In almost every job you handle information about people. Someone on reception writes down a visitor's name. Someone serving in a shop takes a delivery address. Someone in administration sees payslips, sick leave and contracts. That is why data protection rules are not only for management: they apply to you too.
The rules that apply in Spain
- The General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) applies directly in every country of the European Union.
- Ley Orgánica 3/2018 of 5 December on Personal Data Protection and the guarantee of digital rights (LOPDGDD, Spain's Data Protection Act) completes the regulation in Spain. It covers, for example, the age of consent, the duty of confidentiality, video surveillance and digital rights at work.
- The Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD, aepd.es) is the authority that makes sure these rules are followed.
What personal data is
It is any information about an identified or identifiable natural person (article 4.1 of the GDPR). For example:
- name, surname, address, telephone number and email address
- DNI or NIE number (Spanish identity numbers), employee number or customer number
- photographs, videos and voice recordings in which the person can be recognised
- IP addresses, location data and number plates linked to a person
- salary, working hours, absences, appraisals and other working-life data
The data does not have to be secret. An email address published on a website is still personal data. A company's data (its tax number, CIF, or its sales) is not personal data, but data about the person behind a self-employed business is.
Anonymous data, which no longer allows anyone to be identified, falls outside the rules. Pseudonymised data, where the name is replaced by a code but the person can be traced back using a separate key, is still personal data.
What processing is
Processing is anything that can be done with data: collecting, recording, storing, consulting, searching, sending, changing, sharing and deleting (article 4.2). When you simply look at a record on the screen, you are already processing data. The rules apply to automated processing and also to paper files if they are organised by criteria, for example a folder filed by surname.
Who is who
- The data subject is the person the data is about: a customer, a patient, a pupil or a colleague.
- The controller decides why and how data is processed (article 4.7). It is normally the company or organisation you work for, not you personally.
- The processor processes data on behalf of the controller, for example an accountancy firm (gestoría) that prepares the payroll or the supplier of a cloud program (article 4.8). There must be a written contract or legal act between them (article 28).
Anyone who works under the company's authority may process the data only on its instructions (article 29 of the GDPR). You cannot decide on your own to use the customer list for another purpose.
Why it matters
Misused data can cause real harm: fraud, identity theft, harassment, discrimination or the loss of a job. A mistake also harms the company and can end in a fine.
Remember: before you use someone's data, ask yourself whether you need it for your job and whether the company allows you to use it that way.