What is the DPO and what is its relationship with the AEPD?
The DPO (Data Protection Officer), also referred to by its Spanish acronym DPD (Delegado de Protección de Datos), is the person responsible for supervising GDPR compliance within an organisation. This role is regulated under articles 37 to 39 of the GDPR and further developed in Spain by Organic Law 3/2018 (LOPDGDD).
The AEPD (Agencia Española de Protección de Datos — Spain's data protection authority) is the public body responsible for supervising the application of privacy regulations in Spain. It acts as the official point of contact for the DPO, receives the mandatory registration, and may require the DPO's involvement in the event of an investigation or sanction.
Difference between internal and external DPO
The DPO may be an employee of the organisation itself (internal DPO) or an external professional or entity engaged on a contractual basis (external DPO).
Opting for an external DPO has clear advantages: greater independence and objectivity, up-to-date knowledge of the regulatory framework without the cost of ongoing training, and immediate coverage without the need to create a new in-house position.
"The AEPD does not sanction for the sake of sanctioning. It seeks to ensure that organisations take people's rights seriously. When they do, problems are avoided."
Mario P. Talamillo · Managing Partner, Certix®
When is it mandatory to appoint a DPO according to the AEPD?
The GDPR establishes three situations in which appointment is mandatory:
- Public authorities or bodies
- Organisations whose core activities involve large-scale processing of special categories of data: health data, biometric data, genetic data, ideology, religion, sexual orientation, etc.
- Organisations that carry out large-scale regular and systematic monitoring of individuals: mass video-surveillance companies, digital platforms, behavioural advertising, etc.
Article 34 of the LOPDGDD provides for additional cases for certain sectors in Spain — professional associations, educational institutions, credit institutions, insurance companies, securities firms, energy distributors, private security companies, sports federations when processing data of minors, among others — with the exception of healthcare professionals practising on an individual basis. The specific obligation depends on an individual analysis of each organisation; this information is for guidance purposes only and each case must be examined individually.
What if I do not fall into any of these cases?
If your organisation does not fall within any of the above situations, appointment is not mandatory, but it is highly advisable to have a DPO or specialist advisory support. The AEPD notes that proactive compliance significantly reduces the risk of sanctions.
DPO functions: what this professional actually does
Supervising regulatory compliance
The DPO analyses the data processing activities carried out by the organisation and verifies that they comply with the GDPR and the LOPDGDD. They review contracts with third parties, assess data processors, and audit internal procedures.
Advisory work and training
The DPO informs and advises the controller, employees, and all those involved in data processing. They ensure that staff receive adequate and up-to-date training.
Point of contact with the AEPD
The DPO acts as the official intermediary between the organisation and the Agencia Española de Protección de Datos in investigations or requests for information.
Data Protection Impact Assessments (DPIA)
Where high-risk processing activities are envisaged, the DPO supervises and advises on the preparation of Data Protection Impact Assessments.
Management of security breaches
In the event of a security breach, the DPO coordinates the response, assesses whether notification to the AEPD is required within the maximum period of 72 hours, and manages communication with affected individuals where appropriate.
DPO consultation and notification to the AEPD: step-by-step registration
In practice, consulting the DPO with the AEPD and notifying it are the same procedure: once the DPO has been appointed, the organisation must notify it (register it) with the AEPD through the service available on its electronic office (sedeagpd.gob.es). This is the official channel for the AEPD to identify who the Data Protection Officer of each entity is. This registration is mandatory and free of charge.
- Access the AEPD's electronic office
- Select the DPO notification procedure
- Identify yourself using a digital certificate, electronic identity document, or Cl@ve
- Complete the details of the controller and the designated DPO
- Submit the notification and retain the confirmation receipt
What happens if you don't appoint or notify the DPO
If your organisation is required to have a DPO and does not appoint one — or appoints one but does not notify the AEPD — it fails to meet an obligation under the GDPR (art. 37.7) and the LOPDGDD. Beyond the sanctioning regime of art. 83 GDPR, what really matters is practical: without a DPO the organisation is left without the figure that supervises compliance, provides internal advice, and acts as the point of contact with the AEPD.
Appointing the DPO and notifying it properly is, above all, a matter of diligence and of protecting the people whose data you process. Doing it in an orderly way prevents problems and conveys trust to clients and suppliers.
DPO and AEPD in Burgos: local service with national reach
At Certix, headquartered in Burgos, we have spent years helping organisations across Spain with their data protection. We help you determine whether your organisation needs a DPO, understand its functions, and notify it correctly to the AEPD, with ongoing advice. No sales staff, no intermediaries: you will always speak directly with an expert.
This content is for informational purposes only and does not constitute legal advice. The application of regulations to each specific case requires individual analysis.