{"id":1791,"date":"2026-10-13T12:47:04","date_gmt":"2026-10-13T12:47:04","guid":{"rendered":"https:\/\/autosmarts.co\/en\/guidebooks\/spain-data-protection-compliance-guidebook\/"},"modified":"2026-10-13T12:47:04","modified_gmt":"2026-10-13T12:47:04","slug":"spain-data-protection-compliance-guidebook","status":"publish","type":"guidebook","link":"https:\/\/autosmarts.co\/en\/guidebooks\/spain-data-protection-compliance-guidebook\/","title":{"rendered":"Spain Data Protection Compliance Guidebook for Automotive Companies"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\" id=\"overview\">What this guidebook covers<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The AEPD (Spanish Data Protection Agency) fined Vodafone \u20ac8.15 million for marketing calls and messages sent without consent. A dealer handles ID cards, payslips, finance data and camera footage. The GDPR allows fines of up to \u20ac20 million or 4% of worldwide turnover, whichever is higher, and the AEPD can ban the processing.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This guidebook covers 6 data protection standards for dealers and workshops, with 16 checkpoints: marketing consent, information to customers, customer rights, security and breaches (reported within 72 hours), lawful video surveillance, and contracts with data processors. The guidebook PDF is in Spanish.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"standards\">The 6 data protection standards<\/h2>\n\n\n\n<figure class=\"wp-block-table as-papertable as-gbtable\"><table><thead><tr><th>Code<\/th><th>Standard<\/th><th>Ideal fix time<\/th><\/tr><\/thead><tbody><tr><td>DAT-01<\/td><td>Marketing consent<\/td><td>Immediate<\/td><\/tr><tr><td>DAT-02<\/td><td>Information to customers<\/td><td>30 days<\/td><\/tr><tr><td>DAT-03<\/td><td>Customer rights<\/td><td>7 days<\/td><\/tr><tr><td>DAT-04<\/td><td>Security and breaches<\/td><td>24 hours<\/td><\/tr><tr><td>DAT-05<\/td><td>Lawful video surveillance<\/td><td>7 days<\/td><\/tr><tr><td>DAT-06<\/td><td>Data processors<\/td><td>30 days<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"steps\">How to run a Spanish data protection compliance audit, step by step<\/h2>\n\n\n\n<ol class=\"wp-block-list as-gbsteps\">\n<li><strong>Confirm what applies.<\/strong> List every channel that collects customer data and every supplier that handles it (DMS, call centre, marketing agency, lead provider). Business (B2B) contacts are also personal data when they identify a person.<\/li>\n\n<li><strong>Walk the site, standard by standard.<\/strong> Score each of the 16 checkpoints Pass, Fail or N\/A. N\/A only where the standard rules it out, with the reason recorded. Review the forms and test the unsubscribe link, sample 5 rights requests, check cabinets, desks and DMS users, and walk the cameras and the recorder settings.<\/li>\n\n<li><strong>Capture the evidence.<\/strong> A pass counts only with proof captured at the time of the audit: consent forms and the unsubscribe test, privacy notices, the requests log, photos and the DMS user list, camera settings and processor contracts.<\/li>\n\n<li><strong>Give every fail an owner and a fix time.<\/strong> Record what you saw and who owns the fix. Each standard carries an ideal fix time, from immediate to 30 days, counted from audit submission (see the table above).<\/li>\n\n<li><strong>Fix it, then prove it.<\/strong> The site fixes the cause and uploads proof of closure; the auditor checks the proof before closing the finding.<\/li>\n\n<li><strong>Re-check at the next audit.<\/strong> Confirm closed findings stay closed, and look for the same fail at your other sites so one gap doesn&#039;t repeat across the network.<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"who\">Who this guidebook is for<\/h2>\n\n\n\n<ul class=\"wp-block-list as-gbwho\">\n<li>Management and DPO: understand the risk<\/li>\n\n<li>Marketing and sales: know when a customer can be contacted<\/li>\n\n<li>Auditors: review forms, cabinets and cameras<\/li>\n<\/ul>\n\n\n\n<p class=\"as-gbnote wp-block-paragraph\">A reference document, not legal advice. Fines and rules change: check the current text with the regulator or your legal adviser before acting.<\/p>\n\n\n","protected":false},"excerpt":{"rendered":"<p>Consent, privacy notices, rights, security, cameras and suppliers: what the AEPD checks, and why one marketing SMS without consent can cost millions.<\/p>\n","protected":false},"featured_media":1843,"menu_order":48,"template":"","meta":{"footnotes":"","_as_region":"Spain","_as_topic":"Data protection","_as_edition":"Edition 1 \u00b7 2026","_as_standards":"6","_as_checkpoints":"16","_as_pages":"11","_as_language":"Spanish","_as_law":"GDPR (Regulation (EU) 2016\/679) \u00b7 Data Protection Act (LOPDGDD, Organic Law 3\/2018) \u00b7 e-Commerce Act (LSSI, Law 34\/2002)","_as_regulator":"AEPD (Spanish Data Protection Agency)","_as_facts":"\u20ac8.15M | fines on Vodafone for marketing without consent\n4% | of worldwide turnover: maximum fine\n72 h | to report a breach to the AEPD","_as_pdf":1792,"_as_checklist_1":804,"_as_checklist_2":0,"_as_checklist_3":0,"_as_guide":0,"_as_solution":557},"class_list":["post-1791","guidebook","type-guidebook","status-publish","has-post-thumbnail","hentry"],"_links":{"self":[{"href":"https:\/\/autosmarts.co\/en\/wp-json\/wp\/v2\/guidebook\/1791","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/autosmarts.co\/en\/wp-json\/wp\/v2\/guidebook"}],"about":[{"href":"https:\/\/autosmarts.co\/en\/wp-json\/wp\/v2\/types\/guidebook"}],"version-history":[{"count":1,"href":"https:\/\/autosmarts.co\/en\/wp-json\/wp\/v2\/guidebook\/1791\/revisions"}],"predecessor-version":[{"id":1793,"href":"https:\/\/autosmarts.co\/en\/wp-json\/wp\/v2\/guidebook\/1791\/revisions\/1793"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/autosmarts.co\/en\/wp-json\/wp\/v2\/media\/1843"}],"wp:attachment":[{"href":"https:\/\/autosmarts.co\/en\/wp-json\/wp\/v2\/media?parent=1791"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}