Spain Royal Decree 1720/2007Supported in OneClickComply

Map RD 1720/2007 security duties to your GDPR programme

RD 1720/2007 is the Spanish Royal Decree that approved the regulation implementing Organic Law 15/1999 on the protection of personal data (LOPD). It sets detailed rules on data quality, consent, processor contracts, access and rectification rights, file notification to the AEPD and three levels of security measures (basic, medium and high). Organic Law 3/2018 repealed the LOPD and any provisions incompatible with the GDPR, so the decree now survives only where it remains compatible.

See the RD 1720/2007 requirements

RD 1720/2007 Aligned

Automated Evidence

OneClickFix Enabled

Continuous Monitoring

In-House Audit Team

Who needs RD 1720/2007

Is RD 1720/2007 right for your organisation?

Organisations that process personal data in Spain, and their processors, may still meet RD 1720/2007 through legacy security documents, contracts and public sector procurement terms that reference its security levels. It is most relevant to Spanish businesses migrating older LOPD compliance programmes to the GDPR and LOPDGDD, and to suppliers asked to evidence equivalent safeguards.

It is a legal or regulatory requirement for organisations in scope.

Issued by: Government of Spain, Ministry of Justice (approved 21 December 2007)
Published: BOE no. 17, 19 January 2008 (BOE-A-2008-979)
In force since: 19 April 2008
Current status: Applies only where compatible with the GDPR and Organic Law 3/2018; some articles annulled by the Supreme Court
Enforced by: Spanish Data Protection Agency (AEPD)
Structure: 158 articles in 9 titles, plus transitional and final provisions
Assessment route: No certification; medium and high level security required periodic audits under Articles 96 and 110
Type: Regulation (mandatory)
Region: Spain, EU
In OneClickComply: Supported today

How we help

OneClickComply makes it simple

RD 1720/2007 is mapped in OneClickComply's control library and available on request, so its consent, processor, data subject rights and security measure articles can sit alongside your GDPR controls. Evidence collected once from your connected tools counts towards both, and AutoComplete policies help you replace a legacy security document with a current, risk-based policy set.

Requirements covered

158 articles across 9 titles, with processor duties in Articles 20 to 22, data subject rights in Title III and the basic, medium and high security measures in Title VIII (Articles 79 to 114).

Already working towards another framework?

SOC 294% of RD 1720/2007 overlaps
NIST CSF38% of RD 1720/2007 overlaps
GDPR69% of RD 1720/2007 overlaps

Evidence you collect once counts towards every framework it applies to.

Manual RD 1720/2007 vs. OneClickComply

Manual RD 1720/2007

Working out which articles still apply after the GDPR and LOPDGDD takes legal research
Legacy security documents drift out of date as systems change
Access logs, backup tests and incident registers are gathered by hand
Processor contracts and subcontractor approvals are tracked in spreadsheets
Spanish and GDPR evidence is collected twice for overlapping controls

With OneClickComply

Expert guidance from the in-house audit team on how the decree sits alongside the GDPR
Policies generated from your real environment and kept current
Evidence collected automatically from connected tools and admin consoles
Vendor risk management keeps processor and subcontractor records in one place
Control mapping means one piece of evidence counts towards every framework

Capabilities

Everything you need for RD 1720/2007

RD 1720/2007 articles mapped to the same controls as your GDPR programme

Automated evidence for access control, authentication and backups from 13,000+ integrations

AutoComplete policies to replace a legacy LOPD security document

Processor and vendor risk management for Article 20 to 22 obligations

Continuous monitoring with alerts when access logging or backup controls drift

Ask an Auditor guidance on which legacy requirements still apply

How it works

Three steps to RD 1720/2007 compliance

Connect & scan

Connect your cloud, identity and SaaS tools. OneClickComply checks them against RD 1720/2007 and shows you exactly where you stand.

Fix & generate

OneClickFix remediates technical gaps in one click, and AutoComplete generates RD 1720/2007-aligned policies from your real environment.

Monitor & evidence

Continuous monitoring keeps you compliant, and our in-house audit team is on hand when you need expert guidance.

Requirements

Spain Royal Decree 1720/2007 requirements

Articles 1 to 114 of the regulation individually, with the AEPD procedures in Title IX (Articles 115 to 158) grouped by chapter; titles are English translations and Articles 11 and 18 were annulled by the Supreme Court.

Reference	Requirement
Art. 1	Purpose
Art. 2	Material scope
Art. 3	Territorial scope
Art. 4	Excluded files and processing
Art. 5	Definitions
Art. 6	Calculation of time limits
Art. 7	Publicly accessible sources
Art. 8	Data quality principles
Art. 9	Processing for statistical, historical or scientific purposes
Art. 10	Grounds legitimising processing or disclosure of data
Art. 11	Verification of data in applications to public administrations (annulled)
Art. 12	General principles of consent
Art. 13	Consent for processing minors' data
Art. 14	Method of obtaining consent
Art. 15	Requesting consent within a contract for unrelated purposes
Art. 16	Billing and traffic data in electronic communications services
Art. 17	Withdrawal of consent
Art. 18	Proof of compliance with the duty to inform (annulled)
Art. 19	Special cases of the duty to inform
Art. 20	Relationship between controller and processor
Art. 21	Subcontracting of processing services
Art. 22	Retention of data by the processor
Art. 23	Personal nature of the rights
Art. 24	General conditions for exercising access, rectification, cancellation and objection rights
Art. 25	Procedure for exercising rights
Art. 26	Exercising rights before a processor
Art. 27	Right of access
Art. 28	Exercising the right of access
Art. 29	Granting access
Art. 30	Refusal of access
Art. 31	Rights of rectification and cancellation
Art. 32	Exercising the rights of rectification and cancellation
Art. 33	Refusal of rectification and cancellation
Art. 34	Right to object
Art. 35	Exercising the right to object
Art. 36	Right to object to decisions based solely on automated processing
Art. 37	Rules applicable to credit and solvency files
Art. 38	Requirements for including debt data
Art. 39	Information before inclusion in a credit file
Art. 40	Notification of inclusion
Art. 41	Retention of credit data
Art. 42	Access to information in the credit file
Art. 43	Liability for credit file data
Art. 44	Exercising rights in credit information files
Art. 45	Data that may be processed for marketing and information to the data subject
Art. 46	Processing data in advertising campaigns
Art. 47	Cleansing of personal data
Art. 48	Exclusion files for commercial communications
Art. 49	Common exclusion files for commercial communications
Art. 50	Access, rectification and cancellation rights in marketing
Art. 51	Right to object to marketing
Art. 52	Instrument creating, modifying or deleting a public sector file
Art. 53	Form of the instrument
Art. 54	Content of the instrument
Art. 55	Notification of files
Art. 56	Processing data on different media
Art. 57	Files with more than one controller
Art. 58	Notification of modification or deletion of files
Art. 59	Notification forms and media
Art. 60	Registration of files
Art. 61	Cancellation of registration
Art. 62	Correction of errors
Art. 63	Ex officio registration of public sector files
Art. 64	Cooperation with regional supervisory authorities
Art. 65	Compliance with Organic Law 15/1999 for international transfers
Art. 66	Authorisation and notification of international transfers
Art. 67	Adequate protection agreed by the AEPD
Art. 68	Adequate protection declared by the European Commission
Art. 69	Temporary suspension of transfers
Art. 70	Transfers subject to authorisation by the AEPD Director
Art. 71	Purpose and nature of codes of conduct
Art. 72	Initiative and scope of codes of conduct
Art. 73	Content of codes of conduct
Art. 74	Additional commitments in codes of conduct
Art. 75	Guarantees of compliance with codes of conduct
Art. 76	List of code adherents
Art. 77	Deposit and publication of codes of conduct
Art. 78	Obligations after registering a code of conduct
Art. 79	Scope of security measures
Art. 80	Security levels
Art. 81	Application of security levels
Art. 82	Security obligations of the processor
Art. 83	Services without access to personal data
Art. 84	Delegation of authorisations
Art. 85	Access to data over communications networks
Art. 86	Working outside the controller's or processor's premises
Art. 87	Temporary files and working copies
Art. 88	Security document
Art. 89	Staff duties and obligations
Art. 90	Incident register (basic level, automated files)
Art. 91	Access control (basic level, automated files)
Art. 92	Media and document management (basic level, automated files)
Art. 93	Identification and authentication (basic level, automated files)
Art. 94	Backup and recovery (basic level, automated files)
Art. 95	Security officer (medium level, automated files)
Art. 96	Audit (medium level, automated files)
Art. 97	Media and document management (medium level, automated files)
Art. 98	Identification and authentication (medium level, automated files)
Art. 99	Physical access control (medium level, automated files)
Art. 100	Incident register (medium level, automated files)
Art. 101	Media management and distribution (high level, automated files)
Art. 102	Backup and recovery (high level, automated files)
Art. 103	Access logging (high level, automated files)
Art. 104	Telecommunications encryption (high level, automated files)
Art. 105	Common obligations for non-automated files
Art. 106	Filing criteria
Art. 107	Storage devices
Art. 108	Custody of media
Art. 109	Security officer (medium level, non-automated files)
Art. 110	Audit (medium level, non-automated files)
Art. 111	Storage of information (high level, non-automated files)
Art. 112	Copying or reproduction of documents
Art. 113	Access to documentation
Art. 114	Transfer of documentation
Title IX, Chapter I (Arts. 115 and 116)	General provisions on AEPD procedures
Title IX, Chapter II (Arts. 117 to 119)	Procedure for protecting access, rectification, cancellation and objection rights
Title IX, Chapter III (Arts. 120 to 129)	Sanctioning procedures and preliminary investigations
Title IX, Chapter IV (Arts. 130 to 136)	File registration and cancellation procedures
Title IX, Chapter V (Arts. 137 to 144)	International transfer authorisation and suspension procedures
Title IX, Chapter VI (Arts. 145 to 152)	Code of conduct registration procedure
Title IX, Chapter VII (Arts. 153 to 158)	Other AEPD procedures, including exemption from the duty to inform

Always check the official RD 1720/2007 text for the exact wording.

RD 1720/2007 FAQs

What is RD 1720/2007?

RD 1720/2007 is the Spanish Royal Decree approving the regulation that implemented Organic Law 15/1999 on personal data protection (LOPD). Approved on 21 December 2007 and in force since 19 April 2008, it sets detailed rules on consent, processors, data subject rights, file notification to the AEPD, international transfers, codes of conduct and three tiers of security measures for automated and paper files.

Is RD 1720/2007 still in force?

Partly. RD 1720/2007 has not been formally repealed as a whole, but Organic Law 3/2018 (LOPDGDD) repealed the LOPD and any provisions of equal or lower rank that contradict or are incompatible with the GDPR or the LOPDGDD. In practice, obligations such as file registration and fixed security levels have been replaced by the GDPR's accountability and risk-based approach, so each article must be read against current law.

Who has to comply with RD 1720/2007?

In principle, controllers and processors processing personal data in Spain, to the extent its provisions remain compatible with the GDPR and LOPDGDD. Today it matters most to organisations with legacy LOPD documentation, public sector suppliers whose contracts reference its security levels, and businesses using its basic, medium and high measures as a practical benchmark for technical and organisational security.

What are the RD 1720/2007 security levels?

Title VIII of RD 1720/2007 defined three cumulative security levels: basic, medium and high, chosen by the type of data processed. Basic measures covered staff duties, incident registers, access control, media management, identification and backups. Medium added a security officer, periodic audits and physical access control. High added encrypted media distribution, access logging and encrypted telecommunications for sensitive data.

What are the penalties for breaching RD 1720/2007?

RD 1720/2007 does not set its own fines. Infringements of data protection rules in Spain are now sanctioned by the AEPD under the GDPR and Organic Law 3/2018. Under the GDPR, the most serious infringements can attract fines of up to 20 million euros or 4% of worldwide annual turnover, whichever is higher, alongside corrective orders.

How does RD 1720/2007 relate to GDPR and ISO 27001?

The GDPR and the LOPDGDD now take precedence, and RD 1720/2007 applies only where it is compatible with them. Its security measures overlap heavily with ISO 27001 Annex A controls such as access control, logging, backup and media handling, so an ISO 27001 information security management system and a GDPR programme usually cover the same ground with a risk-based approach.

How do I comply with RD 1720/2007 today?

Start by building a GDPR and LOPDGDD compliant programme, then review legacy RD 1720/2007 documents to keep measures that still add value, such as access logging and backup testing. Replace the old security document with risk-based policies, keep processor contracts aligned with GDPR Article 28, and record evidence that your technical and organisational measures operate in practice.

Does OneClickComply support RD 1720/2007?

RD 1720/2007 is mapped in OneClickComply's control library and available on request. Its articles are linked to the same controls used for the GDPR and ISO 27001, so evidence collected automatically from your tools counts towards each. OneClickComply does not issue certifications or guarantee compliance, but the in-house audit team can advise on how the decree applies to you.

Related standards

All standards

Get RD 1720/2007 ready, not stressed

Automate controls, gather evidence continuously and stay audit-ready, all on one platform.