Spain Data Removal Guide (2026)
Spanish residents are backed by one of the European Union's most proactive privacy regulators (AEPD). Use these step-by-step instructions to delete your information from data brokers, commercial directories, and telemarketing lists.
Research status: published guide pending fresh official-source re-verification.
This page is educational orientation, not legal advice. The legal fields below are a research snapshot; eligibility, exemptions, deadlines, penalty rules and broker routes can change. Verify the current statute and regulator guidance before relying on a right or filing a complaint.
At a glance
- Governing law
- EU GDPR / LOPDGDD
- Response deadline
- 1 month (extendable by 2 months for complex requests)
- Regulator
- Agencia Española de Protección de Datos (AEPD)
- Private right of action
- Yes: civil claim for compensation under Article 82 GDPR and LOPDGDD
EU General Data Protection Regulation (GDPR) + Ley Orgánica 3/2018 (LOPDGDD)
Spain enforces the EU GDPR supplemented by the Ley Orgánica 3/2018 de Protección de Datos Personales y garantía de los derechos digitales (LOPDGDD). The Agencia Española de Protección de Datos (AEPD) rigorously enforces consumer rights of access, rectification, erasure (suprisión), and opposition.
Read the full EU GDPR / LOPDGDDexplainer →Scope, penalties, private right of action, enforcement history.
What rights do Spain residents have?
- →Right of access to personal information (Article 15 GDPR / Art. 13 LOPDGDD)
- →Right to rectification (Article 16 GDPR / Art. 14 LOPDGDD)
- →Right to erasure / "Derecho de Supresión" (Article 17 GDPR / Art. 15 LOPDGDD)
- →Right to object to processing and marketing (Article 21 GDPR / Art. 18 LOPDGDD)
- →Right to digital disconnection and post-mortem digital testament rights (LOPDGDD)
- →Right to submit a formal complaint (reclamación) to the AEPD
Who holds your data in Spain?
In Spain, data brokers and financial intelligence firms (eInforma, Axesor, Iberinform, Infocif) aggregate information from the Registro Mercantil, the Boletín Oficial del Estado (BOE), and telephone guides (Páginas Blancas / Amarillas). International B2B platforms actively scrape Spanish executive profiles.
Public-record sources brokers scrape
- Registro Mercantil Central and provincial commercial registries
- Boletín Oficial del Estado (BOE) and provincial official gazettes (BOP)
- Commercial credit rating and business information databases (eInforma, Axesor)
- Universal telephone directories and telemarketing lead lists
How to remove your data in Spain
- 1Register on the official "Lista Robinson" (listarobinson.es), Spain's statutory advertising exclusion service.
- 2Submit formal "Derecho de Supresión" (GDPR Art. 17) requests to commercial data brokers and B2B platforms.
- 3Request removal of home address and personal contact data from online commercial directory profiles.
- 4File a formal claim (reclamación) electronically with the AEPD if a company does not respond within 30 days.
Ready to remove
Review 1009 US/global broker workflows for $9
Much of Spain residents' data is held by US-based people-search brokers. OfflistMe drafts a legally structured deletion email for each one, sent from your own inbox, no account, no ID upload. Pair it with the Spain-specific steps above.
Request Removal NowWhat if a company ignores your request?
File a complaint with the Agencia Española de Protección de Datos (AEPD). The maximum penalty in Spain is €20M or 4% of global annual turnover, and you may have a private right of action (Yes: civil claim for compensation under Article 82 GDPR and LOPDGDD).
File a complaint with the Agencia Española de Protección de Datos (AEPD) ↗FAQ: Spain data removal
What is the Lista Robinson in Spain?+
The Lista Robinson is Spain's official free advertising exclusion registry managed by the Spanish Association of Digital Economy (Adigital) under AEPD oversight. Companies sending marketing to individuals who have not given consent are legally required to consult and respect the list.
How do I exercise my "Derecho de Supresión" in Spain?+
Send a written deletion request to the data controller's designated privacy email or DPO, attaching proof of identity. Under Article 12 of the GDPR, the organization must process your request and confirm deletion free of charge within one month.