Spain

Spain has emerged as one of southern Europe’s most dynamic data centre markets. The country possesses abundant renewable generation and a mature corporate PPA market. The government intends to increase installed IT capacity from approximately 500 MW to around 2,500 MW by 2030, with total investment potentially exceeding €60 billion. The Aragón region has emerged as the country’s leading hyperscale hub, followed by Castilla-La Mancha, Extremadura, Navarra, and the Basque Country, whilst Madrid and Barcelona remain the principal colocation markets. What follows is a thematic analysis of Spain’s position across the principal dimensions of the comparative framework applied throughout this publication.

Key contacts

Ignacio Álvarez
Partner
[email protected]

Javier Ruiz-Cámara Bayo
Partner
[email protected]

Blanca Arlabán
Partner
[email protected]

Grid connection

Grid architecture and market structure

Access and connection to the electricity grid is probably the greatest roadblock to developing data centres in Spain today. As electricity consumers, obtaining demand-side grid access and connection rights, and maintaining their validity, is a critical factor for the success of data centre projects.

The Spanish electricity sector operates under a strict unbundling model. Transmission is carried out exclusively by Red Eléctrica de España (“REE”), the sole transmission system operator, under full ownership unbundling. Distribution is carried out by a limited number of distribution system operators subject to legal and functional unbundling.

As a result, data centres can only access physical electricity supply through: firstly, obtaining grid access and connection permits to the transmission grid (high voltage: 220 kV or higher) or distribution networks (medium or low voltage) (“A&C Permits”), which represents the primary route for connecting to the grid; or secondly, implementing behind-the-meter arrangements, although it should be noted that these are typically insufficient on their own for large-scale facilities. Spanish law does not currently allow for alternative grid access arrangements, such as microgrids, closed distribution networks, or energy communities.

In line with EU regulations, grid operation in Spain is a regulated activity, subject to exclusive or special rights and strict unbundling conditions. Therefore, no operators other than the authorised grid operators are permitted to provide grid access arrangements. Recent legislative reforms allow alternative grid access arrangements for certain specific cases (such as microgrids, closed distribution networks, or energy communities), but data centres do not qualify to participate in any of these alternatives. In other words, A&C Permits are their main mechanism to secure energy supply.

Limited grid capacity remains a major constraint on data centre development in Spain. According to recent surveys, it is estimated that the total grid connection requests for data centres reached approximately 8.7 GW, of which only around one in four MW had been awarded. To tackle this lack of grid capacity, the Spanish government approved targeted amendments to the transmission grid development plan in April 2024 and July 2025, and a new transmission grid plan is expected during 2026 (to be applicable until 2030). This plan will include mandatory developments of the grid, in order to attend new capacity needs (from both generation and demand sides). A&C Permits for data centres or other consumers can only be obtained at existing or planned grid nodes in positions designated for demand purposes. Recent regulatory amendments have sought to make node planning more flexible and to allow, in certain cases, grid extension or change of purpose of existing node positions to supply new demand facilities deemed strategic investment.

Connection queue: reform, maturity milestones, and competitive tenders

Grid capacity availability varies materially by location, making node selection a critical early step. Capacity maps published by grid operators are a key reference. The forthcoming 2025-2030 grid plan formally incorporates a 2,500 MW data centre target and is expected to identify the transmission reinforcements needed to accommodate projected demand. Although the 2025-2030 grid plan should have been approved by the end of 2024, its processing has been delayed due to, among other reasons, the emergence of new electricity-intensive demand facilities. However, said forthcoming grid plan would consider the demand needs of the years 2025 and 2026, while interim amendments of the previous grid plan were implemented as a bypass measure to attend to urgent grid capacity needs.

Spain’s grid access and connection framework for large consumers is comprehensively regulated through a single electronic process at national level, under standardised timelines and before the grid operator responsible for the relevant node. End-to-end timelines from A&C Permits request to energisation may range between 30 and 40 months under an optimistic scenario, assuming no tenders are called and depending on the scope of connection works required.

A&C Permits applications were historically processed on a “first come, first served” basis. To address speculation risk, competitive tender procedures can now be activated at overloaded nodes, though these procedures are yet to be thoroughly tested in practice. A&C Permits holders are now subject to binding project maturity milestones over a five-year window – including a grid works’ down-payment, execution of a grid reinforcement agreement and grid access contracts – with automatic permit lapse in case of non-timely compliance. In addition, with effect from June 2026, each sponsor is required to make monthly capacity reservation payments. During the first year, 100% of such capacity reservation payments will be credited against future tolls; thereafter, this proportion will reduce to 80%, with the remaining 20% being non-recoverable.

Sponsors must bear the full cost of private connection infrastructure and any required grid reinforcements. A structural constraint applies to campus or multi-tenant configurations: any connection infrastructure shared by more than one consumer is legally deemed part of the public distribution grid and must be transferred to the local DSO for no consideration, with a right of partial cost recovery if subsequently used by additional consumers.

A preferential access framework for “high priority” demand projects has been introduced; although whether data centres may benefit from this framework will depend on forthcoming implementing rules.

Flexibility, charging, and electricity supply

Data centres in Spain are not subject to any mandatory sector-specific demand response or interruptibility obligations by virtue of their nature or size. As a general rule, A&C Permits in Spain are granted on a firm basis, meaning the contracted capacity is guaranteed at all hours of the year. A flexible access regime is currently being developed by the Spanish Markets and Competition Regulatory Authority (Comisión Nacional de los Mercados y la Competencia, “CNMC”), which in July 2026 released a revised draft resolution for public consultation outlining the conditions under which demand facilities may hold flexible A&C Permits. Under this regime, the degree and nature of the flexibility afforded will vary depending on the type of permit granted, ranging from restrictions on the hours during which consumption is allowed to more active real-time interventions by the grid operator, such as remote disconnection or power reduction. However, this flexible regime allows one to obtain grid access connections where the available access capacity is scarce. Data centres are not obliged to opt for flexible A&C Permits, and in practice, are unlikely to do so given their operational requirement for uninterrupted power supply (unless otherwise mitigated with BESS facilities or other behind-the-meter alternatives). In respect of the electricity sector balance markets, although they are not obliged to participate in them, data centres may participate voluntarily in the interruptibility service or in demand response programmes managed by REE.
Power

Power access and procurement

A mature and liquid PPA market

Spain has a mature and liquid corporate PPA market, particularly attractive for large electricity consumers such as data centres. The market benefits from a stable regulatory framework, significant renewable generation capacity and strong participation from utilities, IPPs, traders, financial institutions and hyperscale technology companies. Spain has consistently ranked among the leading European jurisdictions by contracted renewable PPA volumes.

Consumers connected to the grid – including data centres – generally require an electricity supply agreement with an authorised supplier, which acts as an intermediary responsible for supplying electricity to the consumer, either through purchases in the wholesale electricity market or through bilateral physical PPAs. Spanish regulation allows substantial contractual flexibility regarding pricing, tenor, delivery of GOs, balancing liabilities and other commercial terms.

Large consumers may also enter into direct physical PPAs with generators, though these arrangements generally require a supplier acting as a “sleeving” intermediary. Consumers may also enter into financial PPAs, without the need for a sleeving structure, to hedge exposure to variations in electricity prices. Both physical and financial PPAs may provide for the sale of the GOs associated with the volume of electricity contracted.

As an alternative to supplier intermediation in physical arrangements, large consumers may apply to become a “direct market consumer”, allowing them to carry out direct wholesale market or bilateral PPA purchases. In practice, this structure is used in limited cases only due to extensive technical, operational, and financial compliance obligations.

Spanish regulation also allows proximity-based and behind-the-meter structures connecting generation directly to consumers. These structures are particularly favourable to large consumers because renewable electricity consumed on-site generally avoids a significant portion of regulated costs (i.e., grid tolls and charges). Shared self-consumption schemes and surplus compensation mechanisms are also permitted and increasingly relevant for data centres, particularly in areas facing grid access constraints.

Given their constant consumption profile, data centres are expected to accelerate deployment of hybrid PPA structures – combining solar, wind and/or BESS – as well as more sophisticated power procurement models combining corporate PPAs with tolling agreements engaging BESS operators.

Renewable energy certificates

Spain operates a fully EU-compliant Guarantees of Origin (“GOs”) system administered by the CNMC, under which one GO is issued per MWh of renewable electricity injected into the grid. Spanish GOs are fully aligned with the EU Renewable Energy Directive and mutually recognised across interconnected European markets. Under the current regulatory framework, GO matching between renewable generation and electricity consumption is performed on an annual basis, in line with prevailing practice across most European jurisdictions. However, market participants increasingly expect a gradual transition towards more granular temporal correlation, including monthly or hourly matching standards, particularly for large electricity consumers.

At present, data centre operators in Spain are generally not subject to a legal obligation requiring a minimum percentage of their electricity consumption to originate from renewable sources, nor are they required to demonstrate that such electricity is sourced from newly commissioned renewable projects (i.e. the so-called “additionality requirement”). Nevertheless, sustainability and traceability requirements applicable to data centres are expected to become significantly more stringent over the coming years as a result of the implementation of the EED, Delegated Regulation (EU) 2024/1364, and recent Spanish regulatory and policy developments. In particular, Royal Decree-Law 7/2026 expressly contemplates the future development of specific sustainability requirements applicable to large data centres, including potential obligations relating to renewable energy additionality and temporal correlation.

Nuclear power procurement

No explicit legal prohibition on entering into PPAs with nuclear generators (including SMRs) currently exists, but the current regulatory and policy framework provides very limited incentives for doing so. Even though several nuclear reactors still provide a significant share of electricity generation, the Spanish government has approved a moratorium on new nuclear construction which still continues and maintains its phase-out strategy. All operating plants in Spain are scheduled to shut down progressively between 2027 and 2035, notwithstanding ongoing discussions regarding possible lifetime extensions.

National strategy, investment incentives, and planning

National strategy, investment policy, tax, and subsidy framework

Spain aims to increase installed data centre IT capacity from approximately 500 MW to around 2,500 MW by 2030, with total investment potentially exceeding €60 billion. The regulatory framework is still evolving: the government has proposed a sustainability and energy-efficiency regime for data centres, but implementing regulation remains in draft form following a 2025 public consultation. Similarly, Spain’s 2026 Digital Sovereignty Roadmap reaffirmed digital infrastructure and “green” data centres as strategic national priorities. While data centres are not yet expressly classified as “high priority” projects under the access and connection regime, the regulatory trend points towards greater recognition of strategically relevant digital infrastructure.

Like many other European jurisdictions, regional planning tools for projects of strategic interest have accelerated permitting for large-scale data centre developments. Aragón has emerged as the leading hyperscale hub (AWS, Microsoft), followed by Castilla-La Mancha (Meta), Extremadura, Navarra, and the Basque Country. Madrid and Barcelona remain the main colocation markets.

The most relevant support schemes available for data centres are energy-related, particularly programmes managed by the Instituto para la Diversificación y Ahorro de la Energía (IDAE), and financed through EU and FEDER funds supporting BESS. Spain’s Energy Storage Strategy targets over 20 GW of installed storage by 2030 and 30 GW by 2050.

Aligned with EU regulations, data centres are not yet legally treated as “electro-intensive consumers” and therefore cannot benefit from rebates on regulated electricity costs available to qualifying industrial consumers. Additionally, no sector-specific tax regime applies to data centres. Projects are subject to the standard 25% corporate income tax rate, although general incentives – including accelerated depreciation and R&D deductions – may be available depending on the investment structure.

Critical Infrastructure designation and cyber security

Spain has yet to transpose NIS2. The government published a Draft Cybersecurity Law in January 2025, with parliamentary approval widely expected in the second half of 2026. However, the current framework in Spain remains the NIS1 regime, under which data centre operators are not automatically covered, and only become subject to regulatory cybersecurity obligations if they are formally designated as operators of essential services or cloud computing providers. Once in force, the Spanish transposition will also introduce several jurisdiction-specific features: a traceability requirement in incident management, a mandatory information security officer with coordination responsibilities, and potential liability for individual board members for regulatory infringements. On the physical resilience side, transposition of the EU Critical Entities Resilience Directive is also pending, with a draft Critical Infrastructure Law published but yet to complete the legislative process. Notable proposed features include a new intermediate category of “strategic entities” subject to lighter-touch obligations than critical entities, a mandatory periodic certification scheme, and enhanced obligations such as compulsory drills with law enforcement and extended background checks.

Under the current NIS1 framework, the main obligations for covered entities are to implement proportionate technical and organisational security measures, designate an information security officer, and notify significant incidents to the competent authority (“INCIBE-CERT”). Incident reporting is channelled through INCIBE-CERT for private-sector operators of essential services, with notification triggered when an incident reaches a “critical”, “very high” or “high” impact level under a five-tier severity taxonomy (i.e. “critical”, “very high” “high”, “medium”, “low”). Reporting timelines require an initial notification immediately upon detection, intermediate updates within 24 to 72 hours depending on severity, and a final report within 20 to 40 days. Supervisory competence is distributed across several Ministries (Defence, Internal Affairs and Digital Transformation) and key governmental bodies (mainly CNPIC and CCN), depending on the nature of the entity and the sector in which it operates. Sector-specific regimes may displace or supplement these general obligations; most notably, the Digital Operational Resilience Act (DORA) applies to financial entities and their critical ICT third-party service providers or the telecom sector that is subject to its own security and incident-reporting requirements under the Spanish General Telecommunications Law 11/2022.

Data centres providing services to public entities are additionally subject to the National Cybersecurity Scheme, which sets mandatory security requirements calibrated to the risk category of the relevant system. Sector-specific regimes – most notably in telecoms and financial services – may displace or supplement these general obligations. Carve-outs exist for entities supporting national security or defence functions (Instituto Nacional de Ciberseguridad).

National security and foreign investment screening

Spanish FDI legislation has not been modified to explicitly designate data centres as a distinct category subject to FDI screening. However, data centres may fall within the scope of the FDI authorisation regime where the Spanish authorities determine that they constitute critical infrastructure – whether physical or virtual (including data processing or storage facilities) – or where the operator has access to sensitive information. Spanish FDI authorities have subjected transactions involving data centres to screening on this basis.

Under the Spanish national regime, prior authorisation is required where certain conditions of the investors and the target are satisfied. Both non-European Union, or non-European Free Trade Association investors (“Non-EU/EFTA”) and non-Spanish EU/EFTA investors (“EU/EFTA Investors”), the latter of which are so treated only on a temporary basis until 31 December 2026, are deemed to be foreign investors for the purposes of the Spanish FDI regulations. In general terms, prior authorisation is required where the following conditions are satisfied:

the investor is either: (a) a non-EU/EFTA resident, OR (b) an EU/EFTA resident investing more than €500 million in a non-listed Spanish company, OR (c) an EU/EFTA resident acquiring a stake in a listed Spanish company;
acquires at least 10% of the share capital or control of a Spanish company; and
the target operates in a strategic sector or meets certain conditions, or that the investor falls within one of the specified categories under the regime.

Investments in companies with annual turnover below €5 million are generally exempt, subject to exceptions in the energy, communications, and strategic raw materials sectors. Other less relevant conditions should be analysed on a case-by-case basis. Failure to obtain the required authorisation may result in the transaction being declared null and void, and administrative penalties of up to the value of the transaction may be imposed. Given this risk, investors typically elect to submit a formal prior consultation to the FDI authorities – which must respond within 30 business days and whose determination is binding – in order to obtain clarity on whether an authorisation is required.

Data localisation and cross-border data flows

Spain has not adopted general mandatory data localisation requirements distinct from the EU-wide framework. The Spanish regime aligns with the GDPR without adding Spain-specific geographical storage obligations. International transfers of personal data from Spain follow the standard GDPR mechanisms. Sector-specific legislation governing electoral rolls, population registers, tax data, and health system data imposes strict purpose limitation, access control, and confidentiality requirements, but does not mandate that such data be stored exclusively within Spanish or EU territory.

Whilst it may be argued that certain data centre service providers, particularly those offering colocation or housing services, do not directly process the data stored therein and therefore may not qualify as data processors, the Spanish data protection supervisory authority’s position is that data centre providers should be treated as data processors and are subject to personal data protection regulations.

Land use classification and default consenting route

Land use classification is a critical factor in data centre development. Data centres are typically located in urban or suburban areas, close to their clients and with ready access to essential infrastructure – in particular, electricity grids, but also water supply, fibre optic connectivity and transport links. Urban planning matters are predominantly managed by the authorities at the regional and municipal levels, with divergences in zoning rules, permitted uses and procedural requirements across Spain’s 17 regions and over 8,000 municipalities.

There is no specific land use or zoning category for data centres under Spanish law. Projects are typically located on urban land and classified under conventional use categories – most commonly industrial or, in some cases, tertiary (services) – which do not adequately reflect the operational profile of modern data centres. In many cases, data centre projects are not compatible with existing municipal urban planning instruments, thus requiring amendments to regional or municipal planning frameworks. At the national level, the government’s 2024 AI Strategy signalled its intention to develop a regulatory framework to foster the sustainable installation of data centres. However, no standalone national legislation addressing data centre planning or accelerated consenting has been enacted, and the sector continues to rely on regional instruments and urban planning procedures.

National/fast-track consenting pathways

Spain has no dedicated national significant infrastructure regime for data centres. No single authorisation bundles the planning, environmental, and grid consents a project requires. Acceleration is instead delivered through two distinct layers – a mature set of regional strategic-interest instruments, and an emerging national framework – each resting on a different constitutional competence and offering a different package of benefits.

At the regional level, most of Spain’s 17 regions have established instruments for declaring qualifying projects to be of strategic or regional interest, on the basis of criteria such as investment volume, job creation, sustainability impact, and contribution to economic development. These instruments are not designed specifically or exclusively for data centres, but a project that satisfies the applicable criteria can secure designation and the procedural advantages that follow. The criteria, procedure, and effects of such declarations vary from one community to the next, yet they tend to converge around a common set of benefits: firstly, automatic compatibility of the data centre – including its ancillary and connection facilities – with existing land-use classifications; secondly, streamlined administrative procedures and reduced timelines; thirdly, land expropriation rights; and fourth, exemption from certain permits or procedural steps. The practical value of a regional declaration to a given project therefore turns on the rules of the specific community in which the site is located, a matter that should be assessed at the site-identification stage, rather than assumed.

At the national level, Royal Decree-Law 7/2026 introduced a new and independent category of “Strategic Investment Projects”, with implementing criteria to be set out in a Royal Decree currently in draft form. The national regime reaches the matters that fall within State competence, and on which the regions are not competent – grid connection foremost among them – and so addresses the principal constraint that regional instruments cannot. Although the regime applies to large-scale demand facilities generally, the current version is specifically designed in part to accommodate data centre developments. Projects are declared by the Government’s Delegated Commission for Economic Affairs on the basis of criteria, including investment volume and creation of highly qualified employment, with digitalisation a positively weighted factor.

Designation may carry several advantages: processing of institutional support and facilitation of administrative and permitting procedures (including different permits to be granted at all administrative levels); facilitated grid access and connection (including temporary capacity reservations and priority in the permitting process queue); inter-administrative coordination; and streamlined access to public funding. Royal Decree-Law 7/2026 also introduces a related category of “Preferential Energy Projects”, under which associated energy facilities benefit from facilitated processing. The implementing Royal Decree is expected to be approved during the course of 2026, at which point the national fast-track route – today still in formation – will become operative alongside the established regional instruments.

Environmental regulation and sustainability

Environmental Impact Assessment

Spanish legislation does not list data centres as a standalone project category subject to mandatory EIA. Whether a given facility requires one is determined case by case, by reference to both the national and regional regulations applicable to the data centre’s location, and the assessment may follow either an ordinary or a simplified procedure depending on the project’s characteristics. Where an EIA is required and concluded favourably, the competent authority issues an environmental impact statement (“declaración de impacto ambiental”) (“DIA”), which is a precondition to construction and commissioning.

In practice, the EIA obligation is triggered not by the data centre as such, but by its associated infrastructure. The most common triggers are backup generators, electrical substations, cooling systems, and combined heat and power installations, each of which may bring the project within a screening category under the applicable legislation. Beyond the EIA itself, a project may require further environmental permits calibrated to its specific configuration, including permits for atmospheric emissions, for water abstraction and discharge, and for waste management.

A DIA is accordingly required for many data centre projects, on grounds that include: firstly, atmospheric emissions from backup generators and combustion equipment; secondly, the need to obtain a prior urban planning instrument; thirdly, the environmental characteristics of the site or surrounding area; fourth, the integration of the data centre within a broader development (such as co-located on-site renewable generation); and fifth, the cumulative effects of the project taken together with others in the vicinity. The practical consequence is that the EIA question turns on how a project is configured and sited, rather than on its scale alone, so sponsors should resolve the screening position – and the procedure that follows from it – at an early stage, before the design of ancillary infrastructure is fixed.

Energy efficiency: PUE and mandatory standards

Spain is in the process of transposing Article 12 of the EED through the forthcoming Royal Decree on energy efficiency and sustainability for data centres (the “Draft RD”), whose public consultation period expired on 15 September 2025. The Draft RD is broader and stricter in certain respects than the requirements of the EED. For example, aside from submitting an annual report to the energy authorities covering the indicators set out in the Regulation (EU) 2024/1364, the Draft RD additionally requires operators to report on socio-economic indicators, including estimates of direct and indirect jobs created, the qualification level of such employment, territorial impact, and an analysis of expected economic impact at local and national level. These socio-economic reporting requirements go beyond the EED’s disclosure obligations.

Spain has not yet introduced mandatory regulatory thresholds for Power Usage Effectiveness (“PUE”), Water Usage Effectiveness (“WUE”), or other efficiency metrics. However, the Draft RD adopts a best-practice approach, requiring data centres to report on their level of compliance with the EU Code of Conduct on Data Centre Energy Efficiency and, for data centres with an IT demand exceeding 100 MW, to demonstrate that they are among the top 15% of facilities with the best sustainability indicators. Relevant key performance indicators include PUE, WUE, the Energy Reuse Factor (“ERF”), and renewable energy coefficients, with the applicable metrics varying depending on the size of the data centre. Significantly, the Draft RD links compliance with these obligations directly to grid access: access and connection permits for new projects are conditional on demonstrating such compliance, and existing permit holders must provide proof of compliance when executing the technical grid access agreement. Non-compliance with the energy efficiency and sustainability requirements may result in loss of grid access and connection permits.

Heat recovery and waste heat obligations

Spain is also in the process of transposing the EED through the Draft RD by requiring data centres with a total rated energy input exceeding 1 MW to utilise their waste heat for heating, cooling, or other heat applications, unless a cost-benefit analysis (CBA) demonstrates that this is not technically or economically feasible. New projects (and substantially renovated facilities) must prepare a CBA report as a prerequisite for project implementation. The CBA report must be approved by the competent regional authority where the project will be located. For the purposes of obtaining municipal building permits and A&C Permits, the sponsor must demonstrate that the CBA report has been approved. The approved CBA report has a validity period of five years and must be renewed following the same procedure. The waste heat reuse measures identified in the CBA must be implemented during this five-year period. If the sponsor implements the CBA measures within the first three years, the Draft RD contemplates that they may benefit from certain support mechanisms (such as Energy Saving Certificates).

Sustainability reporting

The Draft RD imposes annual reporting obligations on data centres with an IT power demand of 500 kW or above, covering energy performance, water consumption, heat reuse, and renewable energy share. The mechanism by which these obligations bite is the feature that distinguishes the Spanish regime from a conventional disclosure duty: if the Draft RD is adopted in its current form, compliance will be tied to the grant and maintenance of A&C Permits, so that a reporting failure threatens the operator’s grid access itself rather than merely exposing it to an administrative penalty.

The CSRD has not yet been fully transposed into Spanish law, although a draft bill (Proyecto de Ley de información empresarial sobre sostenibilidad) is progressing through the parliamentary process. In the interim, the Spanish authorities have confirmed that Spanish companies may prepare their 2025 sustainability reports under the ESRS. Distinct from the CSRD process, Royal Decree 214/2025 of 18 March 2025, in force since 12 June 2025, establishes a mandatory carbon-footprint calculation and reporting regime for large companies and public sector entities, replacing the previous voluntary registration system. Obligated entities must calculate their organisational carbon footprint annually and prepare a greenhouse gas emission reduction plan with a minimum five-year time horizon. Direct emissions (Scope 1) and indirect emissions from purchased energy (Scope 2) are mandatory; value-chain emissions (Scope 3) remain voluntary for private sector companies at present, although the regulatory trajectory points toward an extension of Scope 3 obligations from 2028.

No greenwashing claims or investigations against data centre operators or their energy suppliers in Spain have been publicly reported as of June 2026.

Real estate

Project site

Due diligence on a Spanish data centre site starts with the search in the Land Registry (Registro de la Propiedad) and must be cross-checked against the Cadastre (Catastro) to identify discrepancies. Beyond registered charges, due diligence should cover unregistered rights, administrative licences, existing leases (which bind purchasers), easements, and soil contamination (particularly for brownfield sites). A separate zoning analysis should confirm that the intended use is permitted from an urban planning perspective. Risk allocation is primarily contractual: through title warranties, price adjustments, environmental indemnities, and W&I insurance.

Three structures are available for securing a campus site. Freehold acquisition (pleno dominio) is the preferred route: it carries no reversion risk, supports full mortgage security, and affords the greatest flexibility – including multi-PropCo structures where each module sits in its own special purpose vehicle, ring-fencing liabilities and simplifying future disposals. Where a campus comprises multiple buildings, a real estate complex (complejo inmobiliario) or a horizontal division (división horizontal tumbada) allows each module to hold its own land registry status and to be financed or sold independently, while shared infrastructure is governed and funded collectively. The surface right (derecho de superficie) is the closest Spanish equivalent to a long-term ground lease, granting the right to build and own constructions on another party’s land for up to 99 years; it is registrable, mortgageable, and transferable, but the buildings revert to the landowner on expiry without compensation. A commercial lease is viable where neither ownership structure is attractive: term and renewal are freely negotiated (without statutory minimum or renewal right), and land registry protection is available – and advisable – to protect the tenant against a sale or the enforcement of third-party security. Both leasehold and surface-right structures require direct agreements with lenders to protect their enforcement position.

Where an operator sub-lets space to customers, colocation arrangements are almost universally structured as service agreements, under which the operator supplies a full range of services – power, cooling, security, and connectivity – and retains control of the facility throughout. Provided an arrangement is genuinely constituted on that basis, rather than as a lease, the statutory tenant-protection regime does not apply. A requalification risk arises where a customer is given exclusive physical control of a self-contained space with no meaningful service overlay; fit-out obligations and maintenance responsibilities should therefore be allocated explicitly in the customer contract, since each either reinforces or undermines the characterisation as a service.

Grid connection and connectivity

The standard tool for securing rights of passage for utilities across third-party land is an easement (servidumbre), which must be granted as a notarial deed and registered with the land registry to bind successors and be fully effective against third parties. An easement may attach to the land itself (in rem), or to a specific beneficiary such as a grid operator (personal), and it may be agreed voluntarily or imposed by law against compensation. What determines its security in every case is registration, which is the step that carries the right across a future sale of the burdened land.

A major consideration for a data centre sponsor is whether the route can draw on the statutory regime for regulated electricity infrastructure. Transmission and distribution grids are declared as public utilities under Spanish law, which allows grid operators – and, in certain cases, sponsors of self-consumption or on-site PPA arrangements – to invoke the compulsory expropriation procedure to obtain the necessary easements where voluntary agreement cannot be reached. Outside that regime, an easement cannot be demanded: unless the project has been approved as one of regional interest – which may trigger an equivalent public utility declaration over the affected plots for any utility infrastructure – the sponsors must rely entirely on voluntary agreements with each landowner along the route. That dependence is a critical risk and timeline driver, because a single holdout can delay or block a connection, which makes early engagement and adequate programme contingency essential.