), was published on the occasion of the correction of GDPR errors, published in the "Official Journal of the European Union”. These changes entered into force on 05/10/23.


  • Elimination of the warning from the catalogue of sanctions.

The warning is no longer considered a sanction to be imposed on Data Controllers and Processors and is now considered an appropriate measure, independent of the disciplinary procedure but processed in a similar way.

This provision is included within the corrective powers of the control authorities and is applicable to any type of subject:

  • Public administrations
  • Legal persons
  • Physical persons

The purpose of this change is the implementation of the warning procedure as a specific, more flexible and quick procedure, with a maximum duration of six months, which will allow speeding up the response to claims presented by citizens.

- Extension of the term of the actions of the Data Protection Agency.

In order to provide a better response due to the increase and complexity of the cases presented to the Agency, the current reform contemplates the following deadlines:

  • Disciplinary procedure: goes from 9 to 12 months
  • Previous investigation actions: go from 12 to 18 months

These processing deadlines, as well as those for admission to processing regulated by article 65.5 and the duration of the preliminary investigation actions, will be automatically suspended when information, consultation, request for assistance or mandatory pronouncement of a body of the European Union must be collected or one or more control authorities of the Member States.

-           Implementation of new research methods through digital systems.

The recent reform introduces a new article that allows research, not only in person, but also through actions through digital systems (videoconference or other similar systems).

To carry out this investigation, the secure transmission and reception of the documents and information exchanged will be guaranteed and the use of these systems will occur when determined by the Agency, requiring the inspected party's agreement with the date and time of its development.

-           Application of obligatory models for the presentation of claims.

The possibility is established for the Agency to implement said claim submission models in all areas in which it has competence, regardless of whether or not the interested parties are obliged to interact electronically with the Public Administrations.

These models will be published in the BOE and in the electronic headquarters of the AEPD. They will be mandatory one month after their publication, with the aim of facilitating and simplifying the presentation of claims.

Madrid, May 31st, 2023.

Author: Laura Gobernado Guzman. Partner at MG Abogados, Madrid, Spain.

© 2023 Alliance of Business Lawyers. All rights reserved.

Terms of Use | Privacy Policy