Not legal advice. This site is an editorial reference. Laws change — always confirm with a qualified attorney in the relevant jurisdiction before recording, and check each page’s last reviewed date.

Call Recording Laws in Spain

Plain-English summary

Spain treats participant recording differently from third-party interception. The Spanish Constitutional Court (STC 114/1984) and the Supreme Court (Sala de lo Penal) have held that a participant who records a conversation in which they themselves take part does not violate the criminal privacy provisions of Article 197 of the Código Penal, because there is no interception of communications between other parties.

That criminal-law treatment is, however, separate from the data-protection treatment. Recording by an organization triggers GDPR and LOPDGDD compliance: lawful basis, transparency, retention, and security. The Spanish data-protection authority (AEPD) has applied these requirements rigorously to commercial call recording.

Statutory framework

  • Article 197 Código Penal. Criminalizes interception of communications by a non-participant.
  • LO 3/2018 (LOPDGDD). Spanish data-protection statute implementing GDPR.
  • GDPR. Applies in full.
  • LO 1/1982. Civil protection of the right to honor, personal and family privacy, and own image.

Regulator guidance

The AEPD has issued guidance on call recording covering lawful basis, notice, retention, and the use of recordings in employment disputes. The AEPD has imposed fines for recordings without proper notice and for excessive retention.

Spanish data-protection specifics

LOPDGDD adds Spanish-specific rules to GDPR, including specific provisions on employee monitoring (Art. 89 LOPDGDD) and the right to digital disconnection (Art. 88).

Workplace and business calls

Workplace recording in Spain requires clear, prior notice to employees, a documented business purpose, and restricted access. Constitutional Court decisions on employee monitoring (e.g., STC 39/2016 on the use of recorded evidence in disciplinary proceedings) emphasize that even lawful recording can yield inadmissible evidence if employees were not adequately informed.

Cross-border and conflict-of-laws notes

For Spanish participants, AEPD jurisdiction follows GDPR’s one-stop-shop where applicable.

Penalties and remedies

Criminal: Article 197 CP for non-participant interception — 1 to 4 years’ imprisonment.

Administrative: GDPR/LOPDGDD fines.

Civil: compensation under GDPR Art. 82; honor and privacy actions under LO 1/1982.

Practical guidance

  • Participant recording for personal use is generally lawful but use as evidence may still require court authorization.
  • Commercial recording requires the full GDPR compliance program.
  • Workplace recording requires written notice and a defined access list.

Related