Use a lawful basis, provide transparent notices, enable rights and implement risk-appropriate security.
Controllers/processors within GDPR material and territorial scope, including relevant non-EU businesses.
EU; AEPD · 2026-10-23المصدر الرسمي ↗Complements GDPR with Spanish data protection and digital rights rules.
Spanish processing within national law and GDPR scope.
BOE / AEPD · 2026-10-23المصدر الرسمي ↗Categorize systems and implement applicable security requirements; assess audit/conformity duties by category. ENS does not automatically cover every private company.
Public-sector systems and relevant private supplier systems under covered public-sector contracts.
BOE / CCN · 2026-10-23المصدر الرسمي ↗Provide accept and reject on the same layer with comparable visibility; granular purposes and withdrawal remain available.
Nonexempt device storage/access on websites under applicable Spanish rules.
AEPD · 2026-10-23المصدر الرسمي ↗يُقيَّم نطاق الأنظمة بحسب أنشطة المؤسسة. هذه القائمة ليست رأياً قانونياً ولا إعلاناً عن صلاحية تدقيق رسمية.