Translate a privacy policy into Spanish

GDPR terminology in Spanish

A privacy policy rests on a dozen terms defined by the regulation. Spanish has fixed equivalents, taken from the official Spanish text of the GDPR, and they must stay identical throughout the document:

• controller → responsable del tratamiento; processor → encargado del tratamiento (not procesador, a frequent literal error from English);
• data subject → interesado;
• data protection officer → delegado de protección de datos (DPD, not DPO);
• right to erasure → derecho de supresión; restriction of processing → limitación del tratamiento; data portability → portabilidad de los datos.

Policies written in Spain often say legitimación where English says “lawful basis”. Both are understood, but one document should not switch between them. Cookies usually stays in English.

Spanish runs noticeably longer than English. Retention period tables and lists of recipients, common in this kind of document, will grow: allow for wider cells and longer headings, especially if your policy is laid out in narrow columns.

Spain or Latin America: one text, several readerships

Choosing your audience affects more than everyday words (ordenador in Spain, computadora in Mexico; móvil or celular). It also touches the conventions of the field:

• in Mexico the document is commonly called an aviso de privacidad, and readers expect the derechos ARCO (access, rectification, cancellation, objection);
• in Spain, política de privacidad is standard, with the list of rights drawn from the GDPR.

Register matters too. Many Spanish websites address the reader informally (tus datos), while a more formal policy uses usted (sus datos). Mixing the two in one text is easy to spot: check it on the free sample, then across the whole file.

Question-style headings, very common in privacy policies, take the opening question mark: ¿Qué datos recogemos?, ¿Durante cuánto tiempo conservamos sus datos?. Dates run day, month, year (Última actualización: 3 de marzo de 2025), and Spain uses a decimal comma.

What Manuce delivers, and what it does not

Your policy is translated by Thémis, Manuce's legal specialist, and comes back in its original format: a Word file stays Word with its headings and tables, an HTML page stays HTML. Accepted formats: Word, PDF, PowerPoint, Excel, plain text, Markdown, HTML, RTF and CSV. For a typical document of around 2,500 words, about six pages, the translation is delivered within minutes and kept in your client area.

What Manuce does not do:

• no legal adaptation: if your policy names the ICO, the CNIL, the UK GDPR or a court in your own country, the Spanish version names them too. A policy aimed at Spain would normally refer to the Agencia Española de Protección de Datos (AEPD); making that change is a lawyer's task, not a translator's;
• no sworn or certified translation: if an authority requires a version certified by a sworn translator, Manuce does not provide it;
• no scanned PDFs: an image without selectable text is not read.

For a policy you will publish, the Professional level, handled by the domain specialist, is the one intended for documents ready to pass on.

Preparing the file and checking the Spanish version

Before uploading, use the current version, the one carrying the right “last updated” date, and prefer the source file (Word or HTML) to an exported PDF. Note the items that must stay unchanged so you can check them afterwards: company name, postal address, privacy@example.com, the URL of your cookie page, the names of third-party tools (Google Analytics, Stripe).

When the translation arrives, check first:

1. that key terms (responsable del tratamiento, encargado, interesado) are used consistently;
2. that retention periods and figures have not changed;
3. that email addresses, links and proper names are intact;
4. that register (tú or usted) and variety of Spanish match the rest of your site;
5. that the supervisory authority and governing law are confirmed by your legal adviser for the target country.

If a term must stay in English, check it first on the free sample, then in the full translation.

In practice

1. Export the current version of your policy as Word or HTML (avoid scanned PDFs).
2. Upload the file: the quote appears at once, based on the exact word count.
3. Read the free sample paragraph to judge GDPR terminology, register and variety of Spanish.
4. Pay, then download the translated file in its original format from your client area.
5. Have a lawyer confirm the references to the supervisory authority and applicable law.