Ley 11/2023 extended accessibility obligations to private companies on 28 June 2025, and the Spanish disclosure and cookie rules already went further than GDPR alone. Most Nordic companies in Spain are running a site that met the requirements when it launched and doesn't now.
Most people who understand Spanish digital compliance can't build. Most people who can build don't understand the Spanish market. That gap is where I work.
GDPR is European. LSSI-CE, LOPDGDD and the AEPD's cookie criteria are Spanish — stricter, more specific, and more actively enforced than most Nordic companies expect. A cookie banner that passes in Stockholm frequently fails in Madrid.
Ley 11/2023 transposed the European Accessibility Act into Spanish law, effective 28 June 2025. Obligations now reach private companies — e-commerce, banking, booking platforms, passenger transport. The standard is WCAG 2.2 AA, and very few private Spanish sites currently meet it. Sanctions scale with severity; on the cookie side, the AEPD publishes its decisions and has been issuing them for years.
Spanish B2B buyers read a translated site as a foreign company testing the market. A missing NIF and physical address, no Bizum, a register of formality wrong for the audience, a contact form nobody answers in August — each one costs conversions in ways analytics won't show you.
I review your Spanish site against ten criteria: legal identification under LSSI-CE, cookie consent, privacy policy, data residency, and five WCAG 2.2 AA checks. You get a plain-language report in Swedish, English or Spanish. Works on any site — WordPress, Wix, Angular, custom.
No access to your systems. No call required. Three working days.
A full manual audit: prioritised findings, an honest assessment of where your real exposure sits, and a fix roadmap you can hand to any developer — including your own.
Credited in full against a remediation project.
Implementing the fixes on the site you already have. Accessibility, cookie consent, the legal layer, data handling.
Your stack, not mine.
A new Spanish presence, built properly: bilingual, compliant, accessible, with a CMS your Spanish team can actually use. Commercial layer included — IVA handling, Verifactu-ready invoicing, Bizum.
Typically six to ten weeks.
Spanish-language content at volume without hiring a Spanish content team. AI writing assistants inside your CMS, automated document generation, customer-facing assistants.
Built in production, not as demos.
Spanish digital law keeps moving. Quarterly re-scan, changes flagged, small fixes included.
Cancel any quarter.
I'm an engineer, not a lawyer, and I don't pretend otherwise.
Your legal texts — legal notice, privacy policy, cookie policy, form consent clauses — are drafted by Asesores & Consultores Privacydat, S.L., a Barcelona consultancy specialising in RGPD, LOPDGDD and LSSI-CE, working as part of my delivery team. Their fee appears as a transparent line item in your quote.
They draft. I implement. That handover is where most compliance projects fail — the texts arrive as a document, and nobody integrates them correctly into the site. If your case needs a lawyer's opinion rather than a compliance specialist's, I'll tell you and bring one in.
I'm Swedish, I've lived and worked in Barcelona for over twenty years, and I've spent most of that time on both sides of this bridge.
I ran the Swedish-Spanish Chamber of Commerce in Barcelona from 2014 to 2017, where my job was making a Spanish organisation work for Nordic companies. Before that, naval R&D at Rolls-Royce and nine years in aviation. Since 2018 I've been building software — most recently as a senior frontend engineer on enterprise projects, now independently, focused on AI product work.
Which means I can sit in a Swedish board call in the morning and a Spanish supplier meeting in the afternoon, and I know why those two conversations need to be run differently.
It also means I've read the regulations in Spanish and shipped the code that satisfies them. Those are usually two different people.
Usually not. Most problems are fixable on your existing site, whatever it's built with. That's what the remediation tier is for — I'd rather fix what you have than sell you a rebuild you don't need.
The accessibility obligations under Ley 11/2023 generally exempt companies under 10 employees. RGPD, LOPDGDD and the Spanish cookie rules exempt nobody. Small companies still need the legal layer.
Yes — anywhere in Spain, and the work is largely remote regardless.
Yes. The compliance work is the same for any foreign company entering Spain. The Nordic part is just where I'm most useful on the cultural side.
Send me your URL. I'll review your Spanish site and tell you honestly what's compliant, what isn't, and what it would cost to fix.
No sales call required. If the report is all you need, take it and go.
Or email me directly: info@asaeriksson.com