The criminal record certificate is probably the most frequently requested — and most misunderstood — document in Spanish recruitment processes. A common misconception is that if the candidate signs a consent form, the company may simply request it. The legal reality is far more restrictive.

Why the candidate’s consent is not enough

Data relating to criminal convictions and offences are a special category of data under Article 10 of the GDPR. Processing is lawful only where a legal provision expressly authorises it for the specific role; the candidate’s consent alone does not replace this legal authorisation. This reflects the same reasoning applied by the revised data-protection framework throughout the European Union, but in Spain the AEPD has turned it into an actively enforced sanctioning criterion.

The case that marked a turning point: Amazon Road Transport Spain

In case PS-00267-2020, the AEPD fined Amazon Road Transport Spain EUR 2,000,000 for requiring its delivery drivers to provide criminal record certificates without a legal basis permitting this for that type of role. The decision confirms that neither the size of the company nor the good intention of “verifying the suitability” of the candidate is a valid defence for requiring criminal-record data without a legal basis.

Sectors where there is a clear legal authorisation

1. Private security: Article 28.1(e) of Law 5/2014 requires security guards to have no criminal convictions for intentional offences in order to obtain their professional authorisation. Importantly, this verification is carried out by the Ministry of the Interior when granting the authorisation, not independently by the hiring company. The Supreme Court confirmed this in Judgment 435/2022 of 12 May, ruling that a private security company could not independently require or obtain this certificate.
2. Activities involving minors: the Certificate of Sexual Offences applies, which is a separate instrument (see the dedicated article on the LOPIVI).
3. Public-sector roles and positions subject to anti-money-laundering regulations: these are governed by specific authorisations under the respective sectoral legislation.

The question every HR manager should ask

Before requesting this certificate, the correct question is not “is the candidate willing to give it to me?”, but rather “is there a legal provision that authorises me to require it for this specific role?”. If the answer is not clearly yes, the prudent approach is not to request it, or to replace it with a voluntary self-declaration by the candidate, documented as such.

See also: Human Risk and Background Checks in Spain: The 2026 Reference Guide, How to Obtain a Criminal Record Certificate in Spain: Steps, Cost and Timelines and GDPR, LOPDGDD and AEPD: The Legal Framework for Background Checks in Spain