[Last reviewed: January 2025]
Yes.
Yes.
If yes, under what circumstances?
☒ the processing is carried out by a public authority or body, except for courts acting in their judicial capacity
☒ the core activities of the controller or the processor consist of processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale
☒ the core activities of the controller or the processor consist of processing on a large scale of special categories of data
☒ other
In accordance with Spanish data protection legislation, data controllers and data processors must appoint a DPO in the following cases:
- Professional bodies and their general councils
- Educational establishments
- Entities operating electronic communications networks and services where they routinely and systematically process personal data on a large scale
- Information society service providers where they perform profiling of users on a large scale
- Credit institutions
- Credit financial institutions
- Insurance and reinsurance entities
- Investment services companies regulated by Securities Market legislation
- Distributors and marketers of electrical energy and natural gas
- Entities responsible for joint files for the evaluation of asset and credit solvency or for joint files for the management and prevention of fraud, including those responsible for the files regulated by legislation on the prevention of money laundering and the financing of terrorism
- Entities that carry out advertising and commercial prospecting activities, including commercial and market research, when they carry out processing activities based on the preferences of the affected parties or carry out activities that involve profiling
- Health centers legally obliged to maintain patients' medical records. Exceptions are health professionals who, although legally obliged to maintain patients' medical records, carry out their activity on an individual basis
- Entities that issue commercial reports that may refer to natural persons
- Operators that develop the activity of gaming through electronic, computer, telematic and interactive channels, in accordance with the regulation of the game
- Private security companies
- Sports federations when dealing with data of minors
[Last reviewed: January 2025]
Yes.
If yes, what are these requirements?
☒ legal qualifications / experience
The Spanish Data Protection Act states that the legal qualifications may be demonstrated, among others, through voluntary certification mechanisms that will take particular account of the award of a university degree proving the expertise in data protection law.