The Home-Country Imprint Mistake (and Why It Gets Expats Into Trouble)
The legal requirements for a business website in Spain catch a surprising number of expat business owners off guard, not because the rules are unusually complex, but because most people assume their home-country setup carries over. It does not.
A British business owner in Jávea copies the “Terms & Conditions” page from their old UK site. A German restaurateur in Dénia pastes in their German Impressum, translates it loosely into Spanish, and considers the job done. Both are well-intentioned. Both are almost certainly non-compliant with Spanish law.
If you live and operate from Spain, Spanish law governs your website. Full stop. The LSSI-CE (Ley de Servicios de la Sociedad de la Información y de Comercio Electrónico) and the LOPDGDD (the Spanish data protection act that sits alongside the EU’s GDPR) apply to you, regardless of your nationality, where your business was originally registered, or which country your hosting provider is based in.
This article is a plain-English orientation for English-speaking business owners on the Costa Blanca who want to understand what their site probably needs and why. This is not legal advice. Exact requirements depend on your specific activity, your target market, and how your business is structured. For anything binding, speak to a Spanish lawyer or a qualified data protection consultant.
With that said: here is what a data-collecting business website in Spain usually needs.
The Three Layers Most Business Websites in Spain Need
For a site that collects any personal data, even just a contact form asking for a name and email address, there are typically three distinct legal texts required. They serve different purposes under different laws, which is why you cannot compress them into one page and call it done.
1. Aviso Legal (Required by the LSSI-CE)
The Aviso Legal is Spain’s equivalent of an imprint. It is required under Article 10 of the LSSI-CE for any website operated by a business or self-employed person (autónomo) offering services or information online.
What it must contain:
- Your full legal name or business name
- Your registered address in Spain (not a PO box, not your home country)
- Your NIF or NIE number
- Contact details (email address at minimum)
- Details of any professional body registration if relevant to your activity
- Your registration in the Spanish Mercantile Registry or equivalent, if applicable
The key point: the address must be Spanish. A UK registered office or a German business address does not satisfy this requirement if you are established and operating from Spain. The LSSI-CE looks at where the service provider is actually established, and if that is Dénia or Calpe or Moraira, the Aviso Legal must reflect that.
Risk if missing: The LSSI-CE allows for fines ranging from minor infractions (up to €30,000) through to serious ones. Competitors and consumer protection bodies do make complaints. It is a straightforward thing for a regulator or a complaints platform to check.
2. Privacy Policy (Required by GDPR and LOPDGDD)
If your website collects personal data, which includes names, email addresses, phone numbers, IP addresses, and enquiry content submitted via a form, you need a Privacy Policy that meets GDPR and LOPDGDD requirements.
What it must explain:
- Who is the data controller (you, with your Spanish contact details)
- What data is collected and through which channels
- The legal basis for processing each category of data
- How long data is retained
- Whether data is shared with third parties (your email provider, CRM, booking platform, etc.)
- The rights of users: access, rectification, erasure, portability, objection
- How to exercise those rights and how to file a complaint with the AEPD
What a GDPR-style policy from your home country misses: The LOPDGDD adds Spanish-specific requirements, including specific reference to the AEPD as the competent supervisory authority and certain procedural obligations around minor data. A generic EU GDPR template from a UK site may not cover these.
Risk if missing: The AEPD (Agencia Española de Protección de Datos) can and does fine businesses for absent or inadequate Privacy Policies. GDPR fines can reach €20 million or 4% of global annual turnover for serious infringements. Minor infractions attract smaller but still significant penalties. The AEPD publishes its decisions publicly, so there is reputational exposure too.
3. Cookie Consent (Required by LSSI-CE and GDPR)
If your site sets any cookies beyond strictly necessary ones, including Google Analytics, Meta Pixel, embedded YouTube videos, or third-party booking widgets, you need prior, informed user consent before those cookies are activated.
What compliant cookie consent looks like:
- A banner that appears before non-essential cookies are set (not after)
- Clear options to accept or reject, without pre-ticked boxes
- A link to a full Cookie Policy explaining what each cookie does, who sets it, and how long it lasts
- The ability for users to change their preferences later
- No “accept” button that is larger or more prominent than “reject” in a way that constitutes dark patterns
The AEPD published detailed guidance on cookie requirements in 2023 and has issued fines specifically for non-compliant banners. Pre-ticked boxes, implied consent (“by continuing to browse…”), and banners with no reject option are all non-compliant.
What if your site has no form and no analytics? A purely informational site with no contact form, no analytics, and only strictly necessary technical cookies may need less. The Aviso Legal is still likely required under the LSSI-CE, but the Privacy Policy obligation reduces significantly and cookie consent may not apply. This is one reason site architecture matters early in the build process.
When a Purely Informational Site May Need Less
Not every website collects personal data. A simple one-page site listing your opening hours and address, with no contact form and no tracking scripts, sits in a different category. You likely still need the Aviso Legal under the LSSI-CE. But the Privacy Policy obligation is tied to data processing, if you are not processing personal data, the obligation is reduced or absent. Cookie consent is triggered by non-essential cookies, if you are not running them, it does not apply.
That said, most business websites do have a contact form, do run some form of analytics, and do embed third-party content. If yours falls into that category, all three layers are likely relevant.
Why “My Designer Will Handle It” Is Not Quite Right Either
Legal texts are not a design task. A web designer can build the pages and make them accessible from every page on your site, which is itself a requirement: the Aviso Legal must be permanently accessible, usually via the footer. But the content of those legal texts needs to reflect your actual business: your data, your third-party services, your legal basis for processing.
What I do at WebDesign Costa Blanca: legal pages are included as standard in every website package, not sold as an add-on. The pages are structured correctly and include the fields the LSSI-CE requires. But I always advise clients to have a Spanish lawyer or a data protection specialist review the content for their specific situation before the site goes live. That review is inexpensive relative to the risk of getting it wrong.
A Note on Language
The LSSI-CE does not require your Aviso Legal to be written in Spanish, but it does require it to be accessible and understandable. If your primary audience is English-speaking, an English-language Aviso Legal is broadly acceptable, though having a Spanish version as well is sensible if you also target Spanish speakers. Cookie banners should be in the language your site operates in.
Get the Legal Foundation Right From the Start
If you are building or relaunching a business website on the Costa Blanca and want to make sure the legal structure is correct from day one, get in touch. I can tell you exactly what pages your site needs, how they will be built, and who to speak to for the legal content review. No add-ons, no surprises.