🇪🇸Organic Law 3/2018 on Data Protection and Guarantee of Digital Rights
Organic Law 3/2018 on Data Protection and Guarantee of Digital Rights
Spain applies this national law alongside the GDPR. The summary below concentrates on the national overlay so that the GDPR baseline is not duplicated.
Status: Current official BOE consolidated text checked 22 August 2026
Citation: Organic Law 3/2018 of 5 December
Regulator: Spanish Data Protection Agency (AEPD) and competent regional authorities
Source basis: Official BOE consolidated PDF downloaded and checked on 22 August 2026.
How the national law fits with GDPR
LOPDGDD supplements the GDPR and creates national rules for lawful processing presumptions, deceased persons, DPOs, enforcement and a broad title of digital rights.
National additions and variations
- Article 7 allows a minor older than 14 to base processing on the minor’s consent, subject to laws requiring parental assistance for the relevant act; consent for younger children requires the holder of parental authority or guardianship.
- Articles 20-24 cover credit-information systems, business transactions, video surveillance, advertising-exclusion systems and internal reporting systems.
- Article 3 and Article 96 govern specified access, rectification, deletion and digital-estate directions concerning deceased persons.
- Articles 34-37 add national DPO designation, qualification and AEPD-notification rules.
- Title X includes workplace device privacy, digital disconnection, workplace video/audio monitoring, geolocation, collective bargaining and other digital rights.
The BOE consolidated text is informational; the officially published amending instruments control if there is a conflict.
Operational approach
First maintain the GDPR control set. Then document whether this country is in scope and apply the national controls to the affected people, systems and processing. Keep article-level evidence for child consent, employment, special-category or criminal data, research, electronic communications, identifiers, surveillance and any rights restriction relied upon.
Do not treat GDPR compliance as automatic compliance with LOPDGDD. Record the national trigger, the responsible owner, the local procedure and the current official source reviewed.