Jurisdiction-specific data protection, defamation law, and removal process information for Spain. Last reviewed 2025.
Agencia Española de Protección de Datos (AEPD) is the supervisory authority for data protection in Spain. Individuals can file erasure and data-related complaints directly with this authority.
GDPR (EU 2016/679) and the Spanish Organic Law on Personal Data Protection and Digital Rights (LOPDGDD, Ley Orgánica 3/2018)
Spain's AEPD is one of the most active data protection authorities for right-to-be-forgotten requests. Spain initiated the landmark 2014 Google Spain v. AEPD ruling by the Court of Justice of the EU, which established the RTBF framework for all of Europe. The AEPD processes the highest volume of Google delisting complaints in the EU.
Spanish defamation law distinguishes between injurias (insults) and calumnias (false accusations of crimes), both criminal offences under the Spanish Criminal Code (Código Penal). The Spanish Constitution protects honor, privacy (intimidad), and self-image (imagen propia) as fundamental rights.
The AEPD processes erasure and delisting complaints and can issue binding decisions requiring Google and others to remove search results. Spanish courts can issue medidas cautelares (interim measures) for content removal. Constitutional Court case law extensively addresses privacy versus free expression.
Common Spanish sources requiring removal include El PaÃs, El Mundo, ABC.es, La Vanguardia, El Confidencial, 20minutos.es, and regional news outlets in Catalonia, the Basque Country, and Andalusia.
Spain's pioneering role in the RTBF via Google Spain v. AEPD means Spanish case law is directly relevant across the EU. The AEPD publishes detailed decisions on erasure requests, creating a rich precedent base that claimants can cite in similar cases across all EU member states.