GDPR compliance software for a business operating in Spain should support the work your team actually has to perform: maintaining processing records, applying Spanish rules, handling requests, following up risks and producing usable evidence. The right choice depends on your activities and organisation. Employee numbers, funding stage and the nationality of a software vendor do not establish a reliable purchasing rule.
This guide is for English-speaking buyers who need to evaluate a Spanish compliance programme. It explains how to turn GDPR and LOPDGDD requirements into practical demonstrations and contractual questions. It does not rank vendors or present unverified market prices. References were checked on 30 September 2026; product capabilities and charges should be confirmed in the offer you receive.
Start with the Spanish operation, not a product catalogue
Identify the legal entities and activities the proposed tool will cover. A Spanish subsidiary may manage employee information locally while using a group customer platform. A small service business may process health information, whereas a larger organisation may have comparatively straightforward administrative records. Those differences matter more than a generic label such as “SME package”.
List the people who will contribute: operations, human resources, security, legal advisers and, where designated, the data protection officer. Establish who can decide that an activity is lawful and who can change its technical implementation. A platform cannot resolve unclear responsibilities simply by assigning every outstanding task to one administrator. It should support the decisions the organisation has agreed to make.
Use the GDPR software buyer’s guide to turn this scope into a shortlist of requirements. Distinguish essential tasks from convenient extras. For example, exporting a complete Spanish processing record may be essential, while a sophisticated dashboard may have little immediate value if the records feeding it are incomplete.
Understand what the LOPDGDD adds
Spain’s Organic Law 3/2018, the LOPDGDD, supplements the GDPR in specific areas. Relevant examples include additional DPO designation cases, blocking of data, workplace digital rights and rules for security cameras. The Spanish-language comparison of LOPDGDD and GDPR helps local colleagues identify these differences. A vendor’s assertion that it “covers Spain” needs to be tested against the activities concerned.
Do not assume that national coverage means a larger library of generic templates. Ask how a Spanish rule changes the actual process. Can the system distinguish blocking from ordinary deletion? Can it record why a statutory DPO category applies? Does an employee policy describe the company’s monitoring practices, or merely repeat legal headings? The useful result is an accurate decision and an operational instruction.
Spain also has sectoral requirements that a general GDPR platform may not address. A healthcare organisation, energy retailer or regulated financial business needs to identify its additional obligations separately. A software procurement specification should state which requirements are included and which will be handled by existing systems or advisers. Avoid treating a general compliance subscription as an assurance that every national rule has been assessed.
Require records that reflect activities and roles
Create a fictional processing activity during the demonstration. Include its purpose, people, data, recipients, service providers and retention arrangements. Ask the vendor to show how the record changes when a supplier is replaced or a new purpose is proposed. The test is whether the information remains coherent and understandable, not whether the software can generate a large document quickly.
Article 30 contains different record requirements for controllers and processors. A business acting in both capacities should be able to maintain that distinction. The explanation of controllers and processors helps frame the question. Adding a lawful-basis field is useful, but the vendor should not present every extra management field as an expressly required minimum under Article 30.
Being below 250 employees does not create a general exemption. The Article 30(5) derogation does not cover non-occasional processing, processing likely to result in a risk to individuals, or processing involving Article 9 special categories or Article 10 conviction and offence data. Assess the activities in question. Routine payroll should not disappear from the programme because an eligibility wizard identifies the company as small.
Check whether a DPO is required on the actual facts
Review the GDPR Article 37 triggers and the additional list in LOPDGDD Article 34. The Spanish list includes, for example, insurers and reinsurers, private security companies and certain healthcare centres. The healthcare provision expressly excludes professionals practising individually in the circumstances it describes. Other entries have their own conditions, such as large-scale profiling by information-society service providers.
The list should not be expanded by analogy. An insurance intermediary is not automatically included merely because insurers are named. Nor does every small organisation using analytics automatically satisfy a statutory profiling trigger. Where designation is required, the relevant conditions must be documented. The Spanish DPO guide, written in Spanish, can support discussion with local advisers and the proposed DPO.
Article 34(3) requires communication of appointments and cessations within ten days to the AEPD or the competent regional authority, including voluntary designations. Software can help track that administrative action, but it cannot become the DPO. Evaluate whether the officer can obtain information, record advice, maintain appropriate confidentiality and report concerns without being responsible for decisions that create a conflict of interests.
Evaluate workplace documentation with human resources
LOPDGDD Articles 87–91 require a more specific review than a generic employee privacy notice. Article 87 concerns employer-provided digital devices, use criteria and safeguards for privacy, including participation by worker representatives in preparing the criteria. Article 88 addresses digital disconnection and an internal policy prepared after hearing the representatives. The relevant output needs to match the organisation’s actual arrangements.
For workplace video and geolocation, examine the purposes, information duties and limits in Articles 89 and 90. A template does not authorise unrestricted monitoring. Ask the vendor to demonstrate how the policy records the system used, the affected people, the decisions made and the information supplied. The tool should allow legal review and correction rather than force every employer into the same monitoring model.
Include a practical change scenario. Suppose a delivery business changes its vehicle-tracking supplier and introduces a new supervisor dashboard. The review should cover what the dashboard reveals, who can access it and whether existing employee information remains accurate. Updating the supplier name in a register may be necessary, but it is not the complete assessment of the changed practice.
Test rights handling beyond a dedicated form
The AEPD’s guidance on exercising rights explains the need for accessible arrangements. Under LOPDGDD Article 12, a request cannot be refused simply because the person used another means. Ask how staff incorporate a letter or an appropriate customer-service message, preserve the original receipt date and identify the action requested when no legal terminology is used.
The GDPR requires action without undue delay and, at the latest, within one month. An extension of two further months may be necessary because of the complexity and number of requests; its reasons must be communicated within the first month. If no action is taken, Article 12(4) requires reasons and information about complaint and judicial remedies without delay and no later than one month. A deadline alert should support those decisions, not replace them.
Run a fictional access request involving several systems and a document containing third-party information. Examine search coverage, identity checks where reasonably needed, review of the copy and secure delivery. A case should not close merely because a task was sent to a supplier. Ask what evidence shows that the answer was delivered and that any promised correction or deletion was actually performed.
Distinguish blocking, deletion and retained evidence
LOPDGDD Article 32 regulates blocking associated with rectification or erasure. It reserves data for specified potential liabilities during the relevant limitation periods, with restrictions on processing and access, followed by destruction subject to applicable exceptions. This is different from simply hiding a customer record and different from restriction under GDPR Article 18. The software should represent the decision accurately.
A useful demonstration starts with a person who asks for an account to be erased while some documents must remain available for a valid legal reason. Ask how the organisation separates those documents from marketing data and how access changes. The data retention policy guide helps define purposes, triggers and responsibilities. A legal hold should have a defined scope and review process, rather than freezing all information indefinitely.
The rights case itself also needs a retention decision. It may be necessary to demonstrate receipt and response without retaining every delivered document forever. Ask about permissions, audit logs, exports and backup restoration. A restored database should not silently reactivate a deleted profile or an opt-out. The implementation needs a documented process for reconciling restored information with decisions already taken.
Treat cameras and website choices as separate tasks
For security cameras, LOPDGDD Article 22 includes specific limits and information arrangements. Images generally have a maximum retention period of one month, with a defined exception for evidence of acts affecting people, property or installations and a corresponding duty to make the images available to the competent authority. This does not justify a universal “keep all video for a month” configuration or indefinite retention after any incident.
The relevant notice must identify the controller and communicate the required information through the applicable arrangement. Workplace cameras also require the separate Article 89 assessment. Ask whether a template explains its scope and whether the organisation can record a shorter retention period, access restrictions and the reason for a particular extraction. The programme should distinguish these decisions from the physical installation of the equipment.
Website consent technology solves a different problem. A consent management platform comparison can help assess choices, integration and records for a website, but a banner does not maintain the entire GDPR programme. Conversely, buying a programme-management tool does not demonstrate that the site’s trackers respect user choices. Test each component against its own task and applicable Spanish electronic-communications rules.
Examine risk assessment and DPIA work
A data protection impact assessment is required where the GDPR conditions for likely high risk are met, taking relevant criteria and authority lists into account. It is not mandatory merely because a company has purchased software or reached a funding round. Nor can a vendor promise that a questionnaire will settle every difficult threshold decision automatically.
Use a scenario requiring a reasoned assessment, such as a new employee-monitoring arrangement. Observe how the product records necessity, proportionality, risks to people and proposed measures. A colour or numerical score should lead to an explanation and assigned actions. Where high residual risk triggers Article 36, prior consultation with the supervisory authority must take place before the processing begins.
Check how assessments stay connected to changes in operations. If the supplier, data categories or access model changes, someone should consider whether the analysis remains valid. Ask whether the tool supports that review and whether the organisation can recover the reasoning after export. An assessment that exists only as a completed wizard may be difficult to maintain or explain later.
Assess the platform as a supplier in its own right
The software may hold employee requests, security details and commercially sensitive records. Review the vendor’s role, access model and processing terms. Where Article 28 applies, the arrangement requires a written contract or another binding Union or Member-State legal act, including electronic form. Instructions, confidentiality, security, assistance, subprocessing and inspection arrangements must reflect the actual service.
EU hosting is relevant, but it does not automatically eliminate international-transfer questions. Examine support access, subprocessors, backup locations and the entities receiving data. An adequacy decision and an Article 46 mechanism have different conditions. The answer should describe the contracted configuration, rather than rely solely on the seller’s nationality or the address of its primary data centre.
At the end of the service, the controller’s choice of return or deletion and deletion of existing copies must be addressed, subject to retention required by Union or Member-State law. Ask for an export containing decisions, attachments, dates and relationships between records. Test whether an independent reader can understand it without the platform. A subscription cancellation confirmation is not evidence that all exit obligations were completed.
Compare options and costs without arbitrary size cut-offs
The AEPD’s Facilita RGPD tool is designed for low-risk processing. Its documents require adaptation and do not establish automatic compliance. Assess the actual processing against its scope; the existence of any HR software or digital product is not, by itself, a universal disqualification. Some businesses need additional processes or specialist support for activities outside that scope.
Compare a maintained set of documents, a specialist tool and a broader platform against the same requirements. A general software comparison can help identify categories, but verify current capabilities directly. There is no reliable rule that an enterprise suite becomes appropriate at a particular headcount. A group platform may be sensible if its local configuration and responsibilities can be maintained.
For each quote, separate subscriptions, users, entities, modules, implementation, integrations, support and exit. Build a realistic change scenario and ask how the price responds. The EU software-cost guide helps structure those questions. Estimate internal work as well: a cheaper tool can require more coordination, while a larger suite can impose administration that the team cannot sustain.
Use enforcement context without buying through fear
The AEPD publishes decisions and resolutions, while the Spanish-language sanctions tracker offers a way into the subject. A historical fine needs its decision, appeal history and scope to be understood. It should not become an invented average loss or a claim that purchasing a particular product prevents enforcement.
The GDPR fines overview explains the broader framework. For procurement, focus on the evidence your organisation can produce: accurate records, decisions, responses and completed corrections. No product is inherently “AEPD-approved” because it exports a document called a registro. A regulator can examine whether the actual practice matches the documentation and whether the applicable obligations have been met.
Language should also follow the people using the information. Spanish output and support may be essential for local teams, while other audiences need another language they understand. An English group interface is not automatically unlawful, and Spanish wording alone does not make a notice clear. Test both the quality of the content and its accessibility in the real workflow.
Decide through a complete trial and an accountable owner
Before signing, run a complete fictional process: create a record, identify a Spanish requirement, assign an action, handle a rights request and export the resulting evidence. Have the intended users perform the work. Record which functions are delivered, which require configuration and which are only planned. Essential commitments should appear in the agreement, with a way to check their delivery.
For operations elsewhere, the country guides for Italy, Portugal and Ireland help identify questions for local review. Shared software can support consistent management while preserving national distinctions. Assign an owner for updates, supplier changes and unresolved legal questions so that the programme remains useful after implementation.