The increasing internationalisation of data processing led to the unitication of rules in the framework of the European Union.

The current regulations on data protection, privacy and information security, in particular the EU General Data Protection Regulation GDPR), establish the framework of compliance that ensures the safeguarding and protection of the personal data of consumers, users and other individuals who provide their data to all types of companies and for all types of purposes. Its main objective is to protect the rights of individuals to prevent them from losing control over their personal data and to guarantee their privacy.

The protection granted by GDPR is manifested through the recognition of a number of rights in relation to people’s data, such as the right to receive transparent and complete information about the processing of their data, as well as the right to access, rectify and erase the data (the so called right to be forgotten), restriction of processing, portability objection and processing based on automated individual decisions.

In the time elapsed since the entry into force of the GDPR, the Spanish Data Protection Agency has already processed numerous sanctioning procedures against entities that have violated data protection regulations. With sanctions of up to 3 million euros, the Agency has made it clear that any breach of the regulation will entail serious consequences. It becomes essential to bear in mind that the GDPR contemplates sanctions that could reach up to 20 million euros or, in the case of a company, an amount equivalent to a maximum of 4% of the total annual global turnover of the previous financial year.