Does the Spanish Data Protection Agency have free forms for exercising my rights?

Yes. The AEPD publishes on its website, under «Modelos y formularios», a free form for each right: access, rectification, erasure, objection, restriction and portability. You may use it instead of this letter. The letter is for when you want to set out the data and the reasons in your own words and send it by a means that records the date.

What if a Spanish company does not answer my data request within a month?

You can complain to the Spanish Data Protection Agency on its website, free of charge, with a copy of this request and proof of the date it was sent (the burofax or certified-post receipt, or the e-mail). Before admitting it, the AEPD may pass it to the controller's data protection officer, who has one month to answer (Article 65.4 of Spain's Organic Law 3/2018).

Can a Spanish company ask for a copy of my ID card before answering?

It may ask only for the further information needed to confirm your identity, and only where it has reasonable doubts about it (Article 12.6 GDPR). This letter already gives your name and address and, if you wish, your DNI or NIE. Exercising the rights is free, except for manifestly unfounded or excessive requests, for example repetitive ones (Article 12.5 GDPR).

Exercising the GDPR rights of access, erasure or objection (Spain)

Name: Exercising the GDPR rights of access, erasure or objection (Spain)
Brand: DocMuse
SKU: ejercicio-de-derechos-rgpd-acceso-supresion-oposicion
Price: 1.38 EUR
Availability: InStock
Author: DocMuse

€1.38Fill it in online free — pay only to download

11 questions · about 5 min

This document is in Spanish

The PDF you download is in Spanish — that is the language it has to be filed in, so it is not translated. Everything on this page is here to tell you what it says.

Your answers appear in place as you type. The full wording is in the PDF you download. Tinted blanks are still empty. The tint is only on screen, not in your PDF. Select a blank to go to its question.

Fill out the form

Your answers stay on this device for 7 days, or until you clear them.

0 of 0 answered

Instant download after payment
Backup link emailed to you
No account needed

The Spanish Data Protection Agency (AEPD) publishes free forms for exercising these rights: you do not need DocMuse for it. This Spanish letter, in Spanish, is for anyone who wants to know what personal data a company or body in Spain holds about them, have it erased or stop its use. It exercises, before the data controller, the right of access (Article 15 GDPR), erasure (Article 17) or objection (Article 21), as you choose, names the data and the reason, and recalls the one-month deadline and that it is free. Send it by burofax, certified post or by hand, or to the e-mail address in the privacy notice.

Made for use in Spain
Last updated October 20, 2026

Print & sign

1 page

Published byDocMuse

When to use this document

A company in Spain keeps sending you advertising and you want it to stop using your data.
You want to know what personal data a shop, bank or app holds about you.
You closed an account years ago and want the company to delete everything it still keeps.
You want to send a data access or deletion request that leaves a dated record.

What you fill in

The details the document asks for.

Sender
Sender's address
Sender's DNI or NIE (Spanish identity number)
How the letter is sent (printed above the recipient)
Data controller
Controller's postal address (from its privacy notice)
City
Date
Right you exercise
Data or processing concerned (account, service, dates)
Grounds for erasure or objection (if any)

Common questions

Does the Spanish Data Protection Agency have free forms for exercising my rights?: Yes. The AEPD publishes on its website, under «Modelos y formularios», a free form for each right: access, rectification, erasure, objection, restriction and portability. You may use it instead of this letter. The letter is for when you want to set out the data and the reasons in your own words and send it by a means that records the date.
What if a Spanish company does not answer my data request within a month?: You can complain to the Spanish Data Protection Agency on its website, free of charge, with a copy of this request and proof of the date it was sent (the burofax or certified-post receipt, or the e-mail). Before admitting it, the AEPD may pass it to the controller's data protection officer, who has one month to answer (Article 65.4 of Spain's Organic Law 3/2018).
Can a Spanish company ask for a copy of my ID card before answering?: It may ask only for the further information needed to confirm your identity, and only where it has reasonable doubts about it (Article 12.6 GDPR). This letter already gives your name and address and, if you wish, your DNI or NIE. Exercising the rights is free, except for manifestly unfounded or excessive requests, for example repetitive ones (Article 12.5 GDPR).

How you can sign this document

Print it and sign by hand. The signature lines in the document are left blank on purpose — sign on them in ink.
Sign it yourself with a qualified electronic signature. If you already hold a QES — Evrotrust, B-Trust, StampIT, ZealiD or any qualified provider on the EU Trusted List, on a card, a USB token, in a mobile app or in the cloud — our signing guide explains step by step how to sign this exact file without invalidating it. Step-by-step help, and a way to check it worked

DocMuse sells documents, not legal advice. Acceptance always depends on the recipient's rules and your local law.