Business compliance in Spain
Guidance for businesses and international clients
A useful compliance review starts with what your business actually does. Identify the applicable obligations, the gaps and who will resolve them, rather than relying on a generic certificate that promises compliance with every law.
Map your business and responsibilities
We review the legal structure, activities, workplaces, markets, staff and handling of customer information. A Spanish company, branch and non-resident VAT registration do not carry identical obligations.
Agree the review scope at the start: documents examined, specialist input, deliverables and follow-up. A focused review of one area is not an audit or certification of the whole business.
Corporate and tax administration
Deadlines and responsibilities should be recorded in a practical calendar. A filing receipt proves submission, not necessarily that the figures or legal treatment are correct.
- Company records, directors’ powers, beneficial-ownership information and changes requiring registration.
- Accounting, annual accounts, tax returns, electronic notifications and evidence of submission.
- VAT, ROI/VIES, customs identification and cross-border transactions where relevant.
- Licences, permits, contracts and sector rules applicable to the activity.
Employees, customers and information
For employers, review contracts, collective agreements, payroll, working time, prevention and workforce-size duties. Coordinate with the occupational-prevention provider and HR team instead of assuming payroll outsourcing covers every obligation.
For personal data, assess lawful grounds, notices, security, retention and processor arrangements under the GDPR and Spain’s data-protection law. Online sales also need appropriate customer information, terms and cookie controls.
AML, reporting channels and criminal-risk controls
Anti-money-laundering duties depend on whether the business is an obliged entity under Law 10/2010 and on the relevant activity and exceptions. Customer checks, training, internal controls and external review must be assessed for that business; they are not identical for every company.
Internal reporting systems are generally required for private entities with 50 or more workers and certain regulated activities irrespective of size. Criminal-risk prevention is another distinct assessment; no generic programme guarantees immunity.
A review that leads to clear next steps
- Collect the relevant records and confirm any missing information.
- Prioritise gaps by their legal and operational significance.
- Assign an owner, deadline and supporting evidence to each action.
- Confirm which implementation and ongoing monitoring tasks are included in the agreed service.
Frequently asked questions
Does every Spanish company need the same compliance package?
No. Requirements vary with legal structure, activity, workforce, transactions and the data processed.
Does the review guarantee there will be no inspection or penalty?
No. It identifies and addresses the agreed areas. Compliance also depends on implementation, continuing activity and changes in law.
Tell us what your business needs
Share the planned activity, countries involved and any deadlines. We will confirm the information needed, the service scope and a case-specific quotation.
Contact our teamRelated services
Official sources
Sources are published in the issuing organisation’s language.
- BOE — Ley de Sociedades de Capital
- Agencia Española de Protección de Datos
- BOE — Ley 10/2010
- BOE — Ley 2/2023
General information. Requirements depend on the activity, documents and applicable rules.