Those companies that process personal data, either in their capacity as Data Controller or as Data Processor, must be prepared and have the necessary means and tools to reply in due time and form to any requirement or request for information that may be received from the Spanish Data Protection Agency (AEPD). <\/p>\n\n\n\n
In this sense, the purpose of the requirement or request for information received by the AEPD is none other than to gather sufficient information to verify whether or not there are sufficient indications to proceed with the opening of a sanctioning procedure. <\/p>\n\n\n\n
The requests for information or requirements of the AEPD are motivated by two fundamental reasons: <\/p>\n\n\n\n
Once the request for information in question has been received, the AEPD will set forth in detail in said written document the information or questions that must be submitted to said entity for the purpose of identifying or delimiting the facts that motivated the request, identifying the persons who may be responsible and, in summary, to verify the circumstances of the specific case in order to initiate or not a sanctioning proceeding. <\/p>\n\n\n\n
Likewise, the AEPD will grant a specific term for the company to proceed to reply to the requirement, action that will also be carried out in writing, being such term ten (10) working days as a general rule.<\/p>\n\n\n\n
In accordance with the above, the company must make the allegations it deems appropriate to demonstrate that it has acted in accordance with the applicable regulations, providing the necessary evidence (registration forms, clauses, privacy policies, etc.) to demonstrate that its actions have been adequate and that it complies with its data protection obligations. <\/p>\n\n\n\n
After submitting the response to the AEPD, two different scenarios may occur: <\/p>\n\n\n\n
In the event that a sanctioning proceeding goes ahead, the most common consequence for the company will be the payment of a financial fine.<\/p>\n
<\/p>