Your data protection rights in Spain and what you can demand

Key rules

• Reply deadline: A company must answer a data rights request within one month, and can extend this by two further months only if it tells you why within the first month.
• Cost: Using your rights is free, unless a request is clearly unfounded or excessive.
• Marketing: You can object to direct marketing at any time without giving a reason.
• Complaints: If a company ignores or refuses you, you can complain to the AEPD and go to court.

Which rights do you have?

You have strong rights over the personal data any company holds about you. You can:

• Be informed about what the company does with your data.
• Access your data and get a copy.
• Correct data that is wrong.
• Erase your data (the "right to be forgotten").
• Restrict how your data is used.
• Take your data with you (portability) in a usable format.
• Object to certain uses, including marketing.
• Refuse purely automated decisions, including profiling, that significantly affect you.

Spanish law adds a few more, such as rights over the data of deceased people and the right to switch off from work messages outside working hours.

How fast must a company reply?

The company must reply without undue delay, and the deadline is the one in the key rules above. The extension only counts if the company explains the reasons within the first month. Silence is not a "yes". It is a breach, and you can complain to the AEPD.

The rights are free. If the company has real doubts about who you are, it can ask for proof of identity, and the month generally starts once it has what it needs. If you are already logged into your account, extra ID is usually not justified. The company cannot use this check to delay or discourage you.

What can a company refuse?

A company can refuse, or charge a reasonable administrative fee, only if your request is clearly unfounded or excessive, for example repeated over and over. It must be able to show why. A repeat request within six months is not automatically excessive.

If it refuses, it must tell you within one month. The notice must give its reasons, and say you can complain to the AEPD and go to court.

Deletion has extra limits. A company may keep data it needs to:

• meet a legal duty, such as tax or accounting records;
• protect freedom of expression and information;
• serve public health or the public interest;
• support archiving, research or statistics;
• make, exercise or defend legal claims.

Data kept for these reasons is blocked. Only courts and public authorities can reach it, and it is destroyed after the limitation period.

Marketing is the easy one

You can object to direct marketing at any time, free, and you do not need to give a reason. The company must then stop using your data for marketing. It may keep a minimal record so it does not contact you again. Marketing emails must also offer an easy way to opt out. The Robinson list helps cut down advertising in general.

How to send your request

Send it to the company, using the contact details in its privacy policy: usually a privacy email, a web form or a postal address. If the company has a data protection officer, you can write to that person instead.

No special form is required, and even a request to customer service counts. But a written request that leaves a record is safest: an email with confirmation, registered post or a web form receipt. Say which right you are using and give details that identify you. A Spanish message you can adapt is below, with a checklist of the steps.

Companies outside Spain

The rules cover companies based in the EU, and also non-EU companies that sell to people in the EU or monitor them. Non-EU companies in this group generally must appoint a representative in the EU, so you can write to that representative.

If the company is based in another EU country, you can still complain to the AEPD in Spain. It passes your complaint to the lead authority in that country, for example Ireland's, and stays your contact point. For a non-EU company with no EU base, the AEPD can act directly.

If the answer is no

If you get no reply or a refusal you disagree with, you can file a claim with the AEPD. The decision and timeline below show the options.

Choosing between options

What can you do when a company charges a fee or refuses your request?

• Accept the refusal: The company shows the request is manifestly unfounded or excessive, or it must keep the data for a legal duty such as tax or accounting records.

• Challenge the fee or refusal: The company charges you without showing the request is excessive, or gives no reasons. A repeat request within six months is not automatically excessive.

• File a complaint with the AEPD: The company does not reply within one month, or the refusal notice gives no reasons or no mention of your right to complain.

Requests are free. A company can charge a reasonable fee or refuse only if it can show the request is manifestly unfounded or excessive, and it must tell you the reasons within one month.

Timeline and deadlines

• Send your request and keep proof that you sent it: at the start

• If the company asks for proof of identity, send it so the clock can run: as soon as the company asks

• The company must answer your request: within one month of receiving it

• The company can extend the time only if it tells you why: within the first month, for up to two further months

• If the company refuses, it must tell you the reasons and your right to complain to the AEPD and go to court: without delay and within one month

• If you get no answer or a refusal, file a claim with the AEPD, Spain's data-protection agency: after the month has passed without a reply, or after a refusal

Documents you need

• A copy of your ID document, only if the company has reasonable doubts about who you are. Send it only when asked, and not if you are already logged into your account.

Checklist

• Send your request to the company's data protection officer if it has one.

• Attach a copy of your ID if the company asks for it.

• Say clearly that you object to direct marketing if you want it to stop, and give no reason.

Data access or deletion request message in Spanish

Copy the message below, fill in the blanks, and send it in a way you can prove. You do not need a special form, and the request is free unless it is clearly unfounded or excessive.

Before you send it

• Attach a copy of your passport, DNI or NIE. If someone sends it for you, attach proof that they can act for you.
• Delete the right you do not need, or keep both if you want to see and delete your data.
• Say exactly what the request covers, such as one account, one service or one period.
• Add any supporting documents, such as an invoice or a screenshot.
• The company can ask for more information only if it has reasonable doubts about who you are.

Message in Spanish

Asunto: Solicitud de ejercicio de derechos de protección de datos

A la atención del Delegado de Protección de Datos / Responsable del tratamiento:

Datos del responsable: [nombre de la empresa u organismo y dirección]

Yo, [nombre y apellidos], con [DNI / NIE / pasaporte] número [número], con domicilio a efectos de notificaciones en [dirección completa], correo electrónico [correo electrónico] y teléfono [teléfono],

EXPONGO:

Que, de conformidad con el Reglamento (UE) 2016/679 (RGPD) y la normativa española de protección de datos, ejerzo mi derecho de:

• Acceso (artículo 15 del RGPD): solicito que me confirmen si tratan mis datos personales y, en caso afirmativo, que me entreguen una copia de ellos, junto con información sobre los fines del tratamiento, los destinatarios, el plazo de conservación y el origen de los datos.
• Supresión (artículo 17 del RGPD): solicito que eliminen mis datos personales y que lo comuniquen a quienes se los hayan cedido.

El alcance de mi solicitud es el siguiente: [describa qué datos o qué relación con la empresa, por ejemplo: "mi cuenta de cliente con el correo... y los pedidos realizados entre enero de 2024 y hoy"].

SOLICITO:

1. Que atiendan mi solicitud de forma gratuita y por escrito, en el plazo de un mes desde su recepción.
2. Que me envíen la respuesta a la dirección o al correo electrónico indicados arriba.
3. Que, si no atienden mi solicitud, me expliquen los motivos y me informen de mi derecho a presentar una reclamación ante la Agencia Española de Protección de Datos.

Adjunto copia de mi documento de identidad [y, si procede, otros documentos: ______].

En [ciudad], a [día] de [mes] de [año].

Firma: ______________________ [nombre y apellidos]

How to send it so you can prove it

Keep a copy of the signed message and of the proof of sending. These options are listed from strongest to weakest:

1. Burofax with certified content. This is the strongest proof, because Correos certifies both what you sent and that it was delivered.
2. Registered post with acknowledgement of receipt (carta certificada con acuse de recibo). It proves delivery.
3. A certified email service. It gives you a certificate of sending and receipt.
4. The company's own web form or data protection officer form. Save the receipt or registry number it gives you.
5. Ordinary email. This is the weakest option. Save the sent message, the attachments and any read receipt.

Any method that shows what you sent and on what date is generally accepted. Burofax and certified services carry the most weight if there is a dispute.

Frequently asked questions

Can a company ask for my ID before it answers my request?

Yes, a company can ask for extra information to confirm who you are, but only if it has reasonable doubts about your identity. It should ask for no more than needed, usually a copy of your ID.

Can I stop a company sending me marketing at any time?

Yes, you can object to direct marketing at any time, free of charge and without giving a reason.

Can I use these rights against a company based outside Spain?

Yes, your rights apply to companies in other EU countries and to non-EU companies that offer goods or services to people in the EU. You can still file a complaint with the Spanish data-protection agency (AEPD), which passes it to the lead authority abroad and stays your contact point.

Can a company refuse to delete my data?

Yes, a company can refuse deletion when it must keep the data for a legal duty such as tax or accounting records, or to defend legal claims. In that case it blocks the data and destroys it once the legal period ends.