Minors and special data
A minor can only give valid consent from the age of 14. The law also limits consent for special categories of data and regulates criminal records data and data about deceased people.
Organic Law 3/2018 · Law 34/2002
What Spanish law adds to the GDPR, in a single questionnaire.
For organizations operating in Spain: 48 controls covering what the LOPDGDD and the LSSI require on top of the GDPR. Minors, CCTV, the data protection officer, digital rights at work, dealings with the AEPD and everything that affects your website, cookies included.
- 48 controls in 9 sections
- Cookies under Art. 22.2 LSSI and the AEPD guide
- Cookie Policy template
LOPDGDD and LSSI auditIn progress
58%
Self-assessmentSample data
- Transparency and rights71%
- Data protection officer80%
- Digital rights in the workplace42%
- CCTV and specific processing55%
- LSSI: website, emails and cookies38%
48 controls on what Spanish law adds to the GDPR
9 sections, from digital rights to your website and cookies
63 mappings to the GDPR so you don't answer twice
5 languages: English, Spanish, French, Italian and German
What Spanish law adds
The GDPR is the baseline. In Spain you also have the LOPDGDD and, if you have a website, the LSSI.
The LOPDGDD adapts the GDPR to Spain and adds its own rights and obligations. The LSSI governs the information on your website, marketing emails and cookies. The Audexa questionnaire focuses on what these laws add, without repeating the GDPR.
Information and rights
Layered information with mandatory basic content, free and simple ways to exercise rights, and blocking of data after it is rectified or erased.
Data protection officer
The law lists the sectors that must appoint a DPO, such as schools, credit institutions and insurers, and requires the appointment to be notified to the AEPD within ten days.
CCTV and whistleblowing channels
Purpose, information signs and deletion of footage within a month. Internal reporting channels have to fit with data protection, in connection with Law 2/2023.
Digital rights at work
Rules for using company devices, a right-to-disconnect policy, prior information on workplace CCTV and employee geolocation.
LSSI: your website and emails
A legal notice with the provider's details, clearly identified marketing emails with an easy opt-out, online contracting and cookies with prior consent.
Sources: Organic Law 3/2018, consolidated text (BOE, Spanish) · Law 34/2002, consolidated text (BOE, Spanish) · Regulation (EU) 2016/679 (EUR-Lex)
How Audexa helps
From uncertainty about Spanish law to a plan with owners.
The same method as every other Audexa audit, applied to what only Spanish law requires.
Assess
Control by control, with guidance.
Guided questionnaire
Answer Yes, Partial, No or Not applicable. Each control explains how to assess it and what to look for.
Applicability with a reason
No cameras or no marketing emails? Mark the control as not applicable and record why.
Reuse what you already have
If you have already done the GDPR audit, its answers arrive as proposals for a person to review.
Fix
Every finding becomes a task.
How to meet each control
Concrete steps, expected evidence, suggested owner, closure criterion and when to review it.
Task plan
Findings turn into tasks with subtasks, owners and dates.
Cookie Policy
Start from the template in the policy library and adapt it to your website.
Prove
Keep the evidence at hand.
Evidence vault
Store your records of processing, CCTV signs, disconnection policy or banner configuration.
PDF and Excel report
Score, findings and plan for management or your DPO.
Re-audit
Assess again when your website, campaigns or workforce change, and compare progress.
Some features depend on your plan and active modules.
LSSI block
Your website, your marketing emails and your cookies, reviewed.
The LSSI has its own section with 9 controls. Cookies are assessed against Art. 22.2 LSSI and the AEPD guide: a banner with accept and reject at the same level, an inventory, a policy and a way to withdraw consent.
- Legal notice with the provider's general information
- Prior consent, the existing-customer exception and opt-out in every email
- Banner, inventory and Cookie Policy
- Prior information and confirmation in online contracting
LSSI: cookiesArt. 22.2 LSSI
- Accept and reject at the same levelPartial
- Cookie inventoryNo
- Cookie Policy publishedFrom template
- Withdrawal and proof of consentTask assigned
Digital rights at work
Devices, disconnection, cameras and employee geolocation.
The LOPDGDD requires clear rules when a company monitors devices, records or tracks its staff. Each control shows which document is expected, who usually owns it and when to review it.
- Rules for using company digital devices
- Internal right-to-disconnect policy
- Prior information to staff on CCTV
- Geolocation and safeguards in the collective agreement
Digital rights in the workplace6 controls
- Use of company devicesYes
- Right-to-disconnect policyNo
- Prior information on camerasPartial
- Employee geolocationNot applicable · no fleet
GDPR mappings
Already assessed the GDPR? You don't start from scratch.
There are 63 mappings between this questionnaire and the GDPR. When coverage is high, the answer arrives as a proposal and a person confirms it. When you create the audit, you see how much your existing work already covers.
- 63 LOPDGDD and LSSI ↔ GDPR mappings
- Only high coverage proposes a Yes, and it is always reviewed
- Coverage estimate when you pick the framework
- Not legal equivalences: a help to avoid repeating work
Proposed answersReview it
- Records of processingHigh coverage · proposed
- Layered informationPartial coverage
- DPO notification to the AEPDNo mapping
How it works
Three steps to see what Spanish law asks of you.
Pick the framework
In New audit, choose LOPDGDD and LSSI and see how much your other audits already cover.
Answer with guidance
Decide what applies, answer control by control and get your score and findings.
Close gaps and measure again
Assign tasks, store evidence, publish your Cookie Policy and re-audit when something changes.
Plans
LOPDGDD and LSSI is included from the Premium plan.
The Free and Core plans do not include this framework. Pricing depends on your organization's size: we give you a fixed quote in the demo.
Premium
RecommendedFor teams that want the full cycle.
- 10 audits a month
- LOPDGDD and LSSI plus the other new frameworks
- Policies, evidence, risks and tasks
- The Aude assistant
- 3 users and 200 assets per section
Diamond
For compliance operations without limits.
- Unlimited audits and users
- Everything in Premium
Frequently asked questions
What people usually ask us about LOPDGDD and LSSI.
What is the difference between the GDPR and the LOPDGDD?
The GDPR is the EU regulation and applies directly. The LOPDGDD adapts it in Spain and adds its own rules, such as the age of 14 for a minor's consent, the sectors that must appoint a DPO, CCTV and digital rights at work. This questionnaire covers only what Spanish law adds.
What does the LSSI require for cookies?
Art. 22.2 LSSI requires you to inform users and obtain consent before setting cookies that are not strictly technical. The AEPD guide sets out how, for example with a reject button at the same level as the accept button. Audexa reviews this in separate controls: banner, inventory and policy, and withdrawal of consent.
Does the LOPDGDD apply to companies outside Spain?
It is relevant to organizations operating in Spain that process personal data, and the LSSI to websites and online services aimed at the Spanish public. The questionnaire is available in English, Spanish, French, Italian and German.
Does Audexa certify us or issue a LOPDGDD compliance report?
No. There is no LOPDGDD certification and Audexa does not declare that you comply. It gives you a self-assessment for guidance, an action plan and a PDF and Excel report of where you stand. It is not legal advice.
We already did the GDPR audit in Audexa. Do we answer everything again?
No need. There are 63 mappings to the GDPR. High-coverage ones propose the answer, which a person reviews and confirms. The rest serve as a reference.
Do we need a Cookie Policy?
If your website uses non-technical cookies, you have to inform users about them. Audexa includes a Cookie Policy template in its library of 67 templates, so you can adapt it, approve it and keep it as evidence. It is one of the 8 linked to the LOPDGDD and the LSSI, together with “Privacy and Data Protection Policy”, “Commercial Communications, Legal Notice and Electronic Contracting Policy”, “Data Subject Rights Handling Procedure”, “Personal Data Breach Management and Notification Procedure”, “Procedure for Processors, Sub-processors and Joint Controllers”, “Procedure for Handling Authority Requests and Data Disclosure” and “Data Retention Policy”.
Request a demo
See what your LOPDGDD and LSSI review would look like.
In a 30-minute demo we walk through the questionnaire, the cookie controls, the task plan and the report.
- We look at which parts of Spanish law affect you.
- We show you how your GDPR audit is reused.
- We explain which plan fits your team.