GDPR 2025: new obligations for Spanish companies

In 2025, Spanish companies strengthen GDPR compliance programs amid increased AEPD scrutiny and new expectations for documentation, training and incident management. Document anonymization is consolidating as a key technical control.

Areas of increased scrutiny

• Updated records of processing activities.
• Impact assessments for high-risk processing.
• Reviewed data processor contracts.
• Documented breach response procedures.

How to prepare

Audit document workflows, automate anonymization before sharing files and train staff on data protection.

Role of anonymization in the compliance program

Authorities expect concrete technical measures, not only policies. Including document anonymization in the compliance plan demonstrates minimization and privacy by design in daily operations such as vendor sharing or publishing minutes.