Spanish Data Protection Agency: Functions, Competences, and Legal Framework

The Spanish Data Protection Agency (AEPD) is the public authority that supervises the application of personal data protection laws in Spain. As a supervisory authority, it does not replace companies or public administrations in their daily responsibilities: it monitors compliance with obligations and provides channels for individuals to exercise their rights. Its role combines supervision, guidance, and administrative action.

Independence is crucial because it allows the Agency to exercise its control functions without being subordinate to the entities it supervises. The AEPD Statute, approved by Royal Decree 389/2021, regulates its nature, autonomy, functions, and organization. Therefore, it is advisable to avoid describing it as a ministerial department or an entity that decides outside the law: it is a public body subject to a legal framework and administrative procedures.

In practice, the AEPD is the national reference point for data protection issues within its scope of competence. It is not a court or a private advisory service: it can process complaints and exercise the powers recognized by legislation, but it does not offer an automatic guarantee that every complaint will result in a sanction or financial compensation for the complainant.

The main framework combines the General Data Protection Regulation (GDPR), applicable in the European Union, with Organic Law 3/2018 on Personal Data Protection and Digital Rights Guarantee (LOPDGDD). European legislation establishes common principles and obligations; Spanish law complements this framework and specifies aspects of national application. The AEPD supervises compliance but does not unilaterally create the entire set of privacy rules.

The Royal Decree 389/2021 serves another function: it approves the Agency's Statute. It should not be confused with the GDPR or the LOPDGDD, which regulate data processing and corresponding rights. This distinction helps to correctly read a resolution or guide: one norm may set obligations for controllers and processors, while the Statute establishes how the authority responsible for supervising certain obligations is organized.

The application of these rules depends on the case: what data is processed, who determines the purposes and means of processing, what activity is carried out, and which authority is competent. Therefore, a general guide serves to orient, but it does not replace the legal analysis of a specific situation nor does it allow deducing, without further data, that every questioned conduct infringes the law.

The AEPD controls the application of regulations, promotes public awareness of risks and rights related to data processing, and facilitates information on the exercise of these rights. It can also investigate and apply corrective measures within the competences attributed to it by law. Therefore, the Agency does not limit itself to sanctioning: prevention and guidance are part of its work.

To understand the roles, it helps to separate three actors: the data subject, whose data is processed; the controller or processor, who must fulfill the corresponding obligations; and the supervisory authority, which supervises the system and can intervene according to its powers. The AEPD does not decide for the company what data is necessary in each process nor assumes for it the obligation to document and protect the processing.

The distinction is useful for both individuals and professionals. A person requesting access to their data first addresses the entity that processes it; an organization designing a process must evaluate its obligations before a complaint exists; and the Agency comes into play as a supervisor or institutional channel when the corresponding conditions are met.

The AEPD can control the application of the GDPR and other relevant data protection laws. Supervision does not equate to an immediate fine: the authority can analyze available information, investigate facts, and, depending on circumstances and procedure, adopt measures within its competences. The objective of a specific action depends on the alleged infringement and what the file can substantiate.

The GDPR provides for administrative sanctions that can reach, for certain infringements, 20 million euros or 4% of total annual worldwide turnover, applying the higher amount according to relevant rules. This is a maximum legal limit, not a standard rate or a prediction of a case's outcome. The specific amount depends on legal factors and substantiated circumstances; it cannot be calculated solely based on a complaint being filed.

The maximum figure should not be indiscriminately attributed to any conduct or entity. To assess real risk, an organization must identify processing operations, applicable obligations, compliance measures, and possible effects of an infringement. For citizens, the practical decision is to provide facts and evidence; for a company or administration, it is to document how they comply and respond traceably to requests and requirements.

When a person wants to access, rectify, or delete their data, or exercise other recognized rights, the first step is usually to address the data controller. It is advisable to do so through a channel that allows keeping record of the request and date. The AEPD indicates that, to complain about an insufficient response or lack of response, it is important to have previously approached the responsible entity and be able to prove it.

If there are indications or evidence of a possible violation, the complaint can be filed through the Agency's electronic headquarters. It is useful to explain the facts in order, identify the entity, describe which right was exercised, and attach the original request, the response received, and any pertinent document. A concrete and documented exposition facilitates the Agency's understanding of what is requested and what elements support the complaint, although it does not by itself determine its admission or outcome.

The AEPD points to a maximum period of three months to decide on the admission or inadmissibility of a complaint. This period refers to that initial decision; it should not be confused with a promise of final resolution of the merits within the same period. For general doubts, the Agency publishes information and attention channels. The useful route is, therefore: exercise the right before the entity, keep the proof, and consult official instructions before filing the complaint.

The AEPD is part of the European system of data protection authorities, which share the GDPR framework and cooperate in cross-border matters. The European Data Protection Board (EDPB) contributes to the consistency of the Regulation's application, but does not replace national authorities in the ordinary processing of all cases. Cooperation becomes relevant when processing affects persons or activities in more than one country.

The existence of a Spanish authority does not mean the AEPD is always the only competent one. In cross-border processing, cooperation mechanisms and rules to determine which authority acts as lead may intervene; furthermore, Spain has regional authorities in specific scopes. Competence depends on the controller, the processing, and applicable rules, so it is not enough for a person to reside in Spain to conclude, without more, which authority will handle a file.

Sanctioning statistics compare registered activity, but do not by themselves measure the severity of infringements, the quality of supervision, or the probability of sanction for a particular entity. Similarly, European cooperation does not imply that all countries apply identical procedures in every detail: the common framework is combined with different authorities and circumstances. For a real case, it is prudent to check competence and current official instructions.

The AEPD website gathers information on rights, complaints, functions, instructions, and orientation materials. These resources help translate general obligations into practical questions: what information to communicate, how to respond to a request, or what elements to document. For companies, self-employed, and administrations, they are a starting point to review processes; for individuals, they clarify what steps to follow and what proofs to keep.

When consulting a guide, one must check its date, recipients, and scope. A document focused on a specific technology may explain relevant risks, but does not replace general obligations nor turn each recommendation into an independent rule. Likewise, an instruction or resolution must be read according to its context and legal nature: not all published materials have the same effect.

A simple check before acting is to ask three questions: what processing and what data are involved?, which entity is responsible and what response was received?, and which norm or official resource explains the next step? If it is an organization, add a fourth: can it be demonstrated with documents who accesses the data, what it is used for, and how requests are managed? The AEPD is useful precisely as an authority and source of guidance, but compliance remains the responsibility of each controller.