What your website needs to comply with the GDPR and the LSSI-CE

A small website may seem a purely technical matter, but from the moment it loads its first resource in the browser of a European visitor it enters the scope of two rules that coexist in every interaction: the Regulation (EU) 2016/679 (GDPR) and Law 34/2002 on Information Society Services and Electronic Commerce (LSSI-CE). Organic Law 3/2018 (LOPDGDD) adds the national development, and depending on the activity others also apply (Organic Law 1/1982 for images, Royal Legislative Decree 1/2007 for consumers, sector-specific regulations).

This guide runs through what documents, configurations and practices a website in Spain must have to comply with that minimum common layer, without generic invocations to "stay up to date" and without an alarmist tone. The goal is operational: a checklist that a project manager can use to validate their own website or to commission a redesign with the legal pieces thought through from the start.

Which rules apply to a Spanish website in 2026?

The basic framework applicable to any website operated from Spain with visitors in the European Union combines, at a minimum:

• GDPR (Regulation EU 2016/679): governs the processing of personal data the website collects, from a simple contact form to tracking via cookies. It has applied since May 2018.
• LOPDGDD (Organic Law 3/2018, of 5 December): national development of the GDPR. It adds specific rules on the age to consent (art. 7, 14 years in information society services), workplace processing, the duty of confidentiality, appointment of a DPO and the penalty regime.
• LSSI-CE (Law 34/2002, of 11 July): governs the activity of information society service providers. Its art. 10 imposes the obligation to identify the owner of the website; art. 21 governs commercial communications by electronic means; art. 22.2 governs the storage and retrieval devices on the user's equipment (cookies, pixels, fingerprinting).
• Organic Law 1/1982, of 5 May, on the civil protection of the right to honour, personal and family privacy and one's own image: relevant for photographs of people published on the website.
• Royal Legislative Decree 1/2007 (General Act for the Defence of Consumers and Users) and Law 4/2022 (which amended the guarantee regime to three years for goods): applicable when the website makes sales to consumers.

To this is added, depending on the activity, sector-specific regulation that may add its own requirements (healthcare, financial, legal, educational, hospitality, etc.). This article focuses on the common layer applicable to any website; the sector-specific particularities are dealt with in dedicated pieces.

Legal notice: the document that identifies who is behind it (art. 10 LSSI-CE)

The legal notice responds to the obligation of art. 10 of the LSSI-CE, which requires the service provider to make available by electronic means —permanently, easily, directly and free of charge— the following identifying information:

• Company name, NIF or CIF and registered address.
• Registration details in the Commercial Register or another public register in which it may be registered.
• Email address and any other data that allows direct and effective communication to be established.
• If the activity is subject to a prior administrative authorisation regime, the data relating to that authorisation and the supervisory authority.
• If it is a regulated profession (lawyers, architects, doctors, etc.), details of the professional college, membership number, academic title and applicable professional rules.
• Tax identification number where there is an obligation to operate with one.
• If reference is made to prices, clear and exact information about the price, indicating whether it includes taxes and shipping costs.

The legal notice must be accessible from a permanent link in the website footer. Having it inside a downloadable PDF or inside a hard-to-reach dropdown menu is not enough: that practice is considered contrary to the criterion of permanent, easy, direct and free information required by art. 10 LSSI-CE itself.

Privacy policy: the duty to inform under arts. 13 and 14 GDPR

The privacy policy fulfils the duty to inform that the GDPR imposes through two articles depending on the origin of the data:

• Art. 13 GDPR when the data is obtained directly from the data subject (website forms, registrations, subscriptions, signing up as a customer). The information must be provided at the time of collection.
• Art. 14 GDPR when the data is NOT obtained from the data subject, but from a third party or a publicly accessible source (prospecting databases, professional network profiles, public registers, intermediaries). The information must be provided within a reasonable period that may not exceed one month from the obtaining of the data, or at first contact if the data is to be used to communicate with the data subject.

A typical website combines both planes: the contact form triggers art. 13, while leads obtained via a portal, a commercial intermediary or a professional listing trigger art. 14. The privacy policy must address both scenarios where they concur.

The model recommended by administrative doctrine is that of layered information: a brief first layer next to the point of collection (form, banner, account sign-up) and a full second layer linked from that first one.

The minimum content of the second layer (full policy) must include, in accordance with arts. 13 and 14 GDPR:

• Identity and contact details of the data controller.
• Contact details of the Data Protection Officer (DPO), if the entity has appointed one under art. 37 GDPR or art. 34 LOPDGDD.
• Purposes of the processing and the legal basis for each purpose (art. 6 GDPR: performance of a contract, consent, legitimate interest, legal obligation, public interest task, vital interests).
• Recipients or categories of recipients of the data.
• International transfers, where applicable, indicating the basis used (adequacy decision, appropriate safeguards, derogations).
• Retention period or, where this is not possible, the criteria for determining it.
• Data subjects' rights (access, rectification, erasure, restriction, objection, portability) and how to exercise them.
• Right to lodge a complaint with the competent supervisory authority.
• If there are automated decisions with legal or significant effects (art. 22 GDPR): information about the logic applied and the envisaged consequences.
• Where art. 14 applies additionally: the categories of data processed and the source from which they come, indicating whether they come from a publicly accessible source (art. 14.2.f GDPR).

To go deeper into the privacy policy applied to a specific case (ecommerce), it is worth reviewing the dedicated guide: what an online store's privacy policy must include.

Cookie policy and banner compliant with the applicable guidance

Art. 22.2 of the LSSI-CE requires prior, informed and specific consent before installing any storage or data-retrieval device on the user's equipment that is not strictly necessary to provide the requested service. The applicable official guidance on the use of cookies, in its version updated in May 2024, details how to apply that principle in daily practice.

The technical criteria that distinguish a valid implementation from a decorative one are:

• Three visually equivalent options in the banner: accept all, reject all and configure by category. The reject button cannot be hidden under a smaller-sized link nor hidden behind "configure".
• Prior blocking of all cookies and devices that are not strictly necessary until the user has chosen. The early loading of analytics, marketing or social media scripts before consent is one of the practices most frequently classed as infringing.
• Granularity by category (strictly necessary, preferences, analytics, marketing, social media) with a real option to accept some and reject others.
• Reasonable duration of the consent: the applicable guidance considers appropriate a period not exceeding twenty-four months, after which it must be requested again.
• Reconfiguration link permanently accessible from the website footer ("Configure cookies" or equivalent), allowing the user to change their initial decision without obstacles.
• Cookie policy with a detailed table: each cookie identified by technical name, owner, purpose, duration and how to uninstall it. Pixels, SDKs and fingerprinting devices must likewise be listed, not just cookies in the strict sense.

For the detail of how to implement all of this in a specific online store, see the guide: cookies and consent on an online store in accordance with the GDPR and the LSSI-CE.

Forms: information notice, legitimising basis and evidence of consent

Any form that collects personal data (contact, newsletter sign-up, account registration, quote request, job application) triggers the GDPR. The operational criteria are:

• Layered information notice. The first layer goes next to the submit button with the essential information: who the controller is, the purpose, the legal basis and a link to the second layer.
• Adequate legal basis. For contact forms about specific services, the usual basis is performance of pre-contractual measures (art. 6.1.b GDPR) if the visitor requests information about a contract; for generic support or open enquiry contact, legitimate interest (art. 6.1.f) with a documented balancing test usually applies.
• Specific box unticked by default for each additional purpose. A single "I accept the terms" is not valid to legitimise both the contact and the subsequent sending of commercial communications at once. Consent must be specific for each purpose.
• Accessible privacy policy from a link in the form itself; never embedded in general terms of use without distinction.
• Evidence of consent: the controller must be able to demonstrate that the data subject consented (art. 7.1 GDPR). In practice this requires recording the date, time, version of the information text and mechanism of acceptance.
• Dual basis art. 6 + art. 9 if the form collects special category data (health, biometrics, ideology, etc.). Without the two bases simultaneously, the processing is unlawful.

Commercial communications by email (art. 21 LSSI-CE)

Email marketing campaigns directed at natural persons are governed by art. 21 of the LSSI-CE. The general rule is the prohibition on sending commercial communications by electronic means without the recipient's prior express consent.

Art. 21.2 LSSI-CE introduces a narrow exception (the so-called soft opt-in) that allows communications to be sent without new prior consent when three conditions concur simultaneously:

• The recipient's data was obtained lawfully in the context of a prior contractual relationship with the company itself (that is, the recipient is already a customer).
• The communications relate to products or services similar to those that gave rise to the original contractual relationship.
• A simple and free procedure to object to the processing was offered at the time of collection of the data, and is offered in each subsequent communication.

The three requirements are cumulative: if one fails, the exception does not apply and express consent is needed. Email lists purchased from third parties are not a valid basis for commercial sendings: GDPR consent is free, specific, informed and unambiguous (art. 4.11), and it is not transferred between controllers.

Web design and development: the legal layer is born in the wireframe

Most of a website's compliance problems are not generated by adding the legal notice at the end, but in technical decisions taken much earlier: where the service is hosted, which CMS is used, how third-party scripts are loaded, whether the consent manager blocks cookies before the click or not, whether the form includes a honeypot and a proportionate captcha, whether the security headers are configured. Rewriting a project when the website is already in production costs twice as much as designing it correctly from the start.

For this reason, for technical implementations that integrate the legal layer from the first wireframe (a well-configured consent manager, hosting with correct data processing, forms with evidence of consent, security headers, a cookie policy dynamically generated in accordance with the applicable guidance), working with a partner specialising in web development is a reasonable decision. As a web design and development agency we regularly collaborate with Volantis, which approaches projects already thinking about these pieces during the design phase.

Quick-check checklist

Frequently asked questions

What minimum legal documents must any website in Spain have?

Three at a minimum: a legal notice (art. 10 LSSI-CE), a privacy policy (arts. 13 and 14 GDPR depending on the origin of the data) and a cookie policy (art. 22.2 LSSI-CE + applicable cookie guidance, May 2024). If it sells to consumers, add general terms and conditions of sale; if it manages registered users, terms of use. Missing one of them is not a formal failure: it leaves the website without minimum legal cover.

Is it enough for the cookie banner to have an Accept button?

No. The applicable guidance on the use of cookies (May 2024) requires three visually equivalent options: accept, reject and configure. In addition, non-essential cookies cannot load before the click. A banner that only shows Accept fails the requirement of free consent under art. 4.11 GDPR.

Does hosting outside the EU affect compliance?

Yes. It is an international transfer that needs its own basis. For the US, it depends on whether the provider is enrolled in the Data Privacy Framework (Adequacy Decision 2023/1795). If it is not, you must sign Standard Contractual Clauses and document a Transfer Impact Assessment.

Does a contact form count as data processing?

Yes. Any form that collects an identifying datum (name, email, phone) triggers the GDPR. It needs a layered information notice, an adequate legal basis, a specific box unticked for additional purposes and evidence of consent (record of date, time and version of the text).

References and resources to go deeper

• Cookies and consent on an online store in accordance with the GDPR and the LSSI-CE
• What an online store's privacy policy must include
• Data protection compliance: what it consists of
• Certix data protection consultancy
• For professional web design and development aligned with these requirements: somosvolantis.com

---

This content is for informational purposes only and does not constitute legal advice. The application of regulations to each specific case requires individual analysis. Spanish regional sectoral regulations may extend or modify the general requirements described.