Many expat business owners in Spain are surprised to learn that their website has legal obligations that go beyond what they were used to in the UK or Ireland. Spain applies the EU’s GDPR, its own data protection law and a specific law governing online services, and it expects certain information to be clearly displayed.
This article gives a practical overview. It is not legal advice — rules change and every business is different — so please check the specifics with your gestor, lawyer or data protection adviser.
The key laws
- LSSI-CE (Ley 34/2002 de Servicios de la Sociedad de la Información y de Comercio Electrónico): Spain’s law on information society services and e-commerce. It sets out what information business websites must display and covers commercial communications and cookies.
- GDPR: the EU General Data Protection Regulation, governing how you collect and use personal data.
- LOPDGDD (Ley Orgánica 3/2018): Spain’s data protection law, which complements the GDPR.
- Consumer protection law: relevant if you sell to consumers online.
The Spanish data protection authority, the AEPD (Agencia Española de Protección de Datos), publishes guidance and enforces data protection rules, including on cookies.
1. The aviso legal (legal notice)
Under the LSSI, business websites must make certain information easily, directly and permanently accessible. This is usually done through a page called Aviso Legal, linked in the footer. It typically includes:
- Your name or company name.
- Your registered address.
- Your email address and other contact details.
- Your tax identification number (NIF or NIE/NIF for autónomos, CIF/NIF for companies).
- Company registration details (for example, Registro Mercantil data) if you are a company.
- Professional body and registration details if you work in a regulated profession.
UK-style websites often lack this page entirely, so it is one of the most common gaps we see on expat business websites.
2. Privacy policy
If you collect any personal data — through contact forms, booking systems, newsletter sign-ups or analytics — you need a clear privacy policy explaining:
- Who you are and how to contact you.
- What data you collect and why.
- The legal basis for processing it.
- How long you keep it.
- Who you share it with (for example, email or hosting providers).
- People’s rights, including access, correction and deletion, and how to complain to the AEPD.
Contact forms should link to the privacy policy, and any marketing consent should be separate and optional.
3. Cookie consent
Non-essential cookies — such as analytics, advertising and many social media embeds — require prior consent. The AEPD’s guidance sets out expectations including:
- A clear banner on first visit explaining that cookies are used.
- Consent obtained before non-essential cookies are set.
- Rejecting cookies being as easy as accepting them — typically an “accept” and a “reject” button at the same level.
- A way to change or withdraw consent later.
- A cookie policy listing the cookies used and their purpose.
Pre-ticked boxes and “by continuing to browse you accept” banners are not considered valid consent.
4. Selling online
If you sell to consumers, you also need clear terms and conditions covering prices (including VAT), delivery, payment methods, complaints and the consumer’s right of withdrawal — generally 14 days for most distance sales within the EU, with some exceptions. Read our comparison of WooCommerce vs Shopify if you are choosing a platform, and consider whether the European Accessibility Act applies to you.
5. Email marketing
The LSSI also governs commercial communications by email. In general you need prior consent, with an exception for existing customers in certain circumstances, and every marketing email must include an easy way to unsubscribe. We cover this in detail in GDPR and email marketing.
Should legal pages be in Spanish?
If you target Spanish customers, your legal pages should certainly be available in Spanish. Even if your audience is mainly English-speaking, having a Spanish version of your aviso legal and privacy policy is sensible, as your business operates under Spanish law. If you are building a bilingual site, read should your website be bilingual?
The cost of getting it wrong
Spanish authorities can fine businesses for breaches of the LSSI and data protection rules, and the AEPD regularly publishes enforcement decisions, including against small businesses. Beyond fines, missing legal pages simply look unprofessional to Spanish customers who expect to see them.
A quick compliance checklist
- Aviso legal page with full business details.
- Privacy policy linked from every form.
- Cookie banner with equal accept and reject options.
- Cookie policy.
- Terms and conditions if you sell online.
- Unsubscribe links in all marketing emails.
- An SSL certificate (https).
Need help?
We build websites for businesses in Spain with these essentials included from day one, and we can review an existing site to spot gaps. For the legal wording itself, we always recommend having your lawyer or gestor check the final text. Get in touch if you would like a website review.
