The Personal Data Protection Law was issued pursuant to Royal Decree No. 6/2022. It aims to protect individuals’ personal data by establishing several controls for its processing, the most important of which is that the controller or processor must obtain the consent of the data subject before processing their data. The law also grants the data subject several rights, most notably the right to withdraw their consent, request the correction, updating, or deletion of their data, and to be notified of any breach or violation of their personal data.