The GDPR, Regulation (EU) 2016/679 (RGPD in Spanish and Portuguese), is the European data protection law: it governs how organisations collect, use, keep and share personal data about individuals and gives those people rights over it. It has applied since 25 May 2018. It requires a data protection officer (DPO) only in some cases.
This entry is general information and is not legal advice. Verified on 15 October 2026 against the Regulation in the Official Journal of the EU (copy published by the Spanish BOE), Spain's Organic Law 3/2018 in the BOE (last update published on 27 December 2025) and the CNPD page on the DPO.
How it works
Every processing activity must respect the principles in Article 5 (lawfulness, specified purpose, minimisation, accuracy, limited storage, security), have a legal basis and respect rights such as access, rectification, erasure or objection.
The organisation must be able to show what it does: know what data it processes and why, put a contract or other legal act in place with each processor and apply technical and organisational measures appropriate to the risk. The controller notifies a personal data breach to the authority without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to people's rights and freedoms; the processor must tell the controller without undue delay. If a high risk is likely, the people affected are told too, with exceptions (for example, where the data was encrypted).
Data protection officer (DPO)
Article 37 requires one when a public body processes data (except courts acting in their judicial capacity), when core activities require regular and systematic monitoring of people on a large scale or when they consist of large-scale processing of special categories of data or criminal data. EU or national law can require one in other cases: Spain's Organic Law 3/2018 (article 34) adds cases and Portugal's Law 58/2019 (article 12) specifies which public entities must appoint one, according to the CNPD. Otherwise it is voluntary.
The DPO advises, monitors compliance and cooperates with the authority, independently.
Example
Illustrative example, not a real case. An online shop loses a laptop with unencrypted customer data. It records what data was on it and assesses whether a risk to people is likely: if so, it notifies the authority on time and, if the risk is high, the people; if not, it keeps a record of the assessment. Encryption and backups are prepared beforehand.
Limits
Complying with the GDPR is not a matter of publishing a policy or buying a tool. A DPO advises and monitors, but complying and demonstrating it stays with the organisation (Article 24).
When to call an expert
Ask for help if you do not know whether you must appoint a DPO, or if you have suffered a breach and the clock is running. To interpret the law in your case, consult a legal professional or a qualified DPO.
At Impulso Tecnológico we work on diagnosis, technical controls and training: we review access, encryption and backups, put in the technical controls that are missing and train the team. We do not give legal advice; our work is technical and training-based. See our cybersecurity service, the guide to building an IT security plan or tell us about your case.
Learn more
Related glossary terms: DLP, NIS2 and ISO 27001.
Official sources: Regulation (EU) 2016/679 in the Official Journal (Spanish-language copy; other languages are on EUR-Lex), Spain's Organic Law 3/2018 and the CNPD page on the data protection officer (in Portuguese).