Legal
The legal minimum for a business website in Spain (2026)
A business website in Spain falls under four or five laws at once. None is hard on its own, but each asks for something different, and which ones apply depends on what your site does. This guide covers the minimum for a local business website: which texts you need, what they must say and which mistakes keep coming up. It is general guidance, not legal advice: if your case has particularities, check it with a lawyer or your gestoría (accountant and admin adviser).
Which laws apply, depending on what your site does
A site that just presents the business needs much less than one that takes paid bookings or sells. Find your case in this table.
| Law | When it applies | What it requires |
|---|---|---|
| LSSI (Law 34/2002), art. 10 | Whenever the site has an economic activity, even without selling | A legal notice with the owner's details |
| GDPR and LOPDGDD (Organic Law 3/2018) | If you collect personal data: form, bookings, newsletter, chat | Privacy information, legal basis, processor contracts, record of processing |
| LSSI art. 22.2 and the AEPD guide | If you use non-essential cookies or similar tech | A consent banner with “Reject” at the same level as “Accept” |
| TRLGDCU (Royal Legislative Decree 1/2007) | If you publish prices or sell to consumers | Final price with taxes, pre-contract information, withdrawal |
| LSSI arts. 27 and 28 | If people contract or pay through the site | Explain the steps before, confirm after |
| Law 11/2023 | E-commerce by businesses that are not microenterprises | The service must be accessible |
Legal notice: who is behind the website
Article 10 of Law 34/2002 on Information Society Services (LSSI) requires any provider with an economic activity online to give certain information “permanently, easily, directly and free of charge”. You don't need to sell online: a site that promotes a business is already an economic activity. The usual approach is an “Aviso legal” (Legal notice) page linked from the footer of every page.
What must appear, following the letters of article 10.1:
- Name or company name, address, email and another direct contact detail, such as a phone number.
- Registration details in the Companies Register (Registro Mercantil) or the relevant public register, if you are registered.
- If your activity needs prior administrative authorisation, the details of that authorisation and the supervising body.
- If you practise a regulated profession: professional association (colegio), membership number, academic title, the State that issued it and the professional rules that apply.
- Your tax ID (NIF).
- If you mention prices, clear information on the price, whether it includes taxes and, where relevant, shipping costs.
- Any codes of conduct you have signed up to, and where to read them.
Self-employed or company
If you are self-employed (autónomo), the owner is you: your name, your NIF and the business address. You can add your trade name, but it does not replace your real name. If you have a company, use the full company name (with “S.L.” or “S.A.”), its NIF and its registry details: Registro Mercantil, volume, folio, sheet and entry.
Privacy: if your site collects personal data
As soon as the site collects data about people — a contact form, a booking, a newsletter, a chat — the General Data Protection Regulation (GDPR) and Organic Law 3/2018 on Data Protection and Digital Rights (LOPDGDD) apply. You are the “data controller”: you decide what the data is used for and you are accountable for it.
What the privacy policy must say
Article 13 GDPR sets out what you must tell people when you collect data from them. The LOPDGDD (article 11) allows a two-layer approach: a short summary next to the form and the full information on a separate page linked from it.
- Who the controller is and how to contact them.
- What you use the data for and on what legal basis.
- Who receives it, including the providers who process it for you.
- Whether it leaves the European Economic Area and under which safeguard.
- How long you keep it, or the criteria for deciding.
- The rights of access, rectification, erasure, objection, restriction and portability, and how to exercise them.
- The right to complain to the Spanish Data Protection Agency (AEPD).
Legal basis: why you may use the data
Every use of data needs a legal basis under article 6 GDPR. A local business website almost always relies on three: performing a contract or pre-contract steps (answering a quote request, handling a booking), consent (newsletter, marketing) and a legal obligation (keeping invoices).
In practice: you don't need a consent checkbox to handle a booking, because the person is asking for it. You do need one if you also want to send them offers, and that box must be separate, unticked and not required to book.
Contact forms
Ask only for what you need to reply: name, a way to contact them and the message. A contact form doesn't need a date of birth or an ID number. Under the submit button, show the first layer: controller, purpose, rights and a link to the full policy.
How long you keep data
The GDPR gives no number; it asks you to set a reasonable period and stick to it. A contact message that never turns into a job doesn't need to be kept for more than a few months. Customer data tied to invoices is kept as long as commercial and tax rules require. Once you no longer need it, the LOPDGDD (article 32) requires you to block it — kept only for courts and authorities until liabilities expire — and then delete it.
Providers that process data for you
The hosting your site runs on, your email service, your booking tool and your invoicing software all process customer data on your behalf: they are “processors”. Article 28 GDPR requires a contract with each one setting out what they may do with the data. Large providers include it in their terms as a data processing agreement (DPA); keep a copy or the link.
If the provider is outside the European Economic Area, for example in the United States, the transfer needs a safeguard: the company being certified under the EU-US Data Privacy Framework, or standard contractual clauses. Say so in your privacy policy.
Record of processing activities
Article 30 GDPR exempts organisations with fewer than 250 people from keeping a record, unless the processing is not occasional, is risky or involves sensitive data. A business that handles customer data every week is not doing so occasionally, so the safe choice is to keep one: a table listing each activity, purpose, data, recipients, retention periods and security measures. The AEPD's free Facilita RGPD tool generates it for low-risk businesses.
Clinics, physiotherapists, psychologists and beauty centres that record the reason for an appointment may be processing health data, which is a special category. Ask for the minimum in the form and review your case carefully: the obligations are stricter.
Prices: taxes included if you sell to consumers
Spain's consumer protection law (the consolidated text approved by Royal Legislative Decree 1/2007, known as TRLGDCU) requires the price a consumer sees to be the full final price, taxes included, with any extra charges stated. “Haircut €18” has to mean €18 at the till. If your customers are businesses or self-employed people, showing prices before VAT is common, as long as you say so next to the price (“+ VAT”).
If you sell or take paid bookings online
When the contract is concluded at a distance — the customer buys or pays for a booking on the website — the rules on electronic contracting (LSSI) and distance contracts (TRLGDCU) are added on top.
Before the contract
Article 97 TRLGDCU lists what the consumer must know before paying: what they are buying, who you are, how to contact you, the total price with taxes, payment and delivery methods, the right of withdrawal or why there is none, and the guarantees. The LSSI (article 27) adds that you must explain the steps to contract, how to fix errors before confirming and in which languages the contract can be concluded. All of this usually goes in terms and conditions linked before the payment button.
After the contract
Article 28 of the LSSI requires you to confirm the purchase, for example with an acknowledgement email, within 24 hours. That email is also the natural place to restate your cancellation terms.
Withdrawal: 14 days and the exceptions
As a general rule, a consumer can withdraw from a distance contract within 14 calendar days without giving a reason (articles 102 and 104 TRLGDCU). If you fail to tell them about this right, the period is extended by twelve months (article 105).
Article 103 lists exceptions that matter to many local businesses: services fully performed when the customer expressly agreed they could start before the period ended; goods made to measure or that spoil quickly, such as food; and accommodation, car hire, catering or leisure services for a specific date or period. A table booking with a deposit or a ticket for a workshop on a fixed date normally falls here. Having no withdrawal right doesn't exempt you from informing: you must say before payment that the right doesn't apply and what your cancellation terms are.
If your terms still mention the EU online dispute resolution (ODR) platform, update them: the platform closed on 20 July 2025 and the link is no longer required.
Accessibility: Law 11/2023
Law 11/2023 of 8 May transposes the European Accessibility Act (Directive 2019/882). Its Title I has applied since 28 June 2025 to a closed list of consumer products and services; the services include e-commerce (article 2.2.f), alongside banking, transport, communications and e-books.
Article 3.3 exempts microenterprises providing services from the accessibility requirements. A microenterprise has fewer than 10 employees and annual turnover or a balance sheet of up to €2 million. A hairdresser, workshop or small restaurant with online bookings is generally out of scope. The exemption covers services only, not products you manufacture or import.
Even when it isn't mandatory, an accessible site is a better site: good contrast, alt text, labelled form fields and keyboard navigation. Done from the start, it costs nothing extra.
What happens if you don't comply: penalties
The maximum amounts are alarming, but authorities scale fines by size, intent, harm and how quickly you fix things. The LSSI (article 39 bis) allows the lower band to be applied if you put things right promptly or acknowledge the breach.
| Law | Example of breach | Fine |
|---|---|---|
| LSSI, minor | Missing NIF, registry or membership details; cookies without information | Up to €30,000 |
| LSSI, serious | Significant failure to identify yourself or to inform about prices | €30,001 to €150,000 |
| LSSI, very serious | Exceptional cases, unrelated to an ordinary business site | €150,001 to €600,000 |
| GDPR art. 83.4 | Controller and processor obligations, security | Up to €10 million or 2% of worldwide turnover |
| GDPR art. 83.5 | Principles, legal basis, data subject rights | Up to €20 million or 4% of worldwide turnover |
Checklist
Go through your site with this list. If everything is ticked, you have the minimum covered for a local business website.
- Legal notice with name or company name, NIF, address, email and phone, linked from the footer of every page.
- Companies Register details if you are a company; colegio and membership number if your profession is regulated.
- Privacy policy naming the controller, purposes, legal bases, retention periods, providers, transfers and rights.
- Forms asking only for what's needed; a separate, unticked box for marketing.
- A contract or DPA accepted with your hosting, email, booking and invoicing providers.
- A cookie banner only if there are non-exempt cookies, with “Reject” at the level of “Accept” and nothing loaded before consent.
- Final prices including VAT for consumers, or a visible “+ VAT” if you sell to businesses.
- If you take payments online: terms and conditions, withdrawal information or its exception, a cancellation policy and a confirmation email.
How to write the texts without copying another site
Copying another business's texts is the most common mistake: they describe purposes, providers and retention periods that aren't yours. Review them too whenever you add a form, a chat, a pixel or a new tool.
An order that works: first list what your site collects and the providers you use (hosting, email, bookings, payments, analytics). Then generate a base with the AEPD's Facilita RGPD, adapt it to your case and add the legal notice with the article 10 details. If your business handles health data, takes payment up front or sells outside Spain, have a professional review it.
This guide is general information as of October 2026 and does not replace advice from a lawyer. Laws and AEPD criteria change; always check the consolidated text in the BOE (Spain's official gazette).
Frequently asked questions
Does a self-employed person need a legal notice on their website?
Yes. Article 10 of the LSSI applies to any website with an economic activity, including that of an autónomo who only presents their services. You must show your name, NIF, address and a contact email.
Does Google Analytics need a cookie banner?
Yes, if it uses cookies. The AEPD guide does not exempt analytics cookies from consent; it only says first-party ones with aggregated data pose little risk. Analytics must not load until the visitor accepts.
Does my website have to comply with the accessibility law?
Law 11/2023 has applied to e-commerce and certain other services since 28 June 2025, but microenterprises providing services (fewer than 10 people and up to €2 million turnover or balance sheet) are exempt. A purely informational site is not on the list of services.
Can my customers cancel a paid booking and get their money back within 14 days?
It depends on the service. Catering and leisure services for a specific date have no withdrawal right, but you must say so before payment and publish your cancellation terms. For other services the general 14-day period applies, unless the service has already been fully provided with the customer's express consent.
Sources
- Law 34/2002 on information society services (LSSI), consolidated text — BOE
- Regulation (EU) 2016/679, General Data Protection Regulation — EUR-Lex
- Organic Law 3/2018 on Data Protection and Digital Rights — BOE
- Guide on the use of cookies (2023 update) — AEPD
- Royal Legislative Decree 1/2007, consumer protection law (TRLGDCU) — BOE
- Law 11/2023 of 8 May, transposing EU accessibility directives — BOE
- Facilita RGPD — AEPD
- Closure of the EU online dispute resolution platform — European Consumer Centre Spain