AEPD

The Agencia Española de Protección de Datos (AEPD) is the Spanish Data Protection Authority, an independent national body responsible for promoting and enforcing privacy and data protection laws in Spain. It applies the General Data Protection Regulation (GDPR) within Spain together with national legislation, primarily Organic Law 3/2018 on the Protection of Personal Data and guarantee of digital rights (LOPDGDD).

Responsibilities: The AEPD oversees all processing of personal data by public and private sector bodies, handles complaints from individuals, and conducts inspections and investigations into potential violations. It can issue warnings, corrective orders, and administrative fines, and it publishes guidelines, codes of conduct, and certification schemes to facilitate compliance.

Powers and cooperation: It has investigatory powers, power to request information, perform on-site inspections, and enforce measures. It cooperates with the European Data Protection Board and other data protection authorities in cross-border cases and GDPR enforcement actions.

Rights and resources for citizens: The agency informs data subjects about their rights, including access, rectification, erasure, objection, and data portability, and provides practical guidance on privacy notices, consent, cookies, and incident reporting.

Organization and impact: Based in Madrid, the AEPD operates as an autonomous authority within the Spanish government framework. It issues annual activity reports and contributes to the development of Spain's data protection framework and its implementation of EU law.