For many privacy professionals in Spain, the headquarters of the Spanish Data Protection Agency (AEPD) on Calle Jorge Juan 6 has been more than just a government building. It has been a place closely associated with the evolution of data protection law and practice over the past two decades.
The AEPD has recently announced that it will relocate its headquarters to new offices on Paseo de la Castellana, marking the end of an era for one of Spain’s most recognisable regulatory institutions. The move will provide modern facilities better suited to the Agency’s current and future responsibilities, while continuing its important public service mission.
For me, the announcement also brings back many professional memories.
I first walked through the doors of the AEPD as a junior lawyer, long before the General Data Protection Regulation (GDPR) entered into force. At that time, one of the routine tasks for privacy practitioners was the registration of personal data files with the Agency. It was not uncommon to visit the AEPD in person to submit documentation at its registry, making Calle Jorge Juan 6 a familiar destination for lawyers working in data protection.
Since then, both the legal framework and the profession have changed dramatically.
The GDPR fundamentally transformed European data protection law, replacing many administrative formalities with a risk-based and accountability-driven approach. Today, the work of privacy lawyers extends far beyond regulatory registrations.
Over the past sixteen years, I have had the privilege of advising organisations on data protection matters in Spain, representing clients in investigations and sanctioning proceedings before the AEPD, responding to regulatory information requests and documentation production orders, acting as Data Protection Officer, and litigating data protection disputes before the Spanish courts.
Throughout this period, the AEPD has remained a central institution in the Spanish privacy landscape. Its decisions, guidance and enforcement activities have played a significant role in shaping compliance practices across both the public and private sectors.
Although the Agency’s new headquarters will undoubtedly provide facilities better adapted to today’s regulatory environment, many practitioners will remember the building on Calle Jorge Juan 6 with a certain sense of nostalgia. It represents not only the home of Spain’s data protection authority, but also a place that has accompanied the professional development of an entire generation of privacy lawyers.
As the AEPD begins this new chapter, its mission remains as important as ever. In an increasingly digital economy, effective data protection, responsible innovation and public trust continue to be fundamental pillars of the legal framework governing personal data.
Sometimes, a change of address is also a reminder of how far a profession has come.
