Compliance and security at Corpshore Spain

Providers of basic services of general interest fall within scope regardless of headcount or turnover. No threshold exempts you.

Main obligations: support cannot be exclusively automated and human intervention must be guaranteed on request; a target of answering 95 percent of calls in under three minutes on average; complaints resolved within fifteen working days, and five working days for billing complaints on basic services.

The adaptation deadline is 28 December 2026.

Above those thresholds the same customer service obligations apply, even if you do not provide basic services of general interest.

One point that matters if you outsource: the law applies regardless of whether the service sits in your structure or a third party's, and regardless of geographic location. Outsourcing does not place it beyond the law's reach.

Royal Decree 311/2022 binds the Spanish public sector and also the suppliers that serve it, including foreign ones.

Systems fall into basic, medium or high category, deduced from potential impact rather than chosen. Basic category is evidenced by a declaration of conformity; medium and high require certification from an accredited certification body, audited every two years.

Worth knowing before preparing a bid: Corpshore does not currently hold ENS certification from an accredited body, so if your tender requires medium or high category you will need a certified provider for that part of the scope.

In Spain the National Markets and Competition Commission is the Digital Services Coordinator, with supervision, investigation and sanction powers over intermediaries established in Spain, including access to moderation and recommendation algorithms.

Obligations that shape daily operations: notice-and-action mechanisms; a statement of reasons to the affected user for every content removal; and a free internal complaint system. Marketplaces must additionally verify seller identity.

The statement of reasons obligation affects service design most, because it requires every decision to be recorded with its basis at the moment it is taken, not reconstructed afterwards.

The Article 50 transparency obligations have applied since 2 August 2026: people must know they are interacting with an AI system, and synthetic content must be labelled.

High-risk system obligations come later: December 2027 for Annex III cases and August 2028 for Annex I. That timetable allows documentation to be prepared rather than improvised.

Read alongside Law 10/2025, the real margin is this: you can automate a great deal, you must say that you do, and you cannot close the door on a person.

Processing is prohibited unless an Article 9.2 exception applies. The management of health care services is expressly covered in point (h).

Paragraph 9.3 adds a requirement bearing on any external team: processing must be carried out by a professional subject to secrecy, or by another person also subject to an obligation of secrecy under Member State law. In Spain that anchor exists in Article 16.6 of Law 41/2002.

One useful precision, because it is frequently overstated: Spanish law contains no obligation to host health data in Spain or the European Union. What applies is Chapter V of the GDPR. We recommend delivery inside the European Economic Area, and we say that as our own recommendation rather than a legal requirement.

Chapter V of the GDPR applies. If the destination country holds a European Commission adequacy decision the transfer needs no additional instrument; if it does not, standard contractual clauses are required and, depending on data sensitivity, a transfer impact assessment.

Of the corridor hubs, Poland is inside the European Economic Area and creates no transfer. Mexico, Colombia, the Dominican Republic, Uzbekistan and the Philippines hold no adequacy decision.

This question is worth settling before any other, because it decides which country can deliver the service and overrides any cost consideration.