Data Protection Officer duties in Spain: what a DPO does (and does not do)

Many companies in Spain have appointed a Data Protection Officer and notified the Spanish Data Protection Agency (AEPD), but are not sure what that person should actually be doing. Others hire one only because the law requires it and treat it as a formality. Either way, they waste a role that, used well, prevents fines and saves trouble.

This article reviews the Data Protection Officer duties under the GDPR and Spain’s data protection act (LOPDGDD), the safeguards the role enjoys, what it is not responsible for and how a good DPO shows in everyday business.

Data Protection Officer duties under the GDPR

Article 39 GDPR lists the minimum tasks of the DPO:

• Inform and advise the controller or processor, and the employees who process data, about their obligations.
• Monitor compliance with the GDPR, national law and internal policies, including assigning responsibilities, raising awareness, training staff and running audits.
• Advise on data protection impact assessments (DPIAs) when asked and monitor their performance.
• Cooperate with the supervisory authority, which in Spain is the AEPD.
• Act as the contact point for the authority, including prior consultation.

The same article adds an important nuance: the DPO must follow a risk-based approach and focus on the processing that can cause the most harm.

Extra duties under Spanish law

Inspecting and recommending

Article 36 of the LOPDGDD allows the DPO to inspect data protection procedures and issue recommendations. If the DPO finds a relevant breach, it must be documented and reported immediately to the management bodies.

Access to data

The DPO has the right to access personal data and processing operations. The company cannot refuse on grounds of confidentiality or secrecy.

Handling complaints before the AEPD

This is the duty with the greatest practical impact. Under Article 37 LOPDGDD, an individual may contact the DPO before complaining to the AEPD, and the DPO has two months to respond. If the complaint goes straight to the Agency, it may forward it to the DPO, who then has one month to reply. A DPO who handles this stage well prevents many proceedings.

Safeguards for the DPO

• Involvement from the start in all data protection issues.
• The resources needed to do the job and keep knowledge up to date.
• No instructions on how to perform the tasks, and no dismissal or penalty for performing them.
• Direct reporting to the highest management level.
• Other tasks are allowed only if they create no conflict of interest.

For in-house DPOs, Spanish law adds that they cannot be removed or penalised for performing their duties unless they acted with intent or gross negligence.

What the DPO is not responsible for

The DPO is not the person responsible for compliance: the company is. Nor is it the DPO’s role to draft every document, sign contracts or make business decisions. The role is to advise, monitor and warn, which is why the DPO cannot hold positions that decide the purposes and means of processing.

How a good DPO shows in daily practice

• Keeps the record of processing activities up to date.
• Reviews contracts with suppliers that access data before they are signed.
• Helps manage security breaches and decide whether to notify the AEPD within 72 hours.
• Answers data subject requests on time.
• Trains staff and keeps evidence of that training.
• Gets involved before a new project with personal data is launched.

Common mistakes

• Appointing a DPO and then not sharing information.
• Leaving no written trace of the DPO’s work.
• Choosing someone with a conflict of interest.
• Not notifying the AEPD when the DPO changes.
• Assuming the DPO solves everything.

Internal or external DPO

The duties are the same. An external DPO usually finds independence easier and brings experience from other organisations, while an in-house DPO knows the company better but often has other tasks. That is why many companies choose an external Data Protection Officer service.

Frequently asked questions

Is the DPO liable for fines?

No. Liability lies with the controller or processor. The DPO advises and monitors but does not take responsibility for the company’s decisions.

Does the DPO have to be on site?

The law does not require it. What matters is that the DPO is accessible to the company, data subjects and the authority.

How long is there to notify the appointment?

Ten days from the appointment under Article 34.3 LOPDGDD. Dismissals must also be notified.

Is your DPO doing the job?

If your company has a DPO but you do not know what they did this year, or you need one who truly supports the business, we can help. See our Data Protection Officer service.

This article provides general information and does not replace legal advice on a specific case.