1. Home
  2. Personal data
  3. When and how do we collect your personal data?
  4. When and how do we collect your personal data?

When and how do we collect your personal data?

Most of the personal information we process is provided directly by you for one of the following reasons:

  • You have filed a complaint or a request.
  • You have asked us for information.
  • You wish to attend or have attended an event or a seminar, either live or online.
  • You have subscribed to our e-Newsletter or to our mailing list for press releases.
  • You have applied for a traineeship to our Authority.
  • You have contacted the Authority directly or have participated in a consultation. 
  • You represent a natural or legal person before the Authority.
  • You have provided us with your data due to the Authority’s financial obligations (e.g. supplier data).

We may also receive your personal information from other sources, in the following cases:

  • We have contacted a complainant for clarifications about a complaint submitted to our Authority; he/she gives us your personal information in his/her reply.
  • Your personal information is contained in documents submitted to the Authority by controllers and processors in accordance with the provisions of the GDPR (e.g. breach incident notifications, data protection impact assessment drafts submitted for consultation, Data Protection Officers’ communications, etc.).
  • A complainant refers to you in the text of his complaint or in the documents submitted to our Authority.
  • We have confiscated documents or storage media during an audit carried out where your personal data are included.
  • In the exercise of our duties your data is communicated to us by other regulators or law enforcement bodies.

We collect and publish statistics, such as the number of requests received, but not in a form that allows the identification of persons.

During the exercise of our duties, if we need to process data of specific categories, such as health data, racial origin, sexual life, trade union action, etc., provided to us because you consider it absolutely necessary to substantiate your complaint, the legal basis for processing is Article 9(2) (g) of the GDPR, which relates to our public duty and to safeguarding your fundamental rights.

We use the cookies that are necessary to maintain your connection to the online services of the HDPA’s Portal and to store your preferences in relation to optional cookies (“Necessary”).
Only with your consent we will use any of the following optional cookies you select (“Analytics”, “LinkedIn”, “Twitter”). You can see information on each cookie category by passing the cursor over each option.