GDPR (known in Spain as RGPD) isn't just a big-company problem. Any website that collects personal data from users — including a simple contact form — must comply, no matter how small the business.

The Spanish data protection authority, AEPD, actively investigates complaints and has fined businesses as small as sole traders thousands of euros for non-compliance. This guide explains exactly what you need, in plain language.

⚠️ Disclaimer: This article is for informational purposes and does not constitute legal advice. For specific legal questions, consult a qualified attorney or data protection specialist.

Who does GDPR apply to?

GDPR applies to any organisation that collects or processes personal data from people in the EU. Personal data includes:

  • Names and email addresses (contact forms)
  • Phone numbers
  • IP addresses (collected automatically by analytics tools like Google Analytics)
  • Cookie identifiers that can track behaviour

So yes — even a simple one-page website with a contact form must comply.

Your complete GDPR compliance checklist

✓
1. Privacy Policy pageYou must have a clear, accessible Privacy Policy that explains what data you collect, why you collect it, how long you keep it, and who you share it with. It must be linked from every page of your website.
✓
2. Cookie consent bannerIf your site uses any cookies beyond strictly necessary ones (analytics, social media pixels, advertising), you must ask for consent before setting them. A pre-ticked box or continued browsing does NOT count as consent.
✓
3. Contact form data noticeEvery contact form must include a notice explaining what you'll do with the submitted data, and a checkbox where the user actively agrees (opt-in, not pre-ticked).
✓
4. Legal Notice (Aviso Legal)Spanish law (LSSI) requires an Aviso Legal on all commercial websites, stating the company name, registered address, tax identification number (NIF/CIF), and contact details.
✓
5. Data Processor AgreementsIf you use third-party tools that handle user data (Mailchimp, Google Analytics, etc.), you need signed Data Processing Agreements with each provider.
✓
6. Right to erasureUsers can ask you to delete their personal data at any time. You must have a clear process for handling these requests and act on them within 30 days.

The cookie consent banner: what's allowed and what isn't

This is where many Spanish websites fail. Under GDPR (confirmed by Spanish case law), a compliant cookie banner must:

  • Appear before any non-essential cookies are set
  • Have equally prominent "Accept" and "Reject" buttons
  • Not use dark patterns (small print, hard-to-find reject options)
  • Remember the user's choice
  • Allow users to change their preference at any time

Common tools like Cookiebot, CookieYes, and Axeptio can handle this automatically for most websites.

💡 SITEGO includes GDPR compliance on every website. We set up cookie banners, add privacy policy templates, and configure contact forms correctly — all included in the price. Ask us about it →

What happens if you don't comply?

The AEPD (Agencia Española de Protección de Datos) can investigate your website and issue fines of:

  • Up to €10 million or 2% of annual turnover for minor infringements
  • Up to €20 million or 4% of annual turnover for serious infringements

In practice, small businesses typically receive warnings first and smaller fines, but cases against sole traders and SMEs are increasingly common. The AEPD receives thousands of complaints per year, many from competitors or disgruntled customers.

Quick summary: what to do this week

  • Add a Privacy Policy page and link it in your footer
  • Add a Legal Notice (Aviso Legal) with your business details
  • Install a proper cookie consent banner
  • Add a data consent checkbox to all contact forms
  • Review which third-party tools collect data on your users

If this all sounds complex — that's because it is. The good news: SITEGO handles all of this for you as part of every website we build. You don't need to worry about it.