Data protection duties for your company (GDPR and the AEPD)

Key rules

• Breach report: Report a breach likely to risk people's rights to the AEPD within 72 hours of becoming aware.
• Processing record: Being small does not exempt you; regular processing such as payroll means you normally keep a record.
• DPO: Most small SLs do not need a DPO, but if you appoint one you tell the AEPD within 10 days.
• Requests: Answer requests to access, correct or delete data within one month.
• Providers: Sign a data-processing contract with every provider that handles personal data for you.

The short version

If your SL handles personal data, you must follow European and Spanish privacy law. Payroll, customer lists, website forms and supplier contacts all count. Being small does not exempt you. You will almost certainly need a record of processing. You will probably not need a data protection officer.

What your company must have in place

Do these things as a baseline:

• A lawful basis for each use of data. For every way you use personal data, you need one reason: consent, a contract, a legal obligation or legitimate interest.
• A privacy notice when you collect data. Say who you are, why you use the data, on what basis, who receives it, how long you keep it and what rights people have.
• A way to answer people's requests. People can ask to see, correct, delete, restrict or move their data, or object to its use. Answer within one month.
• A contract with each provider that handles data for you. This covers payroll, hosting and marketing providers.
• Security that fits the risk. Collect only the data you need and keep it no longer than necessary.
• An impact assessment before high-risk processing. Do it before you start.

The Spanish data protection authority, the AEPD, offers free tools for small firms, called Facilita and Facilita-RGPD. They help you build these documents.

Do you need a record of processing?

Almost certainly yes. A company with fewer than 250 employees is exempt only if all three of these are true: the processing is occasional, it is unlikely to risk people's rights, and it involves no sensitive or criminal-conviction data. Payroll and customer management are regular processing, so a small firm normally has to keep the record. You must show it to the AEPD if asked.

The record should contain:

• your identity and contact details, and your DPO's if you have one;
• the purposes of the processing;
• the categories of people and data;
• the recipients of the data;
• any transfers outside the EU;
• retention periods, where possible;
• a general description of your security measures.

If you process data on behalf of another company, you keep a record of what you do for each client.

Do you need a data protection officer?

Most small SLs do not. A data protection officer (DPO) is mandatory for public bodies, for companies whose core work is regular, large-scale monitoring of individuals, and for those handling sensitive or criminal data on a large scale. Spanish law adds named sectors. They include education centres, health centres, insurers, financial institutions, energy and telecoms companies, advertising and profiling firms, gambling operators and private security firms.

If you are in one of those sectors, check whether you must appoint a DPO. You may also appoint one voluntarily. If you appoint or change a DPO, tell the AEPD within 10 days through its electronic office. Publish the DPO's contact details and give them to the people whose data you hold.

If there is a data breach

Write down every breach internally, with the facts, the effects and what you did to fix it. Do this even if you do not need to report it.

If the breach is likely to risk people's rights, report it to the AEPD within 72 hours of becoming aware. Use the form in its electronic office. Describe what happened, roughly how many people and records are affected, your contact point, the likely consequences and the measures you have taken. You can send the information in phases.

If the breach is likely to cause a high risk to the people affected, tell them too, without undue delay and in clear language. You can skip this if the data was encrypted or the risk has been neutralised. If telling each person would take disproportionate effort, publish a public notice instead.

If a provider that handles your data suffers a breach, it must tell you without undue delay. Your own clock then starts when you become aware.

What fines look like

The legal maximums are very high: up to 10 million euros or 2% of worldwide annual turnover for lesser infringements, and up to 20 million euros or 4% for serious ones. The higher figure applies in each tier. Fines on small firms are usually far lower, often in the thousands of euros, and the AEPD can issue a warning instead. The most common triggers are:

• no valid lawful basis or consent;
• unsolicited marketing;
• weak security;
• ignored access or deletion requests;
• missing privacy information.

The steps and deadlines are in the timeline below, and the checklist and warnings below cover the rest.

Timeline and deadlines

• Decide whether you must appoint a data protection officer (DPO) and, if you do, tell the AEPD: within 10 days of appointing the DPO or changing who it is

• Record every personal data breach internally, with the facts, effects and fixes: as soon as you become aware of it

• Tell the people affected if the breach is likely to cause them a high risk: without undue delay after you become aware

• Answer a request from someone to see, correct or delete their data: within one month of receiving it

Checklist

• Identify a lawful basis for each way you use personal data: consent, contract, legal obligation or legitimate interest.

• Give people a privacy notice when you collect their data, covering who you are, why you use it, who receives it, how long you keep it and their rights.

• Set up a way to handle requests to access, correct, delete, restrict or move data, or to object to its use.

• Sign a data-processing contract with each provider that handles personal data for you, such as payroll, hosting and marketing.

• Apply security measures that fit the risk, and collect only the data you need, keeping it no longer than necessary.

• Write your record of processing activities, and check whether you need a DPO.

• Run an impact assessment before any high-risk processing.

• Try the AEPD's free tools for small firms, Facilita and Facilita-RGPD, to build your documents.

What to watch out for

• Assuming a small company is exempt from the processing record: The exemption for firms with fewer than 250 employees only covers occasional, low-risk processing without sensitive data. Payroll and customer management count as regular processing. Write the record and keep it ready to show the AEPD if it asks.

• Missing the deadline after a data breach: If a breach is likely to risk people's rights, you must report it to the AEPD within 72 hours of becoming aware. Every breach must also be recorded internally, even if you do not report it. Agree in advance who decides and reports. Use the form in the AEPD's electronic office, and tell affected people without delay if the risk to them is high.

• Using data without a valid lawful basis or consent: Using data with no lawful basis or invalid consent, and sending unsolicited marketing, are among the most common triggers for AEPD fines. Fines can reach 20 million euros or 4% of worldwide turnover. Pick and note a lawful basis for each use, and get clear consent before marketing.

• Ignoring access or deletion requests: People can ask to see, correct or delete their data, and you must answer within one month. Ignoring them is a common reason for complaints and fines. Name someone to log and answer requests, and reply in writing within the month.

• No contract with providers who handle personal data: Using a payroll, hosting or marketing provider without a data-processing contract breaks the rules. Fines for this can reach 10 million euros or 2% of worldwide turnover.

• Forgetting to notify the AEPD about a DPO: If you appoint a DPO, even voluntarily, you must tell the AEPD within 10 days of the appointment or any change. Notify through the AEPD's electronic office and publish the DPO's contact details.

Frequently asked questions

Does my small company have to keep a record of processing activities?

Yes, in most cases a small company must keep a record of processing activities, because the exemption for firms with fewer than 250 employees only covers occasional, low-risk processing without sensitive data. Payroll and customer management are regular processing, so they normally bring you under the duty. Keep the record ready to show the AEPD, Spain's data protection authority, if it asks.

What goes into a record of processing activities?

The record lists who you are, why you use the data and what you hold. Include your contact details (and the DPO's, if you have one), the purposes, the types of people and data, who receives it, any transfers outside the EU, how long you keep it, and a general description of your security measures.

Do I have to tell the AEPD if I appoint a DPO?

Yes, you must tell the AEPD within 10 days of appointing a data protection officer (DPO) or changing who it is, using the AEPD's electronic office. Most small companies do not need a DPO but may appoint one voluntarily.

How big are the fines for a small company?

Fines for small companies are usually far below the legal maximums, often in the thousands of euros, and the AEPD can also issue a warning instead. The maximums are 10 million euros or 2% of worldwide turnover for lesser breaches, and 20 million euros or 4% for serious ones, whichever is higher. Common triggers are missing privacy information, unsolicited marketing and ignoring access or deletion requests.