News

Due Diligence Obligations in the Spain: Lessons learnt from AEPD Sanctions and future trends

Amid the EU's rapidly evolving due diligence landscape, this article unpacks Spain’s tough stance on data protection compliance and reveals how landmark AEPD fines have sounded a wake-up call: businesses must rigorously vet their third-party providers or face costly consequences.

I. Introduction: A Shifting Legal Landscape in the EU

In recent years, the European Union has significantly expanded its regulatory framework on due diligence obligations, especially in the context of supply chain integrity. The enactment of specific regulations in fields of sustainability, resilience, cybersecurity and corporate governance among others, exemplify this trend. This broader legal context underscores the EU’s commitment to embedding due diligence into corporate structures.

However, due diligence is not a uniform concept across all areas of law. In the data protection sphere, the General Data Protection Regulation (GDPR) imposes distinct and stringent obligations that require businesses to carefully manage and oversee data processing activities performed by third-party service providers. The Spanish data protection regime—shaped by both the GDPR, the local data protection law (LOPDGDD) and the national supervisory authority, the Agencia Española de Protección de Datos (AEPD)—offers a compelling illustration of how due diligence has become a cornerstone of compliance in this domain.

II. Due Diligence in Data Protection under Spanish Law and practice

Under the GDPR, when a data controller engages a processor, the controller retains ultimate responsibility for ensuring that data processing is lawful, secure, and transparent. The Spanish approach, firmly aligned with the GDPR, emphasizes that controllers must undertake comprehensive due diligence of their service providers. This includes assessing whether processors have implemented appropriate technical and organizational measures, such as secure data processing protocols and robust internal controls.

Key areas for scrutiny usually include:

1. Verifying the appointment of a Data Protection Officer (DPO) when required.
2. Reviewing processors’ records of processing activities.
3. Ensuring the existence of strong security measures, including certifications and staff training.
4. Confirming whether subprocessors are engaged only with the explicit authorization of the controller.
5. Assessing whether any international data transfers comply with the GDPR’s stringent requirements.
6. Determining whether the processor has faced recent data breaches, sanctions or investigations by the AEPD.

As confirmed by Spanish jurisprudence, these due diligence obligations are not mere formalities. For instance, the Spanish Supreme Court has clarified that a controller cannot rely on indemnity clauses to shift responsibility for GDPR violations if the breaches are rooted in its own systemic failures to supervise processors. Consequently, due diligence is both a contractual and a statutory duty: it is an ongoing process that shapes the legal and operational relationship between controllers and processors.

 

III. Recent AEPD Sanctions: A Wake-Up Call for Spanish Businesses

The AEPD has imposed substantial penalties on companies for failing to meet their due diligence obligations in data protection. These cases illustrate the heightened risk of administrative liability when due diligence is inadequate:

a) Telecommunications sector (PS/00059/2020): Fine for €8.15 million for failing to ensure that its agents and subcontractors abroad complied with the GDPR’s processor obligations. The AEPD found that the company’s due diligence processes were insufficient to verify whether the agents had adequate data protection measures in place.

b) Energy sector (PS/00477/2022): The company’s processor was sanctioned €15,000 for engaging sub processors without the controller’s authorization and for obstructing the AEPD’s investigative efforts. This case further reinforced the necessity for controllers to scrutinize subcontracting practices by processors.

c) Insurance sector (PS/00453/2023): The organization faced a €5 million fine after a data breach exposed sensitive data of over one million individuals. The breach was linked to serious security deficiencies in the IT systems used by mediators. The AEPD concluded that the company had failed to supervise its mediators adequately, revealing significant shortcomings in its due diligence processes.

 

IV. Implications for Businesses: Reinforcing Third-Party Oversight

These examples highlight a clear trend: the AEPD is focusing on the controller’s responsibility to monitor and verify the data protection practices of processors. Controllers cannot afford to treat due diligence as a one-off exercise. Instead, they must establish dynamic and continuous processes for assessing their providers’ compliance and updating contractual frameworks accordingly.

The message is unequivocal: Spanish businesses face substantial financial and reputational risks if they fail to conduct proper due diligence on their third-party service providers. As such, implementing comprehensive third-party risk management (TPRM) and ongoing audits is not merely good practice—it is essential to avoid the growing wave of administrative sanctions. This is of special importance knowing the significant allocation of resources that an efficient TPRM implies and that often these processes are not substantial but more paper-based compliance.

 

V. Conclusion: The Need for a Proactive Compliance Culture & Certification Initiatives

The EU’s evolving due diligence landscape, coupled with Spain’s stringent data protection regime and the AEPD’s robust enforcement, leaves no doubt that businesses must treat third-party oversight as a core element of their compliance strategy. In this new era of accountability, companies cannot rely solely on indemnification clauses or disclaimers. Instead, they must integrate due diligence into their operational DNA—ensuring that every processor is fully aligned with data protection standards and that all processing activities are transparent, secure, and respectful of individuals’ rights.

In that sense, various local associations of privacy and information security professionals have been calling out for standardized TPC certifications in privacy as a best practice method that would give additional assurances for compliance both for controllers as well as processors that provide them services. It is expected that in the following months the first such certification mechanism focused specifically on data processor due diligence shall be made public.

By prioritizing third-party reviews and investing in robust compliance frameworks, Spanish companies can not only avoid costly penalties but also demonstrate their commitment to data protection and responsible business conduct. In an increasingly interconnected and regulated world, this proactive approach is not just advisable—it is imperative.

 

Article provided by INPLP members: Esmeralda Saracíbar and Nikola Kovacic (ECIX, Spain)

 

 

Discover more about the INPLP and the INPLP-Members

Dr. Tobias Höllwarth (Managing Director INPLP)