Course and certificate
Data protection (GDPR) for employees in Spain
For anyone working in Spain who handles other people's data in their day-to-day job: office work and administration, shops and customer service, healthcare and care, education, human resources and marketing. Eight plain lessons on the GDPR and Ley Orgánica 3/2018 (Spain's Data Protection Act): what personal data is, principles and lawful bases, ID numbers and special categories, people's rights, monitoring and digital rights at work, security and phishing, personal data breaches, fines and the data protection officer. Then a 25-question test. It does not replace your employer's instructions, protocols or job-specific training.
- Jurisdiction
- 🇪🇸 Spain
- Languages
- Español, Български, English, Français, Italiano, Português, Română, Українська
- Lessons
- 8
- Time needed
- About 45 minutes for the lessons and the test
- Assessment
- 25 questions, pass mark 80%
- Refresher
- Recommended after 2 years
- Content updated
- 27 October 2026
- Certificate fee
- €12.00, payable after passing
01Who this course is for
- Office, administration and reception staff who handle data about customers and colleagues
- Staff in shops, hospitality, services and customer service centres
- Staff in healthcare, care, education and settings with children
- Human resources, administration, finance and marketing teams
- People joining a company who need an introduction to data protection
- Team leaders and employers who want to give all their staff a common foundation
02Syllabus
- 01What personal data is and who is who
- 02The principles of processing and the bases that allow it
- 03The DNI, staff data and special categories of data
- 04People's rights and how to respond
- 05Monitoring and digital rights at work
- 06Security at work and phishing
- 07Personal data breaches: what to do and by when
- 08Responsibility, fines, the AEPD and the data protection officer
03Assessment
25 multiple-choice questions drawn from the whole course. The pass mark is 80%. The test is free and can be retaken as often as needed; wrong answers point to the lesson to read again.
04The certificate
- With your name, your score and the date you passed.
- A unique number, recorded in our register.
- Your employer or an inspector scans it to see that it is genuine.
- Download it, print it or show it on your phone.
05Sources
The course follows the published guidance below. We are not affiliated with the bodies that publish it.
- RGPD (UE 2016/679), art. 32
- RGPD (UE 2016/679), art. 4.1
- RGPD (UE 2016/679), art. 33.1
- RGPD (UE 2016/679), art. 4.12
- RGPD (UE 2016/679), art. 9.1
- RGPD (UE 2016/679), art. 33
06Questions
Does the law require a data protection course for employees?
The GDPR requires the controller to apply appropriate technical and organisational measures and to make sure that people who process data under its authority do so only on its instructions (articles 24, 29 and 32). The law does not mention a particular course or a particular certificate. Training staff is a common way of meeting those obligations, but this course does not meet them on its own.
Is this certificate an accredited or official qualification?
No. It is a certificate of completion: it shows that you have completed the course and passed the test. It is not a regulated qualification, and it is not accredited, recognised or approved by the Spanish Data Protection Agency (AEPD) or by any other authority. It is your employer who decides whether this training covers what it needs.
What else does my employer have to do?
The employer is the controller. It must keep a record of processing activities where required, tell staff how it processes their data, have internal protocols for handling people's rights and for managing personal data breaches, give written instructions suited to each job, sign contracts with its processors and make it easy to contact the data protection officer, if it has one. A general course replaces none of that.
Which rules does the course explain?
Regulation (EU) 2016/679 (the GDPR) and Ley Orgánica 3/2018 of 5 December on Personal Data Protection and the guarantee of digital rights (LOPDGDD): basic concepts, principles, lawful bases, the age of consent of 14, ID numbers and special categories, people's rights, video surveillance and digital rights at work, security, personal data breaches, fines and the data protection officer. Rules can change. You can find more information at aepd.es.
Does the AEPD fine companies directly?
Yes. In Spain the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) runs the penalty procedure and imposes the GDPR fines, which can reach 10 or 20 million euros, or 2 % or 4 % of turnover, depending on the infringement. It does not fine public bodies: it issues a decision that declares the infringement and orders it to be put right. The course explains this in the last lesson.
Does the course qualify me to work as a data protection officer?
No. It is general training for staff. It does not prepare you to act as a data protection officer or to advise a company, tasks that require much deeper knowledge. Nor does it replace the specific training your employer may give you for your job.
Does the course apply to my sector?
It explains the rules that apply to almost every job. Some sectors have rules of their own, for example healthcare, education, finance or public administration. Ask your employer which rules, systems and protocols apply in your case.
How long does it take?
Most people finish the eight lessons and the 25-question test in about an hour. You can stop and carry on whenever you like from the same device.
What if I fail the test?
You pay nothing. You will see which lessons are worth going over again, and you can retake the test as many times as you need.
When do I pay, and how much?
Only after you pass: €12 for the certificate. The course and the test are free.
How does my employer check the certificate?
Every certificate has a number and a QR code. When it is scanned, or when the number is entered on our verification page, your name, the course and the date you passed appear.
How long is the certificate valid?
The certificate states a validity of 24 months from the date you passed. This is not a period set by law: the rules change and it is a good idea to refresh your knowledge from time to time. Your employer or your collective agreement may require a different interval.
The certificate confirms that you completed this course and passed its test. It is not a regulated or accredited qualification; your employer decides whether this training meets their requirements.