THE BOTTOM LINE
- Heightened Scrutiny: Expect greater data protection scrutiny in Spanish legal proceedings, as the judiciary’s own data protection authority plans to increase preventive inspections and audits of court data handling.
- Clearer Rules of Engagement: New official guidelines and templates will soon clarify data protection rules within the judicial system, reducing ambiguity for companies and their legal teams when handling personal data in litigation.
- A More Data-Savvy Judiciary: A significant push for training judges and court staff on data protection will lead to a stricter application of privacy principles during legal cases, from discovery to judgment.
THE DETAILS
Spain’s General Council of the Judiciary (CGPJ) has approved a new strategic plan for its Data Protection Supervision and Control Directorate (DSYCPD), the dedicated authority overseeing data processed by courts for judicial purposes. This 2026-2028 roadmap signals a clear intent to embed data protection compliance deep within the country’s judicial framework. For businesses, this means that the data you share during litigation, from evidence files to witness information, will be handled by a system under increasing and more sophisticated regulatory oversight.
The plan is built on six key pillars, with the most impactful initiatives for businesses being a drive for clearer rules and proactive supervision. The DSYCPD will publish a comprehensive guide on data protection specifically for the judicial context, providing much-needed clarity. Furthermore, it will develop practical tools, such as templates for responding to data subject rights requests and protocols for handling security breaches. Crucially, the plan explicitly includes conducting preventive inspections and audits to verify compliance within the courts, moving from a reactive to a proactive enforcement model.
This strategic shift has significant implications for corporate legal strategy in Spain. With enhanced training for judges and plans for institutional cooperation with other authorities like the Spanish DPA (AEPD) and the European Data Protection Supervisor (EDPS), data protection is set to become a more prominent issue within court proceedings. Companies must ensure their legal and compliance teams are prepared for a judiciary that is not only more aware of data protection obligations but also better equipped to enforce them throughout the litigation lifecycle.
SOURCE
Consejo General del Poder Judicial (CGPJ)
