The LOPDGDD adapts the EU's General Data Protection Regulation (GDPR) to the Spanish legal framework, strengthening the fundamental rights of individuals in the digital environment.
Phase 1, Adaptation and Implementation
Analysis, documentation, and impact assessments
Phase 2, Training and Awareness
Proactive staff accountability
Phase 3, Support and Maintenance
Ongoing advice and updates
Phase 4, Audit and DPO
Compliance verification and external DPO
The regulations
What is the LOPDGDD?
The LOPDGDD is Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights, the main regulation in Spain that protects citizens' privacy and adapts the EU's GDPR to our country. It emerged to strengthen individuals' fundamental rights by creating a standard applicable to companies and public bodies in the digital world, and to avoid the fragmentation of regulations that can arise in different national systems, thus providing a joint line of action.
The LOPDGDD determines, among other aspects, what requirements are necessary when collecting personal data, providing at least the following information:
Processing, purpose and recipients
Exercise of rights
Identity and contact details of the controller
Legal basis for processing
Data retention periods
Use of data for profiling
Compliance of international transfers with the legal framework
It also makes a double distinction between personal digital rights and those that affect individuals in the workplace.
Other aspects that the regulation also covers are the minimum age of consent, the possibility of being able to withdraw minors' data during their minority, the possibility of exercising the right of access, rectification, or deletion regarding the data of a deceased person, or the establishment of the maximum period for keeping personal data related to the non-fulfillment of monetary obligations in information systems.
Our services
How we work
Our framework has also been strengthened by the Guide on the use of cookies published by the AEPD, in effect since October 31, 2020, which is a compendium of the guidelines and obligations included in the LSSI and LOPDGDD.
Internet Security Auditors covers a wide range of services to help your company align with the regulations:
01Adaptation and Implementation
Analysis of the company's compliance level.
Drafting of security documentation, such as policies, standards, procedures, and instructions.
Execution of data protection impact assessments.
Adaptation of legal texts in forms, contracts, or other documents.
02Training and awareness
All your company personnel must know what their obligations are, based on the principle of proactive responsibility established by the regulation, which implies that the Data Controller will be responsible for compliance with the provisions of the GDPR and must be able to demonstrate it.
Internet Security Auditors offers a personalized training service to meet this requirement through our e-learning platform.
03Support and maintenance offices
We offer companies support tailored to their needs for:
Consultations.
Technical and legal advice.
Documentation updates.
Information on regulatory changes.
Periodic monitoring and control visits.
04Control audit
To verify your company's compliance status regarding the reference legal framework.
05Data Protection Officer
We offer an outsourced Data Protection Officer (DPO) service for those organizations that decide to outsource the service or do not wish to have it as part of their staff.
If your company fails to meet its legal obligations, it may face fines of up to 20 million euros or the equivalent of 4% of its total annual global turnover, not to mention the reputational consequences and loss of credibility with its clients.
Assessment of the organization's level of compliance with the GDPR and the LOPDGDD, with identification of gaps.
Impact evaluations
Execution of data protection impact assessments for high-risk processing.
Legal texts and contracts
Adaptation of information notices, forms, data processing agreements, and website legal texts.
Training
Personalized training and awareness program via an e-learning platform for all staff.
Support and maintenance office
Support tailored to the company's needs: consultations, technical and legal advice, documentation updates, information on regulatory changes, and periodic monitoring and oversight visits.
Control audit
Periodic verification of compliance status with respect to the reference legal framework.
External DPO
Outsourced Data Protection Officer service, fulfilling all functions required by the GDPR.
Testimonials
What our clients say
Working with Internet Security Auditors has been a highly satisfactory experience. Their support in migrating to the ISO/IEC 27001:2022 standard, conducting internal audits, and the PCI DSS certification process has been fundamental to strengthening our information security management system.
Ricardo Andrés Cárdenas Galvis
Information Security Office · Neurona
The strategic support of Internet Security Auditors as CISOaaS has been fundamental in strengthening our internal team. Their expertise perfectly complements our CISO's work and has allowed us to advance more quickly in our cybersecurity maturity.
CISO
RACC
On behalf of Outsourcing SAS BIC, we would like to express our gratitude for your commitment and dedication during the implementation of PCI DSS compliance in our call center. We succeeded in establishing a secure environment in accordance with the most demanding requirements of the payment industry.
Yulian Colmenares
Information Security Office · Outsourcing SAS BIC
Working with Internet Security Auditors has been a positive experience in every way. Their team combines solid technical expertise with a great willingness to collaborate, which has strengthened our security posture and regulatory compliance.
Andrés Mejía
Head of GRC · Payválida
As CFO of Saint Louis University – Madrid Campus, I have had the opportunity to work with Internet Security Auditors. They have been our indispensable partner in implementing the requirements set forth by GDPR regulations. I would like to highlight their availability to resolve questions and their ability to develop a legal framework with concrete and understandable actions…
Victoria Villarreal Palazón
Vice President & Associate VP CFO · Saint Louis University
As CFO of Fleurop - Interflora Spain, we have worked with Internet Security Auditors for years in the areas of consulting and GDPR compliance. As Interflora is a company 100% focused on online commerce, the professional services of Internet Security Auditors provide us with support, security, and the peace of mind that all of our activity is aligned with GDPR compliance.
Francisco Tébar Prada
CFO Southern Europe · Fleurop - Interflora Spain
As CISO at Intaremit S.A., we place the utmost importance on logical security. This is not only due to the fact that PCI-CPP regulations require us to perform four internal and external vulnerability scans and an annual internal and external pen test, but also because of the security and peace of mind our company aims to provide to each and every one of its clients. We have been working and collaborating with Internet Security Auditors for over 10 years due to their experience, commitment, and accessibility; therefore, I recommend them without hesitation.
Sergio Sainz de la Maza
CISO · Intaremit
At Grupo Arbulu, we have worked closely with Internet Security Auditors on the implementation of advanced cybersecurity measures. Thanks to their expertise, we have significantly improved our ability to detect and mitigate cyber risks. Their comprehensive audits and customized solutions have strengthened our security infrastructure, ensuring the protection of our data and the continuity of our operations.
Marcos Montes de Oca
CIO · Arbulu Group
As CEO of Beruby, we worked with Internet Security Auditors when we had to urgently complete a PCI DSS Attestation of Compliance. The entire process was extremely fast, efficient, and professional. Their team provided us with excellent support, demonstrating great technical knowledge and commitment. We undoubtedly recommend their services to any company in need of cybersecurity solutions.
Miguel Acosta
Global CEO · Beruby
At Grupo AR, we highly value the brand protection service from Internet Security Auditors for its comprehensive and proactive approach. Their highly qualified team allows us to identify and mitigate risks that could affect the AR Construcciones brand and its various companies.
Nestor Ivan Melo Ballen
Cybersecurity Director · AR Group
Frequently Asked Questions
We answer your questions
What is the GDPR and to whom does it apply?
The General Data Protection Regulation (GDPR) is the European regulation that governs the processing of personal data. It applies to all companies and public bodies that process the personal data of individuals in the EU, regardless of where the organization is established.
What is the LOPDGDD?
The Organic Law on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD) is the adaptation of the GDPR to the Spanish legal framework. It complements the European regulation with specific provisions, including digital rights in the workplace and the minimum age of consent.
What are the penalties for non-compliance?
The penalties can reach 20 million euros or 4% of the company's total annual global turnover, whichever is higher. In addition to the economic impact, non-compliance entails reputational consequences and a loss of credibility with clients.
Is it mandatory to have a Data Protection Officer (DPO)?
It is mandatory in certain cases: public authorities and bodies, organizations that carry out regular and systematic monitoring of data subjects on a large scale, or that process special categories of data on a large scale. Internet Security Auditors offers an external DPO service to meet this need.
What does the data protection impact assessment include?
The data protection impact assessment (DPIA) is an analysis of the risks that personal data processing may pose to the rights and freedoms of individuals. It includes a description of the processing, an assessment of necessity and proportionality, a risk analysis, and measures to mitigate them.
Contact
Do you need to comply with the GDPR?
Tell us about your situation and our team will get in touch with you to provide guidance or schedule a technical call.
R
Ricardo Andrés Cárdenas
2 months ago
Working with Internet Security Auditors has been a highly satisfactory experience. Their support in the migration to ISO/IEC 27001:2022 and the PCI DSS certification process has been fundamental in strengthening our ISMS.
A
Andrés Mejía
3 months ago
Your team combines solid technical expertise with a great willingness for collaborative work, which has strengthened our security posture and regulatory compliance.
V
Victoria Villarreal Palazón
4 months ago
They have been our indispensable partner for the implementation of GDPR requirements. I would highlight their availability to resolve questions and their ability to develop a legal framework with concrete and understandable actions.
M
Miguel Acosta
5 months ago
The entire PCI DSS Attestation of Compliance process was extremely fast, efficient, and professional. We undoubtedly recommend your services to any company in need of cybersecurity solutions.
S
Sergio Sainz de la Maza
6 months ago
We have been working with Internet Security Auditors for over 10 years because of their experience, commitment, and accessibility. I recommend them without hesitation.
Request information
Global Presence
Our offices
Barcelona
C. Santander, 101. Building A-2 E-08030 Barcelona (Spain)
