SDPA publishes report on the practical implications of the GDPR for companies during the period of transition On 29 June 2016, the Spanish Data Protection Agency (hereinafter "SDPA") published a report which discussed the practical implications of the General Data Protection Regulation (hereinafter "GDPR") for companies during the period of transition. The purpose of the SDPA's report is to explain the difficulties that companies may face during compliance and to recommend steps to take in order to address them. In particular, the SDPA's report discusses the following points: • Information and consent: data subjects' consent should be an unambiguous manifestation or a clear affirmative act, which excludes the use of implied consent. This means that controllers should thoroughly review how consent is currently obtained and registered in order to comply with the new GDPR requirements. The SDPA further recommends that organizations start making use of their websites and communication channels in order to comply with the relevant new information requirements set forth in the GDPR and anticipate the potential risks. • Privacy Impact Assessments (PIAs): The SDPA recognizes the significance of having PIAs in place. Companies that immediately implement this tool are likely to be better placed than others who do not have PIAs, and are able to identify the difficulties, shortcomings and mistakes early on. • Relationship between controllers and processors: the SDPA recommends that both controllers and processors review existing agreements, which should incorporate clauses containing the GDPR's new obligations to ensure consistency with the new regime. • Certification: the SDPA recognizes the National Accreditation Entity (ENAC) as the entity in charge of the accreditation mechanisms foreseen in the GDPR and acknowledges that the ENAC certification is not a pre-requisite to becoming a Data Protection Officer. For more information, please contact Raul Rubio, Patricia Perez, Rosario Alvarez, Ignacio Vela, Alvaro Ubeda or Cristina Monereo.