The Bottom Line
- Increased Scrutiny: Spain’s judicial data protection authority has launched a new three-year strategic plan, indicating a significant increase in data privacy enforcement and awareness within the judicial system itself.
- Impact on Litigation: Companies engaged in litigation in Spain should prepare for a judiciary that is better versed in data protection, a factor that will impact evidence handling, discovery requests, and data-related legal arguments.
- New Guidance & Training: The plan prioritizes creating new data protection guides and training for judges, raising the bar for how personal data is managed and protected throughout legal proceedings.
The Details
The Spanish General Council of the Judiciary (CGPJ) has approved a new strategic plan for its Directorate for Supervision and Control of Data Protection (DSYCPD) for 2026-2028. This body acts as the specific data protection authority for all data processing carried out by Spanish courts for jurisdictional purposes. The plan signals a clear intent to embed robust data protection principles directly into the fabric of the justice system, moving beyond mere administrative compliance to active supervision and training. This initiative will impact not only the courts but also any company that interacts with them.
The strategic plan is built on six key pillars, with the most significant for businesses being compliance, training, and supervision. The DSYCPD will publish a comprehensive guide on data protection specifically for the judicial environment, providing a clear framework for judges and court staff. Crucially, the plan calls for the introduction of data protection as a subject in judicial entrance exams and the creation of specialized training courses. This ensures that the next generation of Spanish judges will be data-literate from day one, equipped to handle complex privacy issues that arise in commercial and civil litigation.
For CEOs and General Counsel, this development is a strategic signal. A judiciary that is more educated and focused on data protection will scrutinize how companies handle personal data during legal disputes. Arguments related to the scope of discovery, the protection of data in evidence, and the legal basis for processing data in litigation will be met with greater understanding and stricter standards. Businesses should anticipate that courts will be more proactive in enforcing data protection rules within their own proceedings and should prepare their litigation strategies accordingly. This plan reinforces that in Spain, data protection is not just a regulatory hurdle but a fundamental aspect of the rule of law.
SOURCE: Consejo General del Poder Judicial
