Spanish customer service law (Law 10/2025): what companies must change before 28 December 2026

The Spanish customer service law, officially Law 10/2025 of 26 December regulating customer service, is already in force. In addition, companies in scope have until 28 December 2026 to adapt. Almost everything published so far focuses on the three-minute waiting time and the right to speak to a person. However, the law has a part that few are looking at: call recordings, bots, call centres outside Spain and audits. In other words, data protection. In this article we summarise what the law requires, who it affects and what your company needs to review.

What the Spanish customer service law is and when it applies

Law 10/2025 was published in the Spanish Official Gazette on 27 December 2025 and came into force the next day. Its single transitional provision gives companies twelve months to adapt their customer service. Therefore, the deadline is 28 December 2026.

Note, however, that one part arrives earlier. Sales calls by companies in scope must come from 400 numbers once the deadline of the implementing resolution expires on 17 October 2026. We explain it in detail in 400 prefix for sales calls in Spain.

Which companies does the Spanish customer service law affect?

Article 2 distinguishes two groups. First, companies providing basic services of general interest, whatever their size: water, gas and electricity; passenger transport by air, rail, sea or bus; postal services; electronic communications and financial services. It also covers foreign companies offering those services in Spain.

Second, other companies selling mainly to consumers that, in the previous financial year, individually or as a group, reached at least one of these thresholds:

• 250 employees.
• More than 50 million euros in turnover.
• More than 43 million euros in total assets.

As a result, a company that sells mostly to other businesses falls outside this second group. So does a small business selling to consumers, unless it belongs to a group above the thresholds. By contrast, a small company in a basic sector is in scope. Finally, there are special rules. The financial sector is governed by its own sector rules, and several articles do not apply to it, including those on surveys, annual evaluation, audits and penalties (arts. 18, 21, 22 and 23). Electronic communications are also mainly governed by their sector rules. In addition, the law covers public companies and the Spanish central government when there is a consumer relationship.

The main obligations of the Spanish customer service law

Human attention and waiting times

• A person always available (art. 8). Answering machines, bots or similar tools are banned as the only channel. Customers may ask to speak to a person at any time, from the very start.
• Three minutes (arts. 8 and 10). 95% of calls and of requests for personal attention must be answered, on average, in under three minutes. Moreover, companies cannot cut a call because of a long wait (art. 8.4).
• Identification. The agent must identify themselves at the start of the conversation. In addition, an unsatisfied customer may ask to be transferred to a supervisor or a quality department.
• Priority for elderly people and people with disabilities in telephone service.

Response deadlines

• Fifteen working days at most to resolve queries, complaints, claims and incidents (art. 17.1), unless sector rules set another period.
• Five days for billing or undue charge complaints (art. 17.3).
• Two hours to respond to an outage or suspension of a basic service, with the cause and the estimated restoration time (art. 17.2).

Channels, languages and cost

• The service must be free of charge. In addition, calling cannot cost more than a standard call to a landline or mobile, and a free number cannot redirect to a paid one.
• In regions with a co-official language where the company operates, customers may use that language and must receive the reply in the same language (arts. 7.2, 8.6 and 13.6).
• The service must be accessible to people with disabilities and elderly people.
• In ongoing service contracts, the company cannot suspend the service after a complaint directly related to the reason for the suspension until it is resolved. The exceptions are safety or different sector rules (art. 4.4).

Annual evaluation and audit

In addition, the law requires an annual quality evaluation system for the service (art. 21). An audit firm accredited by ENAC, the Spanish accreditation body, must audit it every year (art. 22). Moreover, the documentation and the audit must be published on the website, kept for at least five years and made available to the authorities. Companies with fewer than 250 employees and up to 50 million euros in turnover or 43 million in total assets may evaluate and audit every two years, if their volume of queries and complaints justifies it.

The part almost nobody mentions: data protection

Article 20 of the law is blunt: all processing of personal data to provide the service must comply with the GDPR and the Spanish Data Protection Act (LOPDGDD). In addition, article 23 refers data protection infringements to that legislation and to the competent data protection authority. Therefore, adapting customer service without reviewing privacy leaves a second front open. These are the four areas where we see the most risk.

1. Call recording: mandatory if the customer consents

Article 12.1 changes the usual approach. If a customer files a complaint by phone, video call or messaging and gives express consent, the company must record the call. In addition, it must explain in the receipt how to access the recording and keep it, or its transcript, at least until the decision is notified. The same rule applies if the decision is communicated by phone, video call or messaging (art. 13.5).

In practice, this means reviewing three things. First, how express consent is collected and proven. Second, the data protection notice in the initial message. And third, the retention period: once the complaint is resolved, the recording cannot be kept indefinitely without another justification.

One important nuance: express consent is a requirement of Law 10/2025, but the GDPR legal basis should be analysed separately. In our view, it is probably compliance with a legal obligation (an interpretation, with no AEPD guidance yet).

2. Bots and artificial intelligence

The law does not ban bots or AI. In fact, its preamble accepts systems that make communication easier. What it bans is using them as the only channel: there must always be a button to speak to a person. In addition, from 2 August 2026, article 50.1 of the EU AI Act requires AI systems that interact with people to be designed to tell them they are talking to an AI, unless it is obvious. The obligation falls on the provider of the system, but the company using it should make sure it is met.

Moreover, if the bot takes decisions based solely on automated processing with legal or similarly significant effects for the customer, such as refusing a refund, article 22 GDPR applies. If you use an AI assistant, we review it through our artificial intelligence lawyers service.

3. Outsourced call centres and call centres outside Spain

Many companies outsource customer service. In that case, the provider normally acts as a data processor and needs an article 28 GDPR contract. However, the biggest risk is location. If the call centre is outside the European Economic Area, there is an international data transfer. If the country has no European Commission adequacy decision (Argentina and Uruguay do; Morocco, Colombia or Peru do not), article 46 GDPR safeguards are needed, usually standard contractual clauses, together with a transfer impact assessment.

In addition, the law applies wherever the contact point is located and even if a third party provides the service (art. 2.3). Therefore, outsourcing does not release the company: it remains responsible for the three minutes and every other obligation, and it must pass them on to the provider by contract.

4. Satisfaction surveys and quality data

The law requires a customer satisfaction system, but it bans running the survey before the complaint is resolved (art. 18). In addition, under the GDPR purpose limitation principle, evaluation and audit data must only be used for the purpose they were collected for. Using those recordings or surveys to profile customers or to sell requires its own legal basis.

Penalties under the Spanish customer service law

Article 23 refers infringements to the consumer protection penalty regime and to regional rules. If sector rules have their own regime, that one applies. On the other hand, data protection infringements are penalised under the GDPR and the LOPDGDD. Moreover, the law treats repeat offences as aggravating and repairing the damage as mitigating. As a result, the same breach may have consequences both in consumer law and in data protection, if it affects different legal interests.

Checklist: what to review before 28 December 2026

1. Scope: confirm whether your company or its group is in scope (sector and last year’s thresholds).
2. Channels: list the phones, chats, web forms, apps and social networks where you serve customers. Check that they are free and accessible.
3. Bots and IVR: they must always offer the option to speak to a person and, if they are AI systems, disclose it unless it is obvious.
4. Timing: measure whether you meet 95% in under three minutes and the 15-day, 5-day and 2-hour deadlines.
5. Recordings: a message with express consent and data protection information, customer access to the recording and a retention period.
6. Providers: processor contracts with the call centre and, if it is outside the EEA, safeguards for the international transfer.
7. Record of processing activities: add or update the customer service, recording and survey activities.
8. Evaluation and audit: design the annual quality system and hire the accredited auditor in good time.
9. Sales calls: separate the sales number (400) from the customer service number.

FAQ about the Spanish customer service law

When does the Spanish customer service law come into force?

It came into force on 28 December 2025. However, companies have twelve months to adapt, that is, until 28 December 2026.

Does it affect small businesses?

It depends. If the small business provides a basic service (for example, passenger transport or financial services, subject to their sector rules), yes. By contrast, if it sells other goods or services and does not exceed the thresholds, alone or with its group, it is out of scope.

Is it forbidden to use a chatbot or artificial intelligence?

No. What the law bans is using it as the only channel. Customers must be able to ask for a person at any time. In addition, from August 2026 the AI system must tell them they are talking to an AI, unless it is obvious.

Do I have to record customer service calls?

For complaints and claims by phone, video call or messaging, yes, if the customer gives express consent. In addition, you must tell them how to access the recording and keep it at least until the decision is notified.

How long do I have to answer a complaint?

Fifteen working days as a general rule, five days for billing complaints and two hours for an outage in a basic service.

How we can help

At Auratech Legal we review customer service from a data protection angle: recordings, bots, call centre contracts, international transfers and records of processing. If your company must adapt before 28 December, see our data protection advisory service. And if you prefer ongoing support, our outsourced data protection officer service includes it.

Sources: Law 10/2025 of 26 December (BOE-A-2025-26698), arts. 2, 8, 10, 12, 17, 18, 20 to 23 and single transitional provision; Regulation (EU) 2024/1689 on artificial intelligence, art. 50; Regulation (EU) 2016/679 (GDPR), arts. 22, 28 and 44 onwards.

This article provides general information and is not a substitute for legal advice on a specific case.