Data protection compliance is an unavoidable obligation for any e-commerce business in Spain. The European General Data Protection Regulation and its Spanish transposition, Organic Law 3/2018 on Personal Data Protection and digital rights guarantees, establish a demanding framework whose non-compliance can result in multimillion-euro penalties.
Cookie compliance under Spanish law
The LSSI and AEPD guidelines require obtaining explicit user consent before installing non-essential cookies. The cookie banner must offer options to accept, reject or configure cookies on a granular basis. Cookie walls that condition content access on accepting all cookies are non-compliant. Technical and session cookies are exempt from consent, but analytical, advertising and social media cookies require prior consent. The AEPD has fined Spanish companies up to 30,000 euros for cookie compliance failures. A compliant cookie management platform should categorize cookies, record consent and allow users to modify their preferences at any time.
Privacy policy and processing records
Every online store must include a privacy policy informing users about the identity of the data controller, personal data collected, processing purposes, legal basis, data recipients, retention periods and data subject rights. The record of processing activities is mandatory for companies with more than 250 employees or those processing sensitive data, but is recommended for all companies as best practice. If the company carries out large-scale data processing or systematic monitoring, it must appoint a Data Protection Officer. For e-commerce, common processing activities include customer account management, order processing, marketing communications and behavioral analytics.
User rights: ARCO-POL
Users have rights of access, rectification, cancellation, objection, portability, erasure and processing limitation. The company must respond to requests within a maximum of one month. For e-commerce, the most frequently exercised rights are account and data deletion, and objection to commercial communications. Newsletter unsubscription must be effective within a maximum of 10 business days. Failure to respond to rights requests within the legal timeframe is one of the most common grounds for AEPD sanctions.
AEPD enforcement and penalties
The Spanish Data Protection Agency is one of Europe's most active authorities in GDPR enforcement. Penalties can reach 20 million euros or 4 percent of annual global turnover. In 2024, the AEPD imposed over 400 sanctions, with fines ranging from 1,000 to 1,200,000 euros. The most frequent grounds were sending commercial communications without consent, inadequate security measures and excessive data collection. Spain consistently ranks among the top three EU countries for GDPR enforcement actions.
Comprehensive compliance with Zunapro
Zunapro offers data protection audits, implementation of compliant privacy and cookie policies, and ongoing advisory services to ensure your e-commerce business meets GDPR and LOPDGDD requirements at all times.