Device Usage Policy Spain (Protocolo de Uso de Dispositivos)

A Device Usage Policy Spain (Protocolo de Uso de Dispositivos) is a formal workplace document required under Ley Orgánica 3/2018, de 5 de diciembre, de Protección de Datos Personales y garantía de los derechos digitales (LOPDGDD) Article 87, which recognises and regulates the right to privacy of workers in the use of digital devices made available by employers. The policy defines the terms under which employees may use corporate computers, laptops, mobile phones, tablets, email systems, and internet connections — both for work purposes and, to the extent permitted by the employer, for personal use — and establishes the conditions under which the employer may monitor device usage in compliance with Spanish data protection law and the Estatuto de los Trabajadores (RDL 2/2015).

Article 87 of LOPDGDD directly addresses employer-provided digital devices in the employment context. It imposes a mandatory information obligation — the employer must inform workers in a clear and unambiguous manner of the authorised uses of devices provided, the monitoring controls established, and the specific periods during which devices may be used for personal purposes. Crucially, Article 87.3 of LOPDGDD establishes that where the employer has not expressly prohibited personal use of devices, the worker has a reasonable expectation of privacy in personal communications made through those devices, which limits the employer's ability to access personal content even on corporate equipment.

The legal framework for device usage policies in Spain involves multiple overlapping statutes. The Reglamento General de Protección de Datos (RGPD) — Regulation (EU) 2016/679 — applies to all processing of employee personal data through monitoring of device usage. The Estatuto de los Trabajadores Article 20.3 permits the employer to adopt monitoring measures to verify compliance with work obligations, but these measures must respect the worker's dignity (dignidad del trabajador) and take into account the real capacity of persons with recognised disabilities. Ley 10/2021, de 9 de julio, de trabajo a distancia, Article 22, specifically addresses monitoring of remote workers — employers monitoring home office equipment must respect the right to privacy in the home (inviolabilidad del domicilio) guaranteed by Article 18.2 of the Constitución Española 1978.

The Agencia Española de Protección de Datos (AEPD) has issued extensive guidance on workplace monitoring — its Guía sobre protección de datos en las relaciones laborales (2023) confirms that monitoring must be proportionate, transparent, and limited to what is necessary for the legitimate purpose. The AEPD has sanctioned companies for conducting covert monitoring of employee devices without prior notice in violation of the transparency principle under Article 5.1(a) RGPD, and for retaining monitoring data beyond what is necessary for the monitoring purpose.

The Tribunal Constitucional has addressed workplace privacy through landmark rulings including STC 98/2000, STC 241/2012, and subsequent decisions, establishing that while employers have a legitimate interest in monitoring productivity and compliance, workers retain constitutional rights to privacy (Article 18.1 CE), secrecy of communications (Article 18.3 CE), and — following LOPDGDD 2018 — the right to digital privacy (Article 18.4 CE). The Tribunal Supremo Sala de lo Social has applied these principles in labour disputes, holding in cases including STS 6128/2007 and subsequent rulings that covert monitoring without prior notice is unlawful where the employer has permitted personal use.

A Device Usage Policy documents the employer's legitimate monitoring regime in a manner that satisfies the transparency obligations of Article 87 LOPDGDD, Article 13 RGPD (information provided at data collection), and Article 64.5(d) of the Estatuto de los Trabajadores — which requires the comité de empresa to be consulted on any monitoring system affecting workers' dignity. Workers' representatives must be informed of monitoring systems prior to implementation, and their opinion recorded in the relevant minutes.

The policy must also address the specific provisions of LOPDGDD Article 88 — the right to digital disconnection (derecho a la desconexión digital) — which prohibits employers from requiring workers to respond to communications outside working hours, and Article 91 of LOPDGDD — use of geolocation systems — where company vehicles or portable devices include GPS tracking, which must be disclosed to workers and their representatives.

A Device Usage Policy Spain is needed by any employer that provides digital devices — computers, laptops, mobile phones, tablets, company email accounts — to employees for work purposes. The LOPDGDD Article 87 obligation to inform workers of authorised uses and monitoring controls applies to all employers regardless of size, from sole traders (autónomos) employing staff to large corporations with thousands of employees.

The policy is required before deploying any monitoring software — keystroke loggers, internet usage filters, email scanning tools, or screen capture systems — on company devices or networks. The AEPD has sanctioned employers who deployed monitoring tools without prior written notice to workers, treating this as a violation of the transparency principle under RGPD Article 5.1(a) and LOPDGDD Article 87. The policy serves as the legally required advance notification.

A Device Usage Policy is needed when a company adopts a remote work arrangement under Ley 10/2021, de trabajo a distancia, since remote workers use company equipment in their home environment — Article 22 of Ley 10/2021 requires the employer's monitoring rights and limitations to be specified in the remote work agreement (acuerdo de trabajo a distancia), which should cross-reference the device usage policy.

The policy is required when implementing BYOD (Bring Your Own Device) arrangements — where employees use personal devices to access company systems — because personal devices used for work create hybrid privacy issues requiring clear rules about what the employer can and cannot monitor, and how corporate data on personal devices is managed.

A Device Usage Policy is necessary when a company is advised by its external asesoría or legal team to update data protection documentation for RGPD compliance — the policy must be included in the company's Records of Processing Activities (Registro de Actividades de Tratamiento) under RGPD Article 30 as a processing activity involving employee data.

The policy is also needed whenever the comité de empresa or delegados de personal request clarification on monitoring practices — providing a written policy that has been communicated through the workers' representatives satisfies the Article 64.5(d) ET consultation requirement and creates a documented record of compliance.

A valid Device Usage Policy Spain under LOPDGDD Article 87 and the RGPD must contain the following essential elements to satisfy legal transparency obligations and protect the employer's right to monitor devices lawfully.

Scope of Devices and Systems Covered: A clear list of the digital devices and systems governed by the policy — corporate computers (desktop and laptop), mobile phones, tablets, email accounts, internet access, cloud storage accounts, VPN connections, and any other company-provided digital tools. The policy should specify whether personal devices used to access company systems (BYOD) are also covered.

Authorised Uses: A precise statement of the permitted uses of each device category — whether personal use is prohibited entirely, permitted within defined limits (e.g., outside working hours, not for commercial purposes, not for illegal content), or fully permitted. Article 87.2 of LOPDGDD requires that the employer specify the authorised uses — if the policy is silent on personal use, courts may infer that limited personal use is implicitly permitted, which affects monitoring rights.

Prohibited Uses: An explicit list of prohibited activities — accessing illegal or inappropriate content, storing personal data of third parties without authorisation, installing unauthorised software, connecting to insecure networks, disclosing confidential company information through personal email accounts, and any sector-specific prohibitions (e.g., trading from company devices in regulated financial services firms).

Monitoring Controls (Controles de Supervisión): A description of the monitoring measures the employer applies — internet usage logs, email metadata monitoring (sender, recipient, subject, date — not content unless specifically justified), network traffic analysis, access logs to company systems, GPS tracking of company vehicles. Per AEPD guidance and RGPD Article 5.1(c) data minimisation, monitoring must be limited to what is necessary and proportionate to the legitimate purpose.

Content of Email and Device Access: The policy must state whether the employer reserves the right to access the content of emails and files on company devices, and under what circumstances — investigation of specific misconduct, legal hold, security breach response. The AEPD's 2023 guidance recommends that content access be limited to specific, documented investigations following an initial review of metadata indicating a potential violation.

Right to Digital Disconnection: A statement of the company's policy on digital disconnection (desconexión digital) pursuant to LOPDGDD Article 88 — workers are not obliged to respond to work communications (calls, messages, emails) outside their working hours except in genuine emergencies defined in the policy. The policy should specify which roles, if any, have on-call arrangements and how those are compensated under the applicable convenio colectivo.

Data Protection Information: A RGPD Article 13-compliant privacy notice for the monitoring processing activity — data controller identity, legal basis (legitimate interests under Article 6.1(f) RGPD for monitoring proportionate to business need, or compliance with legal obligations under Article 6.1(c) RGPD), categories of data processed, retention period, recipients, and workers' rights to access, rectification, and objection through the Agencia Española de Protección de Datos (AEPD).

Consequences of Violation: A clear statement that violation of the device usage policy constitutes a breach of the employment contract and may result in disciplinary action under the applicable convenio colectivo and Articles 54 through 58 of the Estatuto de los Trabajadores — ranging from written warnings (amonestaciones) to disciplinary dismissal (despido disciplinario) for serious or repeated violations.

Workers' Representatives Consultation: Confirmation that the policy has been communicated to and, where applicable, consulted with the comité de empresa or delegados de personal pursuant to Article 64.5(d) of the Estatuto de los Trabajadores, and reference to the relevant consultation record. This consultation record protects the employer in subsequent labour disputes.

Forms-legal.com provides this Device Usage Policy Spain template as a practical starting point. Every policy should be reviewed by a qualified abogado especialista in data protection or a registered Data Protection Officer (DPO) to confirm the monitoring measures described are proportionate, technically accurate, and compliant with current AEPD guidance and RGPD requirements for the organisation's specific sector.

Key Spanish regulatory bodies: Agencia Española de Protección de Datos (AEPD) — supervises data processing compliance including workplace monitoring. Inspección de Trabajo y Seguridad Social (ITSS) — enforces Article 64.5(d) ET consultation obligations. Juzgados de lo Social — adjudicate disciplinary dismissals challenged on grounds that monitoring evidence was obtained unlawfully.