Does the GDPR apply to Chinese companies operating in Europe?

Yes. The GDPR applies whenever a company offers goods or services to EU users or monitors their behaviour, regardless of having a physical presence in the EU.

What should I do if I receive an AEPD complaint notice?

Submit written allegations within the stated deadline (usually 1 month). Engage a specialist lawyer immediately to review your data processing and prepare the response, so as not to aggravate the potential penalty.

How large are GDPR fines?

Up to €20 million or 4% of total worldwide annual turnover, whichever is higher. The actual amount depends on the type and severity of the infringement.

Is a cookie policy mandatory on a website?

Yes. Under the GDPR and Spain's LSSI, any website using non-essential cookies must obtain explicit user consent and have a clear, accessible cookie policy.

Back to Services

Data Protection

GDPR and LOPDGDD compliance advisory, privacy policy drafting, data processing agreements, breach response and AEPD liaison.

Who Is This For?

Internet and e-commerce companies operating in Europe and processing personal data
SMEs requiring GDPR compliance assessment
Companies that have received AEPD complaints or penalty notices
Companies needing to draft privacy policies and data processing agreements
Companies carrying out cross-border data transfers (China-Europe)

What We Cover

GDPR and LOPDGDD compliance assessment

Data Processing Agreement (DPA) drafting and review

Data breach management and AEPD notification

Data subject rights request procedure design

Cross-border data transfer compliance (SCCs, etc.)

Data Protection Impact Assessment (DPIA)

Internal data protection training

Handling AEPD complaints and regulatory investigations

Frequently Asked Questions