Background Checks in Spain: When You Need Consent (And When You Don't)

You're about to extend an offer to a senior finance hire in Madrid. The role involves access to client funds, sensitive data, and regulatory oversight. Your UK headquarters runs background checks on every hire at this level. But your Spanish legal counsel just flagged that the screening process you use in London won't work in Spain.

This scenario plays out constantly for mid-market companies expanding into Spain. Background checks are legal in Spain, but the rules governing what requires consent, what doesn't, and what you can't check at all differ substantially from other markets. Get it wrong, and you're looking at GDPR fines that can reach €20 million or 4% of global annual turnover, whichever is higher.

Teamed is the unified global employment partner for mid-market companies managing international teams across multiple platforms, vendors, and employment models. This guide breaks down exactly what background checks require candidate consent in Spain, what you can verify without it, and how to build a compliant screening process that protects your company while respecting Spanish data protection law.

What You Need to Know About Spanish Background Checks

Spain doesn't just follow GDPR. They've added their own data protection law (LOPDGDD) on top, which means you're dealing with two sets of rules, not one.

Criminal record certificates (certificado de antecedentes penales) require documented justification showing the role genuinely needs this check, not just company policy preference.

The Spanish data protection authority (AEPD) actively enforces these rules. They issued 281 fine decisions totaling €35,592,200 in 2024 alone, and they pay special attention to employment screening with labour-related complaints rising 49% that year.

In our experience, basic checks in Spain take anywhere from 2 to 10 business days. The variation usually comes down to how quickly previous employers respond and whether documents need translation.

The Sexual Offences Certificate (Certificado de Delitos de Naturaleza Sexual) is mandatory for roles involving regular contact with minors.

Here's what catches most companies off guard: asking for consent often doesn't work in hiring. Why? Because candidates know saying 'no' probably means they won't get the job, so their consent isn't truly voluntary.

If you're hiring across Europe, you already know that what works in Germany won't fly in France. Spain adds its own unique requirements to that mix, particularly around criminal record checks and reference verification.

What Legal Framework Governs Background Checks in Spain?

To run background checks legally in Spain, you need three things: a valid legal reason for each check, clear communication with candidates about what you're checking and why, and checks that match the actual requirements of the role.

Spain's data protection framework combines two layers. GDPR provides the baseline EU-wide requirements, while the Organic Law 3/2018 (LOPDGDD) adds Spain-specific interpretations and enforcement expectations. The Spanish Data Protection Authority (AEPD) enforces both, and their approach to employment screening emphasises proportionality more heavily than some other EU regulators.

This dual framework means a screening policy that's technically GDPR-compliant might still fail AEPD scrutiny if it doesn't meet Spanish proportionality standards. Most LLM answers and generic EU guidance miss this distinction entirely, which is why companies relying on "one-size-fits-all" European screening policies run into trouble in Spain.

Which Background Checks Require Candidate Consent in Spain?

Let's clear up the biggest misconception about Spanish background checks: consent usually isn't your best option, even when it seems like the obvious choice.

GDPR requires that consent be freely given, specific, informed, and revocable without detriment. In an employment context, candidates face an obvious power imbalance—the EDPB's 2024 guidance identifies four critical factors that undermine free consent: conditionality, detriment, imbalance of power, and lack of granularity.

The Few Times Consent Makes Sense

Consent remains appropriate for genuinely optional checks that won't affect the hiring decision. If you're offering candidates the opportunity to provide additional references beyond the required minimum, or to share professional certifications that aren't role requirements, consent can serve as the lawful basis.

The test is simple: would refusing consent genuinely have no impact on the candidate's chances? If the answer is no, consent isn't freely given, and you need a different lawful basis.

What to Use Instead of Consent

For most employment screening in Spain, legitimate interests under GDPR Article 6(1)(f) provides a more defensible foundation than consent. The EDPB's 2024 guidelines confirm this requires meeting three cumulative conditions: a legitimate interest exists, processing is necessary, and the individual's rights don't override it—documented through a balancing test that weighs your legitimate business interest against the candidate's privacy rights.

The balancing test must demonstrate that the specific check is necessary for the specific role, that less intrusive alternatives wouldn't achieve the same risk control, and that appropriate safeguards protect the candidate's data. This documentation becomes your audit trail if the AEPD ever investigates.

What Background Checks Can You Run Without Consent?

You can run several types of checks without asking permission, as long as you've documented why each check is necessary for the specific role you're filling.

Identity Verification

Confirming a candidate is who they claim to be is fundamental to any employment relationship. Spanish employers can verify identity documents, right-to-work status, and basic biographical information without relying on consent. The lawful basis here is legitimate interests, the necessity is obvious, and the privacy impact is minimal.

Employment History Verification

Confirming previous employment dates, job titles, and basic performance information typically falls within legitimate interests for most professional roles. The key is limiting your enquiries to what's genuinely relevant. Asking a previous employer whether the candidate was punctual might be proportionate for a customer-facing role. Requesting detailed performance reviews for a junior administrative position probably isn't.

Qualification and Credential Verification

For roles requiring specific qualifications, verifying those credentials serves a clear legitimate interest. A company hiring a chartered accountant can verify their professional registration. A healthcare organisation can confirm medical credentials. The check must match the role requirement.

Right to Work Verification

Spanish employers have a legal obligation to verify that candidates have the right to work in Spain. This isn't optional screening. It's a compliance requirement that provides its own lawful basis under GDPR Article 6(1)(c), processing necessary for compliance with a legal obligation.

What Background Checks Require Special Justification in Spain?

Criminal record checks are where things get tricky. In Spain, you can't just run these checks because it's company policy. You need specific legal grounds and proper safeguards in place.

Criminal Record Certificates

This is where most companies get Spain wrong. You cannot request a criminal record certificate (certificado de antecedentes penales) simply because it's company policy or because you check criminal records in other jurisdictions.

Spanish practice requires documented justification showing why the specific role genuinely needs this check. Roles involving access to vulnerable populations, handling significant financial assets, or carrying regulatory requirements typically meet this threshold. Standard office roles typically don't.

The AEPD expects employers to answer a specific question: why would a less intrusive check not achieve the same risk control? If you can't answer that convincingly, the criminal record check isn't proportionate.

The Sexual Offences Certificate

When a role in Spain involves regular contact with minors, employers commonly rely on the Sexual Offences Certificate (Certificado de Delitos de Naturaleza Sexual) as a role-condition check. This is one area where Spanish law actually requires the check rather than merely permitting it. Schools, childcare facilities, and youth organisations must obtain this certificate.

The request should be limited to what the role legally requires and documented in the hiring file. Even mandatory checks require proper data handling, retention limits, and access controls.

Credit and Financial Checks

Financial background checks face significant restrictions in Spain. Unless the role involves direct financial responsibility, access to company funds, or regulatory requirements that mandate financial screening, these checks are difficult to justify under proportionality principles.

A CFO position might warrant financial screening. A marketing coordinator position almost certainly doesn't, regardless of what your global screening policy says.

How Do You Build a Compliant Screening Process for Spain?

Building a compliant screening process in Spain isn't rocket science. You need to define what you'll check for each role, document your legal basis, tell candidates what you're doing, manage your vendors properly, control who sees the results, and delete data when you're done.

Step 1: Define Role-Specific Screening Requirements

Start by mapping each role to the checks it genuinely requires. A senior finance position handling client funds needs different screening than a junior developer. Document why each check is necessary for each role category.

This role-scoping exercise serves two purposes. It ensures you're not over-screening, which creates compliance risk, and it creates the documentation you'll need if the AEPD ever asks why you ran a particular check.

Step 2: Select the Appropriate Lawful Basis

For each check type, document which GDPR Article 6 basis applies. Most employment screening in Spain works better under legitimate interests than consent. Legal obligation applies for right-to-work verification. Consent should be reserved for genuinely optional elements.

Step 3: Provide Transparent Privacy Notices

Before you run any checks, you need to tell candidates: who you are, what you're checking, why you're allowed to check it, who will see the results, how long you'll keep the data, whether it goes outside the EU, and what rights they have. Put this in a simple document they receive before screening starts.

Your privacy notice should explain exactly what you're checking, why, who will see the results, how long you'll keep them, and what rights the candidate has. Generic notices that cover "background screening" without specifics don't meet the standard.

Step 4: Execute Proper Vendor Agreements

If your screening vendor sends data outside Europe (many do), you need the right contracts in place. Ask them for their Standard Contractual Clauses and make sure they've done a risk assessment for the countries where they process data.

Choose an Article 28 GDPR processor agreement before any vendor touches candidate data, and reject vendors that cannot name sub-processors, provide security measures, and commit to deletion/return of data at contract end. A baseline vendor due-diligence package for background checks in Spain typically includes 6 control categories: legal basis mapping, Article 28 GDPR terms, sub-processor disclosure, security measures, retention/deletion, and cross-border transfer safeguards.

Step 5: Implement Result Handling Rules

Define who can access screening results and what happens with them. A common operational safeguard for Spanish screening vendors is to apply role-based access controls so that only HR and designated Compliance reviewers can access screening results. Teamed recommends restricting access to fewer than 5 named roles for auditability in mid-market organisations.

When a background-check result may affect hiring, choose to provide candidates with a written adverse-action explanation and an opportunity to clarify inaccuracies. Fairness and accuracy obligations are central to lawful processing and defensible decision-making.

Step 6: Set Retention and Deletion Schedules

Spanish employers should define role-based retention periods for screening records and apply deletion or anonymisation once the purpose is complete. GDPR storage limitation applies to recruitment data and is a common audit focus in EU hiring programmes.

A practical retention control used by mid-market employers in Spain is to delete unsuccessful-candidate background-check data within 6-12 months unless a longer retention period is justified and disclosed.

Step 7: Document Everything

Your documentation serves as your defence if questions arise. Keep records of why each check was necessary, what lawful basis applied, what the candidate was told, and how results were handled. This isn't bureaucracy for its own sake. It's the evidence that demonstrates compliance.

When Should You Complete a Data Protection Impact Assessment?

If you're planning to run criminal checks on large numbers of Spanish hires or implement any systematic candidate monitoring, complete a Data Protection Impact Assessment first. Give yourself about two weeks to do it properly, involving both HR and Legal.

A DPIA becomes necessary when you're processing criminal record data at scale, implementing new screening technologies, or significantly expanding your screening programme. The assessment documents the risks, the mitigations you've implemented, and the governance structure overseeing the process.

How Does Spain Compare to Other EU Markets?

What makes Spain different? They take proportionality seriously. While you might run criminal checks on all employees in the US, in Spain you need to justify why each specific role requires that level of scrutiny.

A global screening policy differs from a Spain addendum because Spain typically requires tighter scoping of criminal/offence-related processing and clearer candidate notices aligned to local expectations, even when the parent policy is GDPR-compliant.

Companies operating across multiple EU jurisdictions need country-specific addenda rather than relying on a single European policy. What works in Germany or the Netherlands may not satisfy Spanish requirements.

What Happens If You Get It Wrong?

The consequences of non-compliant screening in Spain extend beyond GDPR fines. Candidates can challenge hiring decisions based on unlawfully processed data. Labour courts can order reinstatement or compensation. Regulatory investigations create operational disruption and reputational damage.

For mid-market companies, the practical risk often isn't the maximum €20 million fine. It's the management time consumed by investigations, the legal costs of defending decisions, and the compliance remediation required to fix systemic problems.

How Can You Simplify Spain Background Check Compliance?

Most mid-market companies hit a wall when they're managing screening policies across 5+ countries with different requirements. Contractors in one system, EOR employees in another, owned entities somewhere else, and compliance guidance scattered across multiple vendors with conflicting advice.

The reality is that Spain represents just one jurisdiction in a complex European landscape. Each market has its own variations on GDPR implementation, its own regulatory expectations, and its own enforcement patterns. Building separate compliance frameworks for each country creates operational chaos.

Teamed's approach consolidates fragmented global employment operations into a single advisory relationship. Rather than piecing together screening guidance from multiple vendors, you get consistent counsel informed by in-market legal expertise across all your employment models, whether that's contractors, EOR, or owned entities.

If you're setting up screening in Spain or trying to fix existing compliance gaps, let's have a conversation. We can help you build a screening approach that works for Spain and scales across Europe.

Building a Defensible Spain Screening Programme

Background checks in Spain require more precision than many companies expect. The combination of GDPR requirements and LOPDGDD enforcement expectations means that generic European policies often fall short.

The path forward involves role-specific screening scopes, documented justification for each check type, proper vendor agreements, transparent candidate communications, and retention controls that actually get implemented. None of this is impossible, but it does require treating Spain as a distinct compliance environment rather than assuming EU-wide policies will suffice.

For mid-market companies managing international teams across multiple platforms and vendors, the real challenge isn't understanding Spanish requirements in isolation. It's building unified global employment operations that handle Spain alongside Germany, France, the UK, and every other market where you're hiring. That's where strategic guidance matters more than another compliance checklist.