Spain - Country Commercial Guide
Digital Economy
Last published date:

Overview

Spain’s digital economy sector is well developed and rapidly growing. A strong digital ecosystem supports a broad range of economic activity, from telecommunications to e-commerce and digital media.  

Spain boasts one of the most robust digital infrastructures in Europe, with a high-quality fiberoptic network and a strategic geographic position for undersea cables. Fiber-to-the-premises coverage stands at 95.2% and 5G at 92.3%. This solid foundation enables the private and public sectors to pursue advanced and emerging technologies, such as quantum computing and AI. The Spanish government aspires to be a leader in advanced technologies, both across Europe and the Spanish speaking world.

Spain outlines its digital priorities in España Digital 2026 (Digital Spain 2026), an annual roadmap to digital development and transformation published since 2020. The document is supported by eight specific subsector digitalization plans, including:

  • Infrastructure
  • 5G  
  • Cybersecurity  
  • AI
  • Public administration
  • Small-and-medium-sized businesses
  • Audiovisual, and
  • Skills development.

The roadmap draws resources from the Plan de Recuperación, Transformación y Resiliencia (Plan for Recouperation, Transformation, and Resilience or RRP). This plan outlines the Spanish government’s use of NextGeneration funds, part of the EU’s post-COVID recovery program, EU. Spain allocates approximately 26% of these funds to digital matters, which includes fortifying the digital infrastructure and developing advanced technologies.

In 2024, the Ministry for Digital Transformation and Civil Service launched the Sociedad Estatal para la Transformación Tecnológica (State Corporation for Technology Transformation or SETT), a public company dedicated to investment in subsectors such as technology, semiconductors, audiovisual, and telecommunications. The vehicle is to be funded by $22 billion, including NextGenerationEU funds.

Inbound investment into Spain has outpaced its neighbors and the OECD average (% of GDP). Across all sectors, the country has received the equivalent of 2.3% of GDP in foreign direct investment over the last five years, compared to just under 1% for OECD countries. U.S. companies, both large and small, have been investment leaders in many segments of the digital economy, with several large-scale investments in digital infrastructure and partnerships in the development of advanced technologies.


Market Challenges

In a speech at the February 2024 Mobile World Congress in Barcelona, newly appointed Minister for Digital Transformation and Civil Service, José Escrivá, outlined several systemic constraints on the further development of the digital economy. Some challenges outlined by the minister include:  

  • Necessary improvements to the ICT infrastructure,  
  • Lack of green energy,  
  • Shortage of talent, and  
  • Uncertain policies regarding the use of data.

Overall, Spain and the EU have robust digital regulatory frameworks, though emerging issues such as AI and digital taxation are unresolved or continue with questions over enforcement parameters.

Companies entering Spain or the EU for the first time can find regulatory compliance to be a challenge. U.S. firms may find heightened regulatory requirements in their subsector when compared to other markets, especially in areas such as data protection, anti-competitive practices, and environmental standards. This guide contains a high-level overview of subsector and issue-specific regulation. The regulatory framework is developing, especially regarding emerging technologies, and could have changed after the time of publication.  

The Commercial Service at the U.S. Mission to the EU maintains a chapter of the Country Commercial Guide related to EU matters on the Digital Economy that affect Spain.

Those targeting the Spanish public sector will typically encounter a fair and transparent process, though challenges still exist. Many public procurements prioritize price and commonly utilize reverse auctions, leaving some U.S. firms finding it difficult to compete. Some sectors encounter local content or in-market experience requirements that complicate bidding. Furthermore, in some sensitive sectors across the EU, regulators have discussed “sovereignty requirements,” or mandating that companies have a presence in the EU or countries of acquisition.

Data Privacy

The foundation of the EU’s data privacy regime is the General Data Protection Regulation (GDPR). The regulation, which came into effect in 2018, covers a wide array of data privacy issues, particularly regarding usage, storage, and transfer of individuals’ data. The GDPR is implemented and complemented in Spanish law through the Ley Orgánica de Protección de Datos Personales y Garantía de los Derechos Digitales (Organic Law on the Protection of Personal Data and Guarantee of Digital Rights or LOPDGDD). It is crucial for any company operating in Spain to comply with these data privacy requirements.

In July 2023, the European Commission adopted its adequacy decision for the EU-U.S. Data Privacy Framework. On this basis, personal data can be transferred from the EU to U.S. companies participating in the Framework as if the U.S. company were in the EU.

Agencia Española de Protección de Datos (Spanish Agency for the Protection of Data or AEPD) is the implementing authority of the LOPGDD and GDPR. AEPD manages claims by individuals, imposes fines on data controllers, and protects individual’s rights of access, deletion, portability, and opposition to the processing of automated decisions.

Digital Services Tax

The EU continues to debate the issue of a digital services tax (DST) imposed on digital platforms that access the EU market but do not have the established presence through which they contribute to the tax base. The EU continues to work closely with the Organization for Economic Cooperation and Development (OECD) on a global framework.

In the absence of a coordinated EU or global framework, EU Member States like Spain have taken unilateral action on digital services taxation. The 2020 Spanish DST Act applies to companies with net global revenues exceeding €750 million and revenues derived from Spain (through Spanish users) of at least €3 million, regardless of the taxation status of the company in the country. The tax rate is 3% of gross income obtained from the provision of services in Spain. The implementation of measure is currently paused as the OECD debates a coordinated approach. U.S. firms should analyze their potential exposure to DST, as the developing and dynamic application could result in an unexpected tax burden.

Online Harm Mitigation

The Spanish and EU focus on online harms is focused mainly on content moderation (e.g., removing disinformation), prohibiting anti-competitive practices, and harms experienced by minors in the digital environment. Several EU and Spanish data privacy laws (e.g., GDPR and LOPDGDD) also contain provisions related to reducing the prevalence of digital harms.

In 2022, the EU passed the Digital Services Act (DSA), which regulates several aspects of online intermediaries and platforms such as social networks and marketplaces. The DSA has wide-ranging provisions including standards for content moderation, transparency in algorithms, consumer protection, and anti-competitive practices. The EU’s Digital Markets Act (DMA) augments the anti-competitive practices provisions of the DSA, particularly regarding large online platforms that act as “gatekeepers,” or those with the power to arrange for self-preferencing in the digital environment.

Spain has taken action to address the harms experienced by minors in the digital environment. AEPD leads the Working Group on Minors, Digital Health, and Privacy. In 2024, the agency published the 10 priorities of the working group, including international cooperation to reduce harm to minors in the digital environment. These priorities can be found in the Estrategia de Menores, Salud Digital y Privacidad (Strategy on Minors, Digital Health, and Privacy).

In 2024, the Ministry of Digital Transformation and Civil Service announced that they would release a Cartera Digital Beta or “digital wallet” system that allows users to verify their age before accessing adult content online. The system has not been implemented as of the time of publication.

Artificial Intelligence (AI)

The EU AI Act technically went into force in August 2024. However, most of its provisions will become applicable over the following three years. The EU AI Act’s graduated regulations consider the risk category of the AI product when applying standards for risk management, testing, data training, transparency, human oversight, and cybersecurity. The overall goal of the EU AI Act is the set standards for transparency, safety, and ethical use.

Spain became the first EU Member State to create an oversight body for AI with the Agencia Española de Supervisión de la Inteligencia Artificial (Spain Agency for the Supervision of Artificial Intelligence or AESIA). Created in January 2024, the agency’s mandate will empower it to enact European AI regulation, coordinate with other EU AI offices, promote innovation, and join the international debate on AI use. Prior to the creation of AESIA, Spain’s AI policy was set by the Consejo Asesor de Inteligencia Artificial (Artificial Intelligence Advisory Council). The Council was created in 2020 to advise the then Minister of Economy and Digital Transformation on AI matters.

Cybersecurity

Cybersecurity regulation in Spain stems from EU-level acts and directives:

  • Network and Information Security (NIS) Directive: Sets standard EU levels of security for network and information systems. The Directive intends to address threats posed to the digital economy supported by these systems. The Directive, in place since 2018, is expanded upon by NIS2 (in effect October 2024).
     
  • Digital Operations Resilience Act (DORA): Creates uniform requirements for the security of network and information systems, particularly regarding financial entities. The Act goes into effect in 2025.
     
  • EU Cyber Solidary Act: Enacted in 2024 with the goal of preparing the EU to detect and respond to large-scale cybersecurity threats and attacks. The Act includes the creation of cybersecurity mechanisms and the way they coordinate.
     
  • EU Cyber Resiliency Act: Seeks to ensure security of products and software with digital components by setting a framework and harmonized rules. The Act is slated to go into force the second half of 2024.

For many years, the EU has debated provisions of the European Cybersecurity Certification Scheme for Cloud Services (EUCS). EUCS is a framework to improve security of cloud services with a standardized certification process. A central sticking point that remains is sovereignty requirements for high-risk sectors.

Instituto Nacional de Ciberseguridad (National Institute of Cybersecurity or INCIBE) maintains purview over private sector cybersecurity.

Communications and Network Technology

The foundational EU law on information and communication technology (ICT) is the EU Electronics Communications Code (ECC). The directive sets a regulatory framework for networks and services in the EU. The ECC is implemented into Spanish law through the Ley General de Telecomunicaciones (General Law of Telecommunications or LGT).

Several aspects of telecommunication regulation are managed through the Direccíon de Telecomunicaciones y del Sector Audiovisual (Directorate of Telecommunications and the Audiovisual Sector) at the Comisión Nacional de los Mercados y la Competencia (National Commission for Markets and Competition).

Spain and the EU continue discussions on the implementation of network usage fees, or fees paid from data-heavy digital service providers to network and telecommunications infrastructure operators.

Most laws are set at the EU level. The Digital Economy Chapter of our Country Commercial Guide for the European Union provides a more comprehensive overview.


Market Opportunities

Communications and Network Technology

Spain’s Minister of Digital Transformation and Civil Services states that the country’s digital infrastructure will require investment if Spain is to compete in the next generation of technologies, such as AI and supercomputing. However, he caveated that this expansion must be completed within environmental parameters.

España Digital 2026 (Digital Spain 2026) is the country’s roadmap for digital development. Within the 10 priorities are plans for the 5G rollout and digital connectivity. Expanding and improving internet access is a priority for the Spanish government as found in the Plan for Connectivity and Digital Infrastructures. Currently, Spain ranks high in its deployment of fiber but aims to guarantee 100 Mbps coverage to the entire population, closing the gap between populated and rural areas. To support emerging and data-heavy industries, the plan also supports 1 Gbps connectivity for priority areas, such as research and development zones.

5G/6G

Spain seeks to prepare the entire radio spectrum for 5G deployment. The country’s Strategy for the Promotion of 5G Technology, along with the Plan for Connectivity and Digital Infrastructures, will receive over €4.3 billion for development through 2025. Spain seeks to close gaps in mobile coverage in rural areas, using €680 million of NextGenerationEU funds to install standalone 5G networks in these underserved parts of the country.

Artificial Intelligence (AI)

Spain has been a leader in pushing for the country and the EU to be global leaders in AI development and deployment. Spain’s President Pedro Sanchez used his time as President of the European Council in 2023 to advance the EU AI Act. Spain also announced the creation of the first agency in a EU Member State for AI supervision, AESIA. The body is aimed at classifying AI models by risk, acting as a market surveillance authority, and promoting standards and best practices.

In 2024, the Spanish government approved the Estrategia Nacional de Inteligencia Artificial​ (National Artificial Intelligence Strategy). Some of the goals set out in the strategy include:

  • Promoting the creation of Spanish employment by stimulating local talent and attracting global talent,
  • Increasing private and public sector productivity using AI, and
  • Enhancing supercomputing and other necessary digital infrastructure needed for AI.

Also included in the plan is the development of an AI Large Language Model (LLM) trained on Spain’s four co-official languages:  Spanish, Catalan, Basque, and Galician. Barcelona Supercomputing Center (BSC) will lead technical development. The overall strategy is earmarked to receive €1.5 billion from the RRP, in addition to €600 that has already been mobilized for the initiative.  

Quantum and Advanced Computing

In 2021, Spain founded Quantum Spain, its quantum computing initiative as envisaged in the National AI Strategy. The program is promoted by the Ministry of Digital Transformation and Civil Services . Like many of Spain’s emerging technology initiatives, the program is supported by RRP funds, with an initial investment of €22 million and an expected total investment of €60 million through contributions from various EU programs.

Quantum Spain’s goals include the promotion and financing of a competitive quantum computing infrastructure in the country. The infrastructure will fit into the larger EU ecosystem through the European High-Performance Computing Joint Undertaking (EuroHPC). Spain currently has a network of supercomputer centers, anchored by the Barcelona Supercomputer Center in Catalonia.

Semiconductors

The EU Chips Act was finalized during Spain’s tenure of the Presidency of the European Council. The goal of the law is to increase Europe’s semiconductor market share for the purposes of digital advancement and strategic autonomy.

Spain has pursued its national growth in the industry through the employment of the multisector initiative Proyectos Estratégicos para la Recuperación y Transformación Económica (Strategic Projects for Recuperation and Economic Transformation or PERTE). The program, which utilizes RRP funds to support 12 specific high-impact and critical industries, includes the PERTE de Microelectrónicas y Semiconductores (PERTE for Microelectronics and Semiconductors). The Spanish authorities intend to use the program to mobilize around €12 billion of public investment through 2027 to strengthen the design and production capacities in the country.