The obligation and intensity of the DPO's work vary with each segment's processing profile. Spain, through Article 34 LOPDGDD, substantially broadens the sectors subject to mandatory designation.
Public Sector and Administrations
For public authorities and bodies designation is mandatory; the LOPDGDD reinforces the duty across the state, regional and local public sector.
GDPR Art. 37; LOPDGDD Art. 34
Health, Associations and Universities
Healthcare centres, professional associations and universities are among the entities expressly required to appoint a DPO by Article 34 LOPDGDD.
LOPDGDD Art. 34
Banking, Insurance and Energy
Credit institutions, insurers, investment firms and energy and gas distributors are subject to mandatory designation.
LOPDGDD Art. 34
Technology, SaaS and Marketing
Platforms with large-scale systematic monitoring and providers that build profiles, at the intersection of the GDPR and the LSSI-CE.
GDPR Art. 37(1)(b); Law 34/2002