Tomorrow, April 10, 2026, is the deadline for communicating to AIPI the appointment of the Internal Information System Manager (RSII) through its form.
The issues that have generated the most controversy:
1) For which organizations is this communication mandatory?
– Organizations with 50 or more employees.
– Organizations whose activity is within the scope of application of EU regulations (among others, organizations considered “regulated entities” for the purposes of Law 10/2010, of April 28), even if they have less than 50 employees.
In both cases, in addition, the organization must (i) have establishments in more than one Autonomous Community, or (ii) have only one establishment in an Autonomous Community where there is no competent regional authority.
In all other cases, the communication will be voluntary, without prejudice to the applicable autonomous community regulations.
Our recommendation, in case of doubt, is to make the communication also to the AIPI.
2) Which autonomous regions have their own autonomous authority?
Valencian Community
Community of Madrid
Castilla y León
Autonomous Community of Navarra
Catalonia
Andalucía
Galicia
Castilla- la Mancha
3) Essential documentation. What you can’t miss:
– The minutes or agreement of the governing body appointing the RSII. Important: the minutes or agreement must be stamped with the organization’s digital certificate.
– In order to complete the form, the digital certificate of the organization or, alternatively, of the legal representative (natural person) with the document that proves it (power of attorney or similar) is also required.
However, the communication may be made by any person, as long as he/she is duly authorized by the organization.
4) Registered RSII? Here’s what you should keep in mind:
When the RSII is configured as a collegiate body, it shall be necessary:
– identify all the members of the group (name, surname and ID number); and,
– designate one of them to manage the SII and process the files.
It is not necessary to identify who among the members of the collegiate body is external to the organization (advisors or lawyers, for example).
5) Group of companies: one notification for each company
A communication must be made for each company of the group that meets the requirements indicated in point 1), even in those cases in which the RSII is common to all the companies.
Logically, the companies of the same group may provide the same document of designation/appointment of the RSII, provided that all the companies that share it appear in the same document.
6) Organizations operating in Spain and in the EU, which option to check?
In those cases in which the company operates both in Spain and in EU member states, and given that the form does not contemplate the option “EU including Spain”, our recommendation is to select “national scope”.
7) What are the possible penalties for my organization if I do not communicate the appointment of the RSII to AIPI?
To a fine of up to 100,000 euros.
8) Finally, don’t forget….
– Download a copy of the application and the corresponding filing receipt (PDF).
– Communicate any appointments and/or terminations of the RSII, within ten working days.
