Data protection lawyers in Spain
Your name has ended up on a credit blacklist, a camera is filming you, nobody answers when you ask for your data to be deleted, or it is your company that has received a penalty proposal from the AEPD (the Spanish data protection authority). Our data protection lawyers act on both sides: for the individual bringing the complaint and for the company that has to defend itself. And we separate from the outset two things that are constantly confused: the AEPD fines the infringer, but compensation for you is claimed separately, in the civil courts.
What we handle
You have been listed on a credit blacklist over a disputed debt
Immediate deletion of the entry and, alongside it, a civil claim for damage to reputation: the debt must be certain, due and payable, and a prior demand for payment must have been sent (art. 20 of the Spanish Data Protection Act).
A neighbour's camera is filming you
A private camera may only cover its owner's own space. Formal demand to reposition it, complaint to the AEPD and, in parallel, a civil claim for an injunction and damages (art. 22 of the Data Protection Act and Organic Act 1/1982 on privacy).
The AEPD has opened proceedings against you
Defence of the party under investigation: written submissions, the mitigating factors in art. 83 GDPR and the two cumulative 20 % reductions for admitting liability and for early payment before the decision is issued (art. 85 of Act 39/2015).
Your name still comes up in Google over an old matter
Delisting request to the search engine and to the publisher, and a claim before the AEPD if they refuse: the public interest in the information fades with time (art. 17 GDPR and arts. 93 and 94 of the Spanish Data Protection Act).
Your customer data has been breached
The 72 hour notification to the AEPD and the communication to those affected, plus the defence of the file that follows: whatever is written in that first report will be used against you later.
You asked for deletion and got no answer
Once the one month deadline passes, we file a rights protection claim with the AEPD, which must resolve within six months, and in parallel a claim for the damage suffered (arts. 12.3 and 82 GDPR and art. 64.1 of the Spanish Data Protection Act).
You were dismissed on the strength of CCTV footage
We challenge the dismissal and ask for that evidence to be excluded because the worker was never informed, within twenty working days of the dismissal letter (arts. 89 and 90 of the Data Protection Act and art. 11.1 of the Judiciary Act).
How we work on it
We start by identifying who the controller is and what legal basis they rely on, because that decides whether there is an infringement or merely a nuisance. Then we choose the route: a complaint to the AEPD, which is free and can end in a fine but does not put a single euro in your pocket, or a civil claim under art. 82 GDPR, which is the one that pays compensation. Often both run together, and the order matters, because the AEPD decision later serves as evidence. When the client is the company, the work is the opposite: contain the file, admit only what has to be admitted and use the early payment reductions, which are lost if an appeal is filed first.
Your matter is quoted after the consultation, because every case is different. The consultation fee is credited in full against the engagement if you go ahead.
Frequently asked questions
If I complain to the AEPD, will I be compensated?
No. The AEPD fines the company and that fine goes to the Treasury, not to you. Your compensation is claimed in the civil courts under art. 82 GDPR, and the AEPD decision is excellent evidence for that claim.
How long does the AEPD take to decide?
A rights protection claim has a six month maximum. Penalty proceedings usually run slower. That is why, when the harm is financial, we do not wait for the AEPD before preparing the civil claim: the two run in parallel.
My company has received a penalty proposal. Can it be reduced?
Yes. Besides challenging the substance and the art. 83 GDPR mitigating factors, there are two cumulative 20 % reductions for admitting liability and for paying before the decision is issued. In exchange you waive the right to appeal, so the decision is taken with the figures in front of you.
What does a data protection claim cost?
We assess the matter in the initial consultation, 100 euros for thirty minutes or 200 euros for one hour, and we tell you there and then whether you have a case. That amount is credited in full against the engagement, and the fixed quote follows once we know the route and the opposing party.
Law firm guides on this area
The dispute explained: what action lies, what deadline is running and what has to be proved.
- They listed you on ASNEF over a debt you dispute
- Your neighbour's camera points at your home: how to stop it
- The AEPD opens a file over your cameras: cutting the fine
- Your name in Google over an old case: the right to be forgotten
- Your clients' data has leaked: the 72 hours and what follows
- Your erasure request is ignored: taking it to the AEPD
- Dismissed on camera footage: when that evidence is void