Tranquilidad con simplicidad
Articles on the GDPR, the LOPDGDD and the EU AI Act, written to be understood, with the official sources linked. If we don’t know something, we say so.
Criminal compliance
What a code of ethics and conduct is, why it is a key piece of the crime prevention model in art. 31 bis of the Código Penal, and how it connects with the rest of criminal compliance.
Keep reading
Data protection
What the data protection impact assessment (EIPD) under art. 35 RGPD is, in which cases it is obligatory for an SME and what happens if you process high-risk data without having done one.
Occupational risk prevention
What the occupational risk assessment by job role is, why Ley 31/1995 and RD 39/1997 require it, and how it connects with the planning of prevention measures.
Criminal compliance
What the criminal risk map is, why art. 31 bis of the Código Penal requires you to identify the activities where offences could be committed, and why it is the first piece of compliance that works.
Occupational risk prevention
What the emergency and evacuation measures plan is, why art. 20 of Ley 31/1995 requires any company with workers to have one, and what it must include to be genuinely useful.
Criminal compliance
What the crime prevention plan or criminal compliance model is, why art. 31 bis of the Código Penal turns it into a shield against your company's criminal liability, and why it also matters to a small business.
Occupational risk prevention
What the occupational risk prevention plan is, why Ley 31/1995 requires it of any company with at least one worker, and what you risk before the Inspección de Trabajo if you do not have one.
Data protection
What the cookie policy is, what art. 22.2 of the LSSI and the RGPD require about consent, and why a banner that does not let people refuse is one of the things the AEPD penalises most.
Employment records
What the digital disconnection policy is, why art. 88 of the LOPDGDD requires every company to draw one up, and how it relates to your employees' right not to be available outside their working hours.
Data protection
What the privacy policy must include under arts. 13 and 14 of the RGPD, where you have to show it on your website and your forms, and what risk you run if you don't inform people properly.
Data protection
What rights the RGPD recognises (access, rectification, erasure, objection and more), how long you have to reply and why it is worth having a written procedure before the first request arrives.
Occupational risk prevention
What the protocol against sexual harassment and harassment on grounds of sex is, why art. 48 of LO 3/2007 requires it of any company whatever its headcount, and what LO 10/2022 reinforces.
Criminal compliance
What the disciplinary regime is within criminal compliance, why art. 31 bis of the Código Penal requires a system that penalises breaches of the model, and how it rests on the Estatuto de los Trabajadores.
Data protection
What the record of processing activities under art. 30 RGPD is, why the exemption for companies with fewer than 250 employees almost never applies to you and what risk you run if you do not have it.
Data protection
What the consent record is, why art. 7 of the RGPD requires you to be able to prove that the person said yes and how to avoid the pre-ticked box mistake.
Occupational risk prevention
Why Ley 31/1995 requires you to train and inform your workers (arts. 18 and 19) and to give them personal protective equipment (RD 773/1997), and why without a record it is as if you had not done it.
Employment records
What the daily working time record is, why art. 34.9 of the Estatuto de los Trabajadores makes it obligatory for your whole workforce, and what risk of a serious penalty you run if you don't keep it.
Employment records
What the pay register is, why RD 902/2020 and art. 28 of the Estatuto de los Trabajadores require it from any company with workers, and what employment risk you run if you don't have it.
What a data security breach is, when you have 72 hours to notify the AEPD and what you have to document even if you notify nothing, with the official RGPD and AEPD sources.
The 10 minimum steps to get your business compliant with the RGPD, with the exact article that backs each one. Designed for you to do it yourself, without jargon, in 15 minutes.
What RGPD obligations a dental clinic has for processing health data: when a data protection officer (DPO) is needed, when an EIPD has to be carried out and what consents to ask patients for. With official sources and a real penalty case.
When the processor contract is obligatory, which providers you have to sign it with and what it must include as a minimum, under art. 28 of the RGPD and the AEPD's guidance.
RGPD gestorías
Which documents, deadlines and obligations the RGPD and the LOPDGDD impose on a Spanish gestoría or asesoría in 2026: record of processing activities, processor contract, data protection officer, security breaches and your clients' rights, with official sources (AEPD, BOE, EUR-Lex).
RGPD gestorías
The LOPDGDD does not replace the RGPD, it completes it. What obligations the Spanish law adds that are not in the European regulation: minors, deceased people, video surveillance, the data protection officer and the digital rights in title X, with the exact article and official sources (BOE, EUR-Lex, AEPD).
When you can send a newsletter or a commercial email, what the Lista Robinson is and how to ask your customers for permission without risking a spam penalty, with the official sources (LSSI, LOPDGDD, RGPD, AEPD).
AI Act
What the European AI Act (Reglamento (UE) 2024/1689) already requires of a Spanish SME, what changes on 2 August 2026 and what has been moved by the «Digital Omnibus» approved by the Council of the EU on 29 June 2026. With official sources (EUR-Lex, Council of the EU, AEPD, BOE) and a clear timeline, with no invented dates.
Use cases
What data protection paperwork a bar or restaurant in Spain needs: record of processing activities, clauses for customers and employees, camera sign, contract with suppliers and more. Explained without jargon, with official sources.
The AEPD imposed 281 fines worth 35,592,200 € in 2024. We go through 3 real, public cases against small businesses —cameras, defaulters registers, sales calls— with a link to the original decision for each one.
AI Regulation
If you use ChatGPT, Copilot or another AI in your business, two sets of rules apply to you at once: the RGPD and the new European AI Regulation. What is obligatory now, what arrives in August 2026 and how to comply, with official sources.
Which sign you need if you have cameras, how long you can keep the recordings and what someone caught on camera can ask you for. With the official AEPD sources and Spanish law.