DAC6 Country Profile: Spain

Register for our DAC6 email updates

Spanish Parliament
In light of the COVID-19 pandemic, Spain delayed DAC6 reporting by six months

We are publishing a series of guides on how each EU member state has implemented DAC6. The guide provides a preview to our full up-to-date country-by-country guide to DAC6.

Our next guide focusses on Spain’s implementation of DAC6.

This blog was originally published in July 2020 and was updated in February 2021.

How has Spain implemented DAC6?

Legislation Details

Spain’s tax authority, Agencia Tributaria (Tax Agency), published DAC6 legislation, called Ley 10/2020, de 29 de diciembre, por la que se modifica la Ley 58/2003, de 17 de diciembre, General Tributaria, en transposición de la Directiva (UE) 2018/822 del Consejo, de 25 de mayo de 2018, que modifica la Directiva 2011/16/UE por lo que se refiere al intercambio automático y obligatorio de información en el ámbito de la fiscalidad en relación con los
mecanismos transfronterizos sujetos a comunicación de información.

DAC6 is implemented by amending General Tax Law 58/2003, of 17
December 2003. The amendments for the final law approval were introduced in Law10/2020 of 29 December 2020.

Taxes covered

Spain’s legislation covers cross-border arrangements. The legislation is in line with the EU Directive (i.e., the legislation applies to all taxes except
VAT, customs duties, excise duties and compulsory social security
contributions), and does not include domestic arrangements or any additional hallmarks.

Legal Professional Privilege

In Spain there are two categories of intermediaries with regard to the application of LPP exemptions. One category is professionals who carry out “participitory advice”; this category is not covered by an LPP exemption. The other category is intermediaries who provide “neutral advice”; this category is covered by an LPP exemption. Within the category of those who are covered, the following categories of professionals have LPP: law firms, tax advisors, auditors, and some other professions.

In cases where the intermediary because of LPP, the obligation will shift to the taxpayer.

Reporting

Spain requires reporting to be made by intermediaries and relevant taxpayers using an electronic/XML file via the online service of the Spanish tax authorities. The information must be submitted in the official language (Spanish). Some sections can be completed in English, but a Spanish translation will need to be provided.

Penalties

The penalties regime applied under the bill mentions for failure to comply with the reporting requirements a penalty of EUR 2,000 per data/ per omitted / inaccurate data on reportable arrangements, with a minimum penalty of EUR 4,000 and a maximum equivalent of the fees or tax value resulting from the reportable arrangement, or the value of the cross-border arrangement if the offender is the relevant taxpayer. The minimum and maximum amounts will be halved when the information is filed after the deadline without prior notice from tax authorities.

Download country profile

VinciWorks’ full country-by-country guide to DAC6 implementation

DAC6 guide to country-by-country implementation

Not all EU member states have yet finalised their guidance and additional details, such as legal professional privilege and penalties vary between each state. To help firms save time and money on conducting their own research, VinciWorks has collaborated with Transfer Pricing Services to create a concise country-by-country guide to DAC6 compliance. The guide can be purchased either together with our DAC6 compliance solution or as a standalone tool.

Preview the guide

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

“In a world older and more complete than ours they move finished and complete, gifted with extensions of the senses we have lost or never attained, living by voices we shall never hear.”

Picture of James

James

VinciWorks CEO, VInciWorks

Spending time looking for your parcel around the neighbourhood is a thing of the past. That’s a promise.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.