LOPDGDD

The relationship with the GDPR is the thing to be clear about, because getting it wrong produces confident and incorrect advice. The regulation applies directly and is the source of the obligations; the national law does not restate it and does not replace it. What it does is fill in what the regulation leaves to each country, and it addresses matters the regulation does not, including rights concerning digital life at work and the treatment of certain categories of data under Spanish law.

For a technical audience the practical consequence is that the answer to a question about Spain is often in the national text rather than the regulation: the cases in which a data protection officer must be appointed, the rules that apply to workplace monitoring including video and device use, and the procedural detail around how the supervisory authority acts. A security control that involves monitoring employees is exactly where the national layer bites, and it is a common gap in a report written from the regulation alone.

We are a security firm and not a law firm, so our position is bounded: we identify where a technical measure has an obligation attached and we say which text to check with counsel, without interpreting articles. That boundary is stated in the data protection work where the Spanish layer is applied alongside the regulation, and the authority that supervises it is the AEPD.