{"id":20563,"date":"2025-09-17T18:03:24","date_gmt":"2025-09-17T16:03:24","guid":{"rendered":"https:\/\/etl-ilia.es\/?p=20563"},"modified":"2025-09-17T18:12:40","modified_gmt":"2025-09-17T16:12:40","slug":"data-act-spanish-companies-compliance","status":"publish","type":"post","link":"https:\/\/etl-ilia.es\/en\/legal-advice-blog\/data-act-spanish-companies-compliance\/","title":{"rendered":"Data Act: New legal obligations for Spanish companies regarding the use and sharing of data"},"content":{"rendered":"

On September 12, 2025, the Data Act<\/strong>, one of the most ambitious European regulations on data management and use, came into force. With it, the European Union seeks to boost the so-called data economy<\/em>, ensuring that both companies and users have fair and transparent access to the information generated by connected devices.<\/p>\n

For Spanish companies, this regulation represents a profound change in the way they manage their digital assets. The big question is: is your company prepared to comply with its legal obligations and avoid sanctions?<\/strong><\/p><\/div><\/div>

<\/div>

Key obligations for companies<\/strong><\/h2><\/div>

Spanish companies must take into account a series of essential legal obligations<\/strong>:<\/span><\/p>\n

    \n
  • Share data with users and third parties:<\/span><\/strong> Except for justified exceptions, companies must facilitate access to data generated by the devices they sell or manage.<\/span><\/li>\n
  • Comply with technical interoperability requirements:<\/span><\/strong> Data must be provided in standardised formats so that other systems can use them.<\/span><\/li>\n
  • Eliminate unfair terms in contracts with SMEs:<\/span><\/strong> The Data Act prohibits large companies from imposing disproportionate terms on small and medium-sized businesses.<\/span><\/li>\n
  • Guarantee security and confidentiality:<\/span><\/strong> Data will not <\/span>be used<\/span> for purposes other than those agreed upon, nor will it compromise user privacy.<\/span><\/li>\n<\/ul>\n<\/div>
    <\/div>

    Legal risks due to non-compliance<\/strong><\/h2><\/div>

    The Data Act is not a voluntary regulation: <\/span>non-compliance carries significant legal and economic consequences<\/span><\/strong>. The main risks include:<\/span><\/p>\n

      \n
    • Administrative and financial penalties <\/strong>that can<\/span> be costly for the company.<\/span><\/li>\n
    • Civil liability<\/strong> if data misuse causes harm to third parties.<\/span><\/li>\n
    • Conflicts with the GDPR<\/strong>: Failure to comply with the <\/span>Data Act<\/span> can also lead to breaches in personal data protection.<\/span><\/li>\n
    • Reputational damage<\/strong>: The loss of trust from customers and business partners can be as <\/span>serious<\/span> as a fine.<\/span><\/li>\n<\/ul>\n<\/div>

      Impact on Spanish companies<\/strong><\/h2><\/div>

      The impact of the Data Act<\/strong> will be especially significant in sectors where data generated by connected devices plays a central role:<\/p>\n

        \n
      • Automotive<\/strong>: connected vehicles that generate usage and maintenance information.<\/li>\n
      • Telecommunications<\/strong>: data derived from mobile devices and network services.<\/li>\n
      • Digital health<\/strong>: medical devices and connected health applications.<\/li>\n
      • Energy<\/strong>: smart meters and consumption management systems,<\/li>\n<\/ul>\n

        In these and other sectors, companies will need to review their contracts, internal policies, and technical systems<\/strong> to ensure they comply with the regulations from the outset.<\/p>\n<\/div>

        <\/div>

        How companies should prepare<\/strong><\/h2><\/div>

        The entry into force of the Data Act requires immediate adaptation<\/strong>. Some practical steps we recommend are:<\/p>\n

          \n
        1. Conduct a data audit<\/strong> to identify what information is generated, who manages it, and how it is shared.<\/li>\n
        2. Review and adapt contracts<\/strong> with clients, suppliers, and technology partners.<\/li>\n
        3. Train staff<\/strong> on the new legal and technical obligations.<\/li>\n
        4. Implement specific compliance protocols<\/strong> for data management and sharing.<\/li>\n
        5. Engage specialised legal counsel<\/strong> to assist the company in interpreting and applying the regulations effectively.<\/li>\n<\/ol>\n<\/div>
          <\/div>

          Legal Conclusions on the Data Act<\/strong><\/h2><\/div>

          The Data Act<\/strong> marks a turning point in corporate data management in Europe. Because compliance<\/strong> is mandatory<\/strong>, Spanish companies must make adaptation an urgent priority.<\/p>\n

          It’s not just about avoiding sanctions, but also about protecting business activity from legal, economic, and reputational risks<\/strong>. The sooner the adaptation process begins, the lower the costs and difficulties.<\/p>\n<\/div>

          <\/div><\/div><\/div><\/div><\/div>