The Personal Data Protection Law originally issued under Royal Decree 6/2022 was amended for the first time last week by Royal Decree 68/2026. This blog post will highlight the key amendments made to the PDPL.
A key substantive change can be seen in article 5bis which allows a controller to process its own staff data, including biometric data such as fingerprints, without the need to obtain a permit from the ministry.
Article 14 grants data subjects a new right to object to decisions made through automated processing, for example, filtering of CVs for job applications, and to require the controller to bring in a human to review the decision.
Moreover, article 15 imposes a new obligation on controllers and processors to erase personal data as soon as its processing purpose ends, subject to narrow exceptions, like an existing dispute or a legal obligation.
Article 22 strengthens consent requirements by requiring explicit consent for marketing purposes, and article 10 provides a new list of specifications for the request for consent to process personal data.
The amendment includes several other substantive changes relating to definitions, territorial scope, consent, direct marketing, and fines.
This amendment has already entered into force. You can read it in full in English at the link below:
