Human Risk and Background Checks in Spain: The 2026 Reference Guide

What is Human Risk and what role do background checks play in Spain?

Human Risk is the operational, financial and reputational risk an organisation assumes through the people it hires: candidates who falsify their CVs, executives with undisclosed conflicts of interest, or employees with criminal records incompatible with their role. A background check is the tool a company uses to manage this risk before it materialises, by verifying a candidate’s identity, history and integrity in a proportionate and lawful manner.

In Spain, managing Human Risk is not only a matter of security but also of regulatory compliance: the Constitution, the Workers’ Statute, the General Data Protection Regulation (GDPR) and Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD) strictly limit what may be checked and how. Validato helps companies operating in Spain design screening processes that reduce Human Risk without breaching these limits.

Read more: Human Risk in Spain: What It Is and How Companies Manage It with Background Checks

What exactly is a background check and when should a company conduct one in Spain?

A background check is a structured verification process carried out before hiring (or during employment) that confirms a candidate’s identity, academic and professional history and, where justified by the role, their criminal and financial background. There is no general legal obligation to conduct background checks in Spain, except in specific sectors (private security, banking, activities involving minors).

The question every Spanish company should ask before launching a check is not “what information can I obtain?”, but “what information is necessary and proportionate for this specific role?”. This principle of proportionality, derived from Article 18 of the Spanish Constitution and Article 4.2(c) of the Workers’ Statute, is the basis of the entire Spanish legal framework in this area.

Read more: What Is a Background Check and When Is It Mandatory (or Recommended) in Spain?

Is it legal in Spain to ask a candidate for a criminal record certificate?

Only in specific cases: criminal-record data are a special category of data (Article 10 GDPR) and, as a general rule, a Spanish employer is not entitled to require them unless a specific legal provision authorises this for the role. The candidate’s consent alone is not sufficient to justify the request.

There are sectors with a clear legal basis, such as private security (Article 28.1(e) of Law 5/2014), public-sector roles or positions subject to anti-money-laundering regulations. Outside these cases, requesting the certificate creates a real risk: the Spanish Data Protection Agency (AEPD) fined Amazon Road Transport Spain EUR 2,000,000 (case PS-00267-2020) for requiring delivery drivers to provide this certificate without a legal basis, and the Supreme Court (Judgment 435/2022 of 12 May) confirmed that even a private security company may not obtain it independently: verification is carried out by the Ministry of the Interior during the authorisation process.

Read more: Criminal Record Certificates in Spain: What an Employer May (and May Not) Require

How is the criminal record certificate requested and how much does it cost?

Only the candidate may request it; the employer cannot do so directly. It can be obtained through the Ministry of Justice’s electronic portal (sede.mjusticia.gob.es) using Cl@ve or a digital certificate, or in person. The fee is nominal, around EUR 3–4 depending on the applicable Form 790 fee, and it can be issued immediately in digital format where there are no records requiring verification.

Where the candidate has resided in another European Union country in recent years, the application automatically triggers a query through ECRIS (European Criminal Records Information System), which can extend the timeline to up to 30 days. For third countries, the candidate must request the certificate directly from the authorities of that country, usually with an apostille or consular legalisation.

Read more: How to Obtain a Criminal Record Certificate in Spain: Steps, Cost and Timelines

Is the Certificate of Sexual Offences mandatory for working with minors?

Yes. It is a mandatory legal requirement, not merely good practice. Under Organic Law 8/2021 on the comprehensive protection of children and adolescents against violence (LOPIVI), any profession, trade or activity, whether paid or voluntary, involving regular and habitual contact with minors requires this certificate, issued free of charge by the Central Register of Sex Offenders and Human Trafficking Offenders.

This is the closest Spanish equivalent to the “special certificates” used in other European countries to protect minors and vulnerable persons. The AEPD clarifies that the requirement applies only where minors are the primary recipients of the activity, not where they may merely be present incidentally.

Read more: Certificate of Sexual Offences: LOPIVI and Working with Minors in Spain

Can a company check a candidate’s financial solvency in Spain?

Not directly. Unlike some other European countries, Spain has no public debt register that can be consulted by third parties, and access to private creditworthiness databases such as ASNEF or RAI is legally restricted to entities that already have a credit relationship with the individual (Article 20.1(e) LOPDGDD). An employer that checks a candidate in ASNEF risks a sanction: the AEPD fined a company EUR 70,000 (reduced to EUR 42,000 for voluntary payment, case EXP202103933) for doing so before an interview.

The lawful route for verifying the financial integrity of a candidate for a role with budgetary responsibility (CFO, treasury, procurement) is the Public Insolvency Register (publicidadconcursal.es), which is free and fully public and shows whether the individual has been involved in insolvency proceedings as a director or private individual.

Read more: ASNEF, RAI and the Public Insolvency Register: What an Employer in Spain May (and May Not) Check

Can a company review a candidate’s social media before hiring them?

It depends on the platform and its relationship to the role: professional and public profiles such as LinkedIn may be compared with the candidate’s CV, but private profiles (Instagram, Facebook, TikTok) are, according to the AEPD itself, outside the boundaries of a recruitment process unless there is a clear, documented and proportionate connection to the role.

In its guide “Data Protection in Employment Relationships”, the AEPD expressly states that a candidate is not required to allow a company to investigate their social media, even where the content is public, and that requesting “friend” access to view private content is not acceptable. Searching without defined criteria also increases the risk of discovering — and unconsciously allowing to influence the decision — protected data such as religion, sexual orientation or pregnancy (special categories under Article 9 GDPR).

Read more: Social Media in Recruitment: What the AEPD Says About Reviewing a Candidate’s Profile

What do the GDPR, LOPDGDD and AEPD say about background checks?

The GDPR and LOPDGDD require any data collected about a candidate to be lawful, transparent, proportionate to the role and retained only for as long as necessary; the AEPD is the authority that supervises and sanctions compliance in Spain. In practice, this means always informing the candidate what will be checked, why, and for how long the data will be retained before any verification begins.

Non-compliance is not a minor infringement: Article 83 of the GDPR allows fines of up to EUR 20 million or 4% of the company’s total worldwide annual turnover, and the two AEPD cases cited on this page (Amazon Road Transport Spain and case EXP202103933) demonstrate that Spain applies these sanctions in practice, not merely in theory.

Read more: GDPR, LOPDGDD and AEPD: The Legal Framework for Background Checks in Spain

Can employment references be verified without the candidate’s consent?

No. Calling former employers without the candidate’s knowledge and explicit consent constitutes an unlawful disclosure of personal data to a third party and an infringement of the candidate’s right to privacy. The candidate must provide the contact person and authorise the call.

Once authorised, the conversation must be limited to the candidate’s professional performance and conduct: questions about health, family planning, political views or private life are not permitted and may also constitute a very serious discrimination-related infringement.

Read more: Employment References in Spain: Why You Need the Candidate’s Consent

What is the company certificate and does it replace an employment reference?

No. The company certificate (certificado de empresa), governed by Article 298 of the General Social Security Act, is a purely objective document (employment dates, professional category, contribution bases and reason for termination) that the employee needs in order to apply for unemployment benefits through SEPE. It contains no assessment of performance.

Unlike some other European countries, Spain has no legal tradition of a qualitative written employment reference. For this reason, a telephone reference interview, always with the candidate’s prior consent, is the most reliable tool in the Spanish market for validating a person’s actual performance, far more so than any document.

Read more: Company Certificate vs. Employment Reference: The Difference Every Recruiter in Spain Should Know

What additional checks are required for executives (C-Level) and Politically Exposed Persons (PEPs)?

Senior executive and board positions require Enhanced Due Diligence that goes beyond the CV: verification of professional and academic history, analysis of conflicts of interest, screening against international sanctions lists, and analysis of media coverage and leaks (“Leak Papers”) concerning the individual.

Where the candidate is a Politically Exposed Person (PEP), as defined in Article 14 of Law 10/2010 on the prevention of money laundering, the level of diligence must be even higher. The Executive Service of the Commission for the Prevention of Money Laundering (SEPBLAC), Spain’s financial intelligence unit, notes that there is no separate Spanish sanctions list: companies must screen against the official lists of the European Union and the United Nations.

Read more: Background Checks for C-Level and PEPs in Spain: Enhanced Due Diligence

How long does a background check take in Spain, including candidates who have lived abroad?

A standard check in Spain (criminal record certificate and identity and education checks) is usually completed within 24 to 48 hours when the candidate cooperates actively. Timelines become longer when third parties, former employers, universities or foreign authorities are involved, or when the candidate has lived outside Spain.

For criminal records from other EU countries, the ECRIS query can take up to 30 days; for countries outside the EU, the timeline depends on the relevant consulate and can be considerably longer. Screening international profiles should therefore be planned with more lead time than for candidates with an entirely Spanish background.

Read more: How Long Does a Background Check Take in Spain? Domestic and International Timelines

What risks and sanctions does a company face if it fails to comply with the rules when conducting a background check?

The risks are both financial and reputational: AEPD sanctions of up to EUR 20 million or 4% of worldwide turnover (Article 83 GDPR), claims by candidates for discrimination in access to employment, and reputational damage from being publicly associated with invasive recruitment practices.

The two real cases cited on this page — the EUR 2,000,000 fine imposed on Amazon Road Transport Spain for criminal-record checks without a legal basis and the EUR 42,000 fine for checking a candidate in ASNEF — show that the AEPD actively investigates and sanctions these practices in the Spanish market, regardless of company size.

Read more: AEPD Sanctions for Unlawful Background Checks: Real Cases in Spain

Is it advisable to outsource background checks to a specialised provider such as Validato?

For most companies, yes: a specialised provider offers standardised processes, up-to-date knowledge of the Spanish legal framework and access to verification sources (registers, universities, former employers) more quickly and with a lower risk of non-compliance than a purely internal process. As a global background-check provider, Validato combines this standardisation with the local knowledge required to operate within the framework of the AEPD, GDPR and LOPDGDD.

When evaluating a provider in Spain, three things should be required: a data-processing agreement compliant with Article 28 GDPR, ISO 27001 certification (and, if the provider works with public authorities, alignment with the National Security Framework), and servers within the EU/EEA or appropriate safeguards where data are processed outside it.

Read more: Outsourcing Background Checks in Spain: What to Require from Your Provider

In summary

A background check in Spain must always be proportionate, transparent and limited to what is strictly necessary for the role: the candidate controls their own criminal record certificate, creditworthiness databases such as ASNEF are not available to employers, there is no mandatory written employment reference, and any social-media verification must be justified by the role rather than curiosity. The AEPD actively sanctions excessive practices, with fines in the Spanish market already reaching EUR 2 million. A well-designed process, often supported by a specialised provider such as Validato, turns Human Risk into a competitive advantage rather than a legal liability.

Quick questions

Does the candidate have to consent to a background check in Spain? Informed consent is almost always necessary, but it is not sufficient on its own: the company must also demonstrate that the verification is proportionate to the role.

Does Validato conduct background checks for companies outside Spain? Yes. Validato is a global provider and adapts each verification process to the legal framework of the country where the candidate is being hired.

What certificate do I need to hire someone who will work with minors? The Certificate of Sexual Offences, mandatory under LOPIVI and free of charge, requested by the candidate from the Ministry of Justice.

How much does a professional background check cost in Spain? It varies depending on the depth of the check (identity, education, criminal records, references, financial integrity) and the risk profile of the role; Validato offers packages adapted to each risk level.

Would you like to review your background-check process in Spain?

Validato can assess in a 30-minute call whether your current recruitment process complies with the GDPR, LOPDGDD and AEPD criteria, and which additional checks would make sense based on the risk of each role.

Sources cited on this page

Spanish Data Protection Agency (AEPD) — case PS-00267-2020 (Amazon Road Transport Spain) and case EXP202103933
AEPD — guide “Data Protection in Employment Relationships” and FAQ on criminal records in the employment context
Supreme Court, Judgment 435/2022 of 12 May 2022
Ministry of Justice — electronic portal, criminal record certificate and Certificate of Sexual Offences
Official State Gazette — Spanish Constitution (Art. 18), Workers’ Statute (RDL 2/2015), LOPDGDD (LO 3/2018), Law 10/2010, Law 5/2014, LOPIVI (LO 8/2021), General Social Security Act (RDL 8/2015)
Public Insolvency Register (publicidadconcursal.es)
SEPBLAC — Executive Service of the Commission for the Prevention of Money Laundering