Employee monitoring law · Spain
Digital rights are written into the data protection act, and reps must be involved.
Involve employee representatives and publish the digital rights policy before switching anything on.
- Region
- Europe
- Instruments
- 3 governing
- Employer duties
- 3 listed
- Last reviewed
- August 22, 2026
Spain · what the law requires
Consultation required
Spain legislated employee digital rights directly. Articles 87 to 90 LOPDGDD cover privacy in the use of digital devices, the right to digital disconnection, and video and geolocation monitoring. Article 87 requires criteria of use to be established with the participation of worker representatives, and article 89 requires that employees be informed expressly and clearly. The Supreme Court and the AEPD both look for that participation.
- Criteria of use set with representativesArticle 87 requires worker representatives to participate in establishing how digital devices may be used and monitored.
- Express and clear informationEmployees must be told expressly. Spanish case law is unforgiving about monitoring that was technically disclosed but practically buried.
- Respect digital disconnectionArticle 88 gives a right to disconnect outside working hours, developed through an internal policy with representatives. Out-of-hours capture cuts against it.
- Proof Ledger
- Outcomes
- Certificates
- Audit log
- Data access
- Disputes
- Data egress
- Export
- What We See
- Controls
- AKAria K. viewed screenshotsLena M. · 3 capturesScreen capturemacOS · London09:42a91f…4c023d7b…91ee
- JMJon M. exported time reportDesign team · CSVmacOS · Berlin09:313d7b…91ee77c5…0ba4
- SDSara D. opened capture reviewRavi P. · one flagged frameWindows · Manchester09:1877c5…0ba4e208…5f13
- wm_live_7f2… read /v1/deliverablesScoped key · read onlyPublic API · allowlisted IP08:57e208…5f13b64a…2d90
- LMLena M. viewed her own recordWhat We SeemacOS · London08:44b64a…2d901cf9…8e77
- AKAria K. changed capture policyBlur set to alwaysmacOS · London08:261cf9…8e7705d2…ae31
The instruments, and which control answers each duty
- GDPR: Regulation (EU) 2016/679. Sets the floor everywhere in the EEA: a lawful basis, purpose limitation, data minimisation, transparency and a DPIA where monitoring is high risk. National law below adds to this, never subtracts.
- Organic Law on Data Protection and Digital Rights: LOPDGDD arts. 87–90. Privacy in digital devices, digital disconnection, video surveillance and geolocation, each with its own information and participation duties.
- Workers' Statute: Estatuto de los Trabajadores arts. 20.3 and 64. The employer's power to monitor performance, and the duty to inform and consult worker representatives.
No product does this part
What you must still do yourself
Compliance is a property of your deployment. These are the steps in Spain that no vendor can complete on your behalf, and skipping them is what turns a rollout into a finding.
- 1Involve worker representatives in setting the criteria of use, and record their participation.
- 2Publish the digital disconnection policy required by art. 88.
- 3Give express, specific information, not a clause inside a long handbook.
- If you get it wrongAEPD fines up to €20m or 4% of turnover. Monitoring that fails the information duty is routinely held to make a subsequent dismissal unfair.
Verify the claim
Every control above, on the page that describes it
Sources and review date
Last reviewed August 22, 2026This is a summary of how employee-monitoring rules generally work in this jurisdiction, written to help you scope a rollout and brief your own advisers. It is not legal advice, it is not a substitute for it, and law changes. Verify against the primary sources listed and take local counsel before you deploy.
Nearby jurisdictions
Monitoring law elsewhere in Europe
- FinlandA dedicated working-life privacy act, and a necessity test read very narrowly.
- PolandThe Labour Code lists the permitted purposes, and productivity is not one of them.
- United KingdomThe ICO's 2023 monitoring guidance is the operative document, and it expects a DPIA.
- IrelandThe DPC accepts a legitimate business interest, and then tests proportionality hard.
- SwedenCo-determination negotiation before any significant change, including this one.
- NorwayControl measures need discussion with employee representatives and periodic review.
Point it at one team for a week.
Create the account, put the agent on a handful of desks, and leave it alone. On Friday you read the week instead of reconstructing it: hours against their projects, focus and idle per person, and the timesheets already filled in.
Free for two seats. No card, and no sales call to sit through.