• 96 105 99 40
Request a Quote
glosario

Glossary

Data protection

The purpose of the LOPD is to guarantee and protect, with regard to the processing of personal data, the public freedoms and fundamental rights of individuals, and especially their honor, privacy and personal and family privacy.

Any numerical, alphabetical, graphic, photographic, acoustic or any other type of information concerning identified or identifiable natural persons.

Any organized set of personal data that allows access to the data in any form or manner of its creation, storage, organization and access. (Example: computerized or manual files).

It is any operation or technical procedure, whether automated or not, that allows the collection, recording, conservation, elaboration, modification, consultation, use, cancellation, blocking or suppression, as well as the transfer of data resulting from communications, consultations, interconnections and transfers.

Natural person who is the owner of the data to be processed. That is, the customer, employee, supplier, candidate to join the company, patient, etc., whose data is being processed by the company. It is the true owner of the information collected in the files.

Natural or legal person, of a public or private nature, or administrative body, who decides on the purpose, content and use of the processing. That is to say, the company itself will be responsible for the files containing data relating to its employees, suppliers, customers, etc.

The relationship between the data controller and the data processor must be formalized through a written contract.

Any person or entity that provides any type of service that involves the processing of personal data on behalf of the data controller, including, among others, accounting firms, labor consultancies, marketing companies, etc.

It is the person who processes the data collected in a file at different times of a data processing, either by means of specific tools (e.g. computer applications) or by accessing them in paper files.

Any person, company or entity (both public and private) that in the exercise of its activity has to use personal data (e.g. data of customers, suppliers, employees, patients, students, etc.) is obliged to comply with the LOPD. Public and private entities.

Security levels

Personal data:
DNI/NIF; Social Security/Mutuality number; name and surname; address and telephone number; signature/fingerprint; image/voice; academic and professional data, health data, referring exclusively to the degree or condition.

Medium level

Data related to the commission of administrative or criminal infractions.
Provision of solvency and credit services.
Data related to financial services, public finance, economic data, etc.
Data from mutual insurance companies for accidents at work and illnesses, Social Security professionals, etc.

High level

Data concerning ideology, trade union membership, religion, beliefs, racial origin, health or sex life.
Data collected for law enforcement purposes, without the consent of the persons concerned.
Derived from acts of gender violence.
Files for which operators who provide publicly available electronic communications services or operate electronic communications networks are responsible.

Data related to the commission of administrative or criminal infractions.
Provision of solvency and credit services.
Data related to financial services, public finance, economic data, etc.
Data from mutual insurance companies for accidents at work and illnesses, Social Security professionals, etc.

Data concerning ideology, trade union membership, religion, beliefs, racial origin, health or sex life.
Data collected for law enforcement purposes, without the consent of the persons concerned.
Derived from acts of gender violence.
Files for which operators who provide publicly available electronic communications services or operate electronic communications networks are responsible.

Creation, modification or deletion of public files

Publicly-owned files must be made through the publication of a general provision, published in the BOE or the corresponding Official Gazette. This provision or agreement must be issued and published prior to the creation, modification or deletion of the file.

Basic file structure
Planned data communications
International transfers
Bodies responsible for the file
Required safety levels
Identification of the file or treatment
Data origin

Agency notifications

The NOTA system is the means by which those responsible for files containing personal data, whether privately or publicly owned, will be allowed to comply with the obligation to notify their files to the Spanish Data Protection Agency.

The interactive form NOTA in .pdf format allows the submission of notifications through the Internet with and without electronic signature certificate, on paper and in xml format.

Telematics

With the electronic certificate
(Presentation through the Internet with a recognized signature certificate).
Without electronic certificate
(Through the Internet without a recognized electronic signature certificate).
In paper format
Simplified notifications

In XML format

With the electronic certificate
Without electronic certificate
What is XML format?

This format is intended for data controllers who want to comply with their obligations through their own computer applications, as well as for developers of data protection programs who want to offer their clients the possibility of notifying their files.

Who is obliged to notify the creation, modification or deletion of files to the GDPR?
All those natural or legal persons, of a public or private nature, or administrative body, who proceed to the creation of files containing personal data.

What happens if the existence of a file is not notified?

In this case, it could incur in minor or serious misconduct, as indicated in article 44 of Organic Law 15/1999, being subject to the sanctioning regime provided in the Law.

What operations about a file are notified to RGPD?

You must notify the AGPD, if you are going to create a file or will make a new data processing, any changes that affect the content of the registration made in the RGPD, of course you must also communicate to the AGPD the deletion of the file by the controller, to proceed to the cancellation of the registration.

The Spanish Data Protection Agency

It is a public law entity with its own legal personality and full public and private capacity that acts independently from the public administration in the exercise of its functions. Ensures compliance with data protection legislation by those responsible for the files (public entities, private companies, associations, etc.).

In relation to those affected

Helping citizens to exercise their rights
Attends to requests and complaints
Ensures that the existence of the files is publicized.
In relation to those who process data

It helps data controllers and data processors to comply with the obligations established by the LOPD and to solve their doubts.
Guarantees the right to data protection by investigating those actions of those responsible for or in charge of the processing of files that may be contrary to the LOPD, either ex officio or by complaint from an individual.
Imposes the corresponding sanctions.
In the development of standards

It informs on the content, principles and guarantees of the fundamental right to data protection regulated by the LOPD.
It dictates precise instructions to adapt the processing to the LOPD and instructions on the security conditions of the files for statistical purposes.
In telecommunications

Protects the rights and guarantees of subscribers and users in the field of electronic communications.
Other functions

Watch out for advertising in the treatment
International Cooperation
Representation and observance of the provisions of the Law Regulating the Public Statistical Function.

Types of files

In order to proceed with the collection of personal data from our customers, suppliers or any other person, we need to obtain the consent of the person concerned.

An organized set of personal data that allows access to information relating to a specific natural person using automated search procedures, i.e., those in which the information is stored on computer media.

File whose physical support allows direct reading and writing, without the need to use an intermediary electronic device. This includes data contained on paper or other printable material.

These are those for which individuals, companies or private law entities are responsible, regardless of who provides the capital or economic resources.

They are those for which the constitutional bodies or bodies with constitutional relevance of the state, the autonomous institutions with analogous functions to them, the territorial public administrations, public law corporations as long as their purpose is the exercise of public law powers.

These are work files created by users or processes that are necessary for occasional processing, or as an intermediate step in the course of processing. Once they have been used they must be deleted or destroyed.

Domestic and gender violence file. Purpose

Improve the effectiveness of protection for victims of gender-based violence.
To facilitate the monitoring of the risk circumstances that may be present in them and to alert on their evolution.
Personal data from the patient’s medical history

Healthcare facilities are required to keep clinical documentation for 5 years.

The management and administration staff of the healthcare facilities can only access the data in the medical record related to their own functions. The personnel is subject to the duty of secrecy.

All professionals involved in the care activity are obliged to comply with the duties of information and clinical documentation, and to respect the decisions freely and voluntarily made by the patient.

Patients have the right to know all the information available on their clinical history and to have it kept confidential, and even to refuse the processing of their data, except in the cases established by law. Any action in the field of a patient’s health requires the free and voluntary consent of the person concerned.

Infringements and penalties under the GDPR

These are minor infractions:
a) Failure to send to the Spanish Data Protection Agency the notifications provided for in this Law or in its implementing provisions.
b) Failure to request the registration of the personal data file in the General Data Protection Registry.
c) Failure to comply with the duty to inform the data subject about the processing of his or her personal data when the data is collected from the data subject.
d) The transmission of data to a data processor without complying with the formal duties established in Article 12 of this Law.

Incident log: Between 900 to 40,000 euros
Access control: Per year
Archiving criteria: Per year

These are serious infractions:

a) Proceed with the creation of publicly-owned files or initiate the collection of personal data for the same, without the authorization of a general provision, published in the “Official State Gazette” or corresponding official journal.

b) To process personal data without obtaining the consent of the affected persons, when such consent is necessary in accordance with the provisions of this Law and its implementing provisions.

c) Processing personal data or subsequently using them in violation of the principles and guarantees set forth in Article 4 of this Law and the provisions that develop it, except when it constitutes a very serious infringement.

d) Violation of the duty of secrecy regarding the processing of personal data referred to in Article 10 of this Law.

Incident log: Between 40,001 to 300,000 euros
Access control: At 2 years of age
Archiving criteria: At 2 years

These are very serious infractions:
a) The collection of data in a misleading or fraudulent manner.
b) To process or transfer the personal data referred to in sections 2, 3 and 5 of Article 7 of this Law, except in the cases authorized by this Law, or to violate the prohibition contained in section 4 of Article 7.
c) Not to cease the unlawful processing of personal data when previously requested to do so by the Director of the Spanish Data Protection Agency.
d) The transfer of personal data to countries that do not provide a comparable level of protection without the authorization of the Director of the Spanish Data Protection Agency, except in those cases in which, in accordance with this Law and its implementing provisions, such authorization is not necessary.

Incident log: Between 300,000 to 600,000 euros
Access control: At 3 years of age
Archiving criteria: At 3 years

The security document

The security document is a private but publicly accessible document that indicates the security policies to be followed by those who process data, i.e., it will contain the technical and organizational measures, which will be mandatory for personnel with access to the data.

Required safety measures, standards, procedures and rules
Some of the most important measures you will need to reflect in your security document:

Identification and authentication.
Access control.
Incident log.
Management of media and documents.
Archiving criteria.
Information storage.
Backup copies.
Transfer of documentation.
Files processed outside the company’s premises.
Personnel functions and duties.
General personnel information procedure

In the security document we must indicate the procedure by which each person with access to the data will be informed of the rules they must comply with and the consequences of not doing so. E.g.: circulars, reminders, new rules, etc. (Internal Circular…).

Functions and duties of a personal nature

The roles and obligations of each of the users or user profiles with access to personal data and information systems shall be clearly defined.

Incident notification, management and response procedure
Specify incident notification and management procedures.

Review procedures

Specify the procedures foreseen for the modification of the security document, with specific specification of the persons who can or must propose them for approval.

Consequences of non-compliance with the security document

Indicate the applicable sanctioning regulations in the event of non-compliance with the obligations and safety measures established in this document.

Audit

In the case of an external audit, a contract must be signed with the person performing the audit procedure.
It consists of the verification of the Security Measures of RD 1720/2007.
It is mandatory in Medium and High level files.
Can be performed internally or externally
It will be optional for basic level files
It must be performed every two years.

Exceptions to access, rectification and cancellation rights

Exceptions:
The files containing the data referred to in paragraphs 2.3 and 4 of art. 22 RGPD may deny access, rectification or cancellation depending on:

Of the dangers that may arise for the defense of the State or Public Security.
Protection of the rights and freedoms of 3º.
The needs of the research being carried out.
The persons in charge of the Treasury may refuse to exercise Arco rights when:

Obstructs administrative actions aimed at ensuring compliance with tax obligations.
When the affected party is being inspected.

The affected party who is denied, in whole or in part, the exercise of his rights shall make it known:

From the Agpd Director
Competent body of each Autonomous Community.
These bodies shall ascertain whether the denial is appropriate or inappropriate.
Other exceptions to the rights of data subjects are set forth in Articles 21 and 24 of the GDPR.

Request a personalized quote.

CONTACT
Auditaris

CONTACTA CON AUDITARIS

FORMULARIO:
Protección de datos personales. Utilizaremos sus datos para responder consultas, enviar comunicaciones comerciales y realizar análisis estadísticos. Para más información sobre el tratamiento y sus derechos, consulte la Política de Privacidad
RESPONSABLE:
Paco Bordería y Asociados SL
C.I.F.: B96467279
Av. del Primat Reig, 129, Entresuelo D, Benimaclet, 46020 Valencia
Telefono: +34 961 059 940
e-mail: auditaris@auditaris.com
FINALIDAD:
Mantener una relación comercial, responder consultas y enviar comunicaciones de productos o servicios.
LEGITIMACIÓN:
El tratamiento está legitimado por el artículo 6 del GDPR: Por consentimiento del Usuario para la remisión de comunicaciones comerciales (art. 6.1.a GDPR). Por interés legítimo del Responsable, para tramitar encargos, solicitudes, etc., a petición del Usuario (art. 6.1.f GDPR).
DESTINATARIOS:
No está prevista ninguna comunicación a terceros salvo por obligación legal o, si fuese necesario para lograr las finalidades del tratamiento, a proveedores de servicios relacionados con comunicaciones, con los cuales, existen contratos de confidencialidad y de encargados.
DERECHOS:
Derecho a retirar el consentimiento en cualquier momento y derecho de acceso, rectificación, portabilidad y supresión de sus datos, y de limitación u oposición a su tratamiento.
INFORMACIÓN ADICIONAL:
Más información del tratamiento en la Política de Privacidad de forma más ampliada.