It seems so, but I guess it'll be difficult to fine businesses without presence in Spain.

In practical terms I don't think the Spanish AEPD (institution for data protection) would actually sue any company not registered in Spain. Too complicated.