What this guidebook covers
The AEPD (Spanish Data Protection Agency) fined Vodafone €8.15 million for marketing calls and messages sent without consent. A dealer handles ID cards, payslips, finance data and camera footage. The GDPR allows fines of up to €20 million or 4% of worldwide turnover, whichever is higher, and the AEPD can ban the processing.
This guidebook covers 6 data protection standards for dealers and workshops, with 16 checkpoints: marketing consent, information to customers, customer rights, security and breaches (reported within 72 hours), lawful video surveillance, and contracts with data processors. The guidebook PDF is in Spanish.
The 6 data protection standards
| Code | Standard | Ideal fix time |
|---|---|---|
| DAT-01 | Marketing consent | Immediate |
| DAT-02 | Information to customers | 30 days |
| DAT-03 | Customer rights | 7 days |
| DAT-04 | Security and breaches | 24 hours |
| DAT-05 | Lawful video surveillance | 7 days |
| DAT-06 | Data processors | 30 days |
How to run a Spanish data protection compliance audit, step by step
- Confirm what applies. List every channel that collects customer data and every supplier that handles it (DMS, call centre, marketing agency, lead provider). Business (B2B) contacts are also personal data when they identify a person.
- Walk the site, standard by standard. Score each of the 16 checkpoints Pass, Fail or N/A. N/A only where the standard rules it out, with the reason recorded. Review the forms and test the unsubscribe link, sample 5 rights requests, check cabinets, desks and DMS users, and walk the cameras and the recorder settings.
- Capture the evidence. A pass counts only with proof captured at the time of the audit: consent forms and the unsubscribe test, privacy notices, the requests log, photos and the DMS user list, camera settings and processor contracts.
- Give every fail an owner and a fix time. Record what you saw and who owns the fix. Each standard carries an ideal fix time, from immediate to 30 days, counted from audit submission (see the table above).
- Fix it, then prove it. The site fixes the cause and uploads proof of closure; the auditor checks the proof before closing the finding.
- Re-check at the next audit. Confirm closed findings stay closed, and look for the same fail at your other sites so one gap doesn't repeat across the network.
Who this guidebook is for
- Management and DPO: understand the risk
- Marketing and sales: know when a customer can be contacted
- Auditors: review forms, cabinets and cameras
A reference document, not legal advice. Fines and rules change: check the current text with the regulator or your legal adviser before acting.
