The main purpose of Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights is to adapt the Spanish legal system to the General Data Protection Regulation of the European Union and to supplement its provisions, as well as to guarantee the digital rights of citizens in accordance with the constitutional mandate. This regulatory framework establishes a comprehensive system regulating, inter alia, the principles of data processing, the rights of those affected, the obligations of the controller and the controller, as well as the essential role of the data protection authorities, in which the Spanish Data Protection Agency stands out as an independent administrative authority.
The Act also provides a specific title for the protection of digital rights in modern times and recognizes fundamental rights such as the neutrality of the Internet, security and digital education, and the right to forget and digital disconnection in the workplace. This regulation also deals with the processing of data in specific scenarios, such as video surveillance or credit information systems, and establishes a sanctions regime structured into minor, serious and very serious infringements to ensure effective compliance with guarantees of personal data and the privacy of citizens.