Applicable law in the absence of EU legislation competence
According to Art. 2 (3) Organic Law 3/2018, any processing of personal data outside the scope of the GDPR (because the matter is not subject to EU legislation competence) shall be processed according to the respective national provisions, Organic Law 3/2018 and the GDPR. For example, this covers national election legislation and national law on commercial registers.
Applicability of Spanish data protection legislation on deceased persons
Art. 3 Organic Law 3/2018 establishes that heirs and other associated persons with the deceased person may access, rectify and erase the deceased’s personal data. The deceased person may impede these rights via testament.
