HR Data Protection Policy Spain (Política de Protección de Datos RRHH)

An HR Data Protection Policy Spain (Política de Protección de Datos en Recursos Humanos) is a formal internal document through which a Spanish employer sets out how it processes the personal data of employees, job applicants, and former employees — governed by Article 88 of the Ley Orgánica 3/2018 de Protección de Datos Personales y Garantía de los Derechos Digitales (LOPDGDD), which implements the specific employment data processing provisions permitted by Article 88 of the Reglamento (UE) 2016/679 RGPD. The document fulfils the RGPD transparency obligations under Articles 13 and 14 RGPD while addressing the specific categories of employee data processing that arise in the Spanish employment relationship.

Article 88 of both the RGPD and LOPDGDD authorises Member States and, through collective bargaining, employers and workers' representatives to specify rules governing the processing of employees' personal data in the employment context. The LOPDGDD Articles 87 through 91 establish specific rules for employee data processing in Spain: Article 87 governs the right to privacy in the use of digital devices at work (derecho a la intimidad y uso de dispositivos digitales en el ámbito laboral); Article 88 regulates employer monitoring of employees' use of company digital devices; Article 89 governs video surveillance (videovigilancia) in the workplace; Article 90 regulates geolocation tracking of employees; and Article 91 governs the processing of employee personal data through digital whistleblowing channels (canales de denuncia).

The Agencia Española de Protección de Datos (AEPD) has published specific guidance on employee data processing — including the Guía sobre relaciones laborales y protección de datos (2021) — and has imposed significant fines on Spanish employers for RGPD violations in the HR context. These include a €150,000 fine against Glovo for failing to inform gig workers of data processing, a €300,000 fine against Bankia for excessive employee monitoring without adequate notice, and €250,000 against Amazon Spain for disproportionate surveillance measures.

The scope of employee personal data processed by a typical Spanish employer under the Estatuto de los Trabajadores (RDL 2/2015), the Ley General de la Seguridad Social (RDL 8/2015), and tax law is extensive: identification data for TGSS registration and AEAT IRPF withholding; payroll and bank account data for salary payments; health and medical certificates for sick leave (incapacidad temporal — IT) management; disciplinary records; performance evaluations; CCTV footage from the workplace; access control records; computer and internet usage logs; geolocation data from company vehicles or mobile devices; and data generated through whistleblowing or internal complaint channels. The HR Data Protection Policy must address all these categories.

The LOPDGDD Article 17 establishes that the legal basis for processing employee data in the ordinary employment relationship is principally Article 6.1(b) RGPD — performance of the employment contract — and Article 6.1(c) RGPD — compliance with legal obligations (social security registration, tax withholding, occupational health requirements under the Ley de Prevención de Riesgos Laborales — LPRL). Consent is generally not the appropriate legal basis for routine employment data processing, since the power imbalance between employer and employee means consent is rarely freely given in the RGPD sense.

An HR Data Protection Policy Spain is legally required for all Spanish employers as part of their RGPD accountability obligations and specifically to fulfil the transparency duty under LOPDGDD Article 88.

The policy is required when a company employs staff and processes their personal data for payroll, TGSS registration, AEAT tax withholding, and employment contract administration — all Spanish employers with any employees must have an HR data protection policy in place.

The document is needed when an employer deploys CCTV cameras in the workplace under LOPDGDD Article 89 — the policy must inform employees of the surveillance before it commences, state the purpose (security, verification of contractual compliance), and cover retention periods for footage (maximum 30 days under LOPDGDD, extendable for disciplinary proceedings).

An HR Data Protection Policy is required when an employer monitors employees' use of company digital devices (ordenadores, teléfonos móviles) under LOPDGDD Article 87 — the Tribunal Constitucional (STC 170/2013) and the Tribunal Supremo have held that employees have a reasonable expectation of privacy in workplace digital communications unless the employer has clearly and specifically informed them that monitoring may occur.

The policy is needed when a company uses GPS or geolocation tracking in company vehicles under LOPDGDD Article 90 — prior notification to employees and, where applicable, prior consultation with workers' representatives (comité de empresa or delegados de personal) under Article 64 of the Estatuto de los Trabajadores is required.

The document is required when a company establishes an internal whistleblowing channel (canal de denuncias) under Ley 2/2023 de protección de las personas que informen sobre infracciones normativas, which requires an accompanying data protection notice for whistleblowers and persons reported.

An HR Data Protection Policy update is needed when the employer introduces new monitoring technologies, changes HR software providers, begins using AI-based recruitment or performance tools, or when a works council (comité de empresa) negotiates new collective bargaining provisions on employee data under the convenio colectivo.

Parties in Spain should prepare a HR Data Protection Policy Spain (Política de Protección de Datos RRHH) proactively rather than waiting for a dispute to arise. Courts interpret agreements based on the written terms rather than oral representations. Under the Estatuto de los Trabajadores (ET) RDL 2/2015, Spanish employment law governs contracts, dismissals, and working conditions. The Tesorería General de la Seguridad Social (TGSS) administers social security contributions. The Servicio Público de Empleo Estatal (SEPE) manages unemployment benefits. The Inspección de Trabajo y Seguridad Social enforces labour compliance. The Juzgados de lo Social hear employment disputes under the Ley Reguladora de la Jurisdicción Social (Ley 36/2011). Where the transaction involves regulated activities, prior approval from the relevant authority may be required before execution.

A valid HR Data Protection Policy Spain under LOPDGDD Article 88 and RGPD must contain the following essential elements to comply with AEPD standards and satisfy employee information requirements.

Identity of the Data Controller (Responsable del Tratamiento): Full legal name, NIF, address, and contact details of the employing company. DPO contact details where a Delegado de Protección de Datos has been appointed.

Categories of Employee Data Processed: A thorough inventory of personal data categories processed in the HR context, including: identification and contact data; payroll, bank, and tax data; social security contribution data; health data (medical certificates, occupational health records, disability status); disciplinary records; performance evaluation data; training records; access control and CCTV data; computer and internet usage data; geolocation data; and whistleblowing channel data.

Purposes and Legal Basis for Each Category: The specific purpose for which each data category is processed and the RGPD Article 6 legal basis — contract performance (Article 6.1(b)) for payroll and employment management; legal obligation (Article 6.1(c)) for TGSS and AEAT obligations; legitimate interests (Article 6.1(f)) for certain security monitoring (subject to balancing test); and vital interests (Article 6.1(d)) for occupational health emergencies. Special category data (health data) requires an Article 9 RGPD basis — typically Article 9.2(b) (employment law obligations) or Article 9.2(h) (medical diagnosis and occupational medicine).

Workplace Monitoring Provisions: Specific notice as required by LOPDGDD Articles 87 to 90 — covering digital device monitoring (Article 87), CCTV (Article 89), and geolocation (Article 90). Each monitoring measure must state: the scope and purpose; the technical and organisational measures applied; retention periods; and the procedure by which employees can exercise their data rights. Prior consultation with workers' representatives is required before implementing new monitoring systems.

Retention Periods: Specific retention schedules for each data category — payroll records (4 years under Estatuto de los Trabajadores Article 4.2(f)), social security records (4 years under LGSS), CCTV footage (maximum 30 days under LOPDGDD Article 89.3), disciplinary records (linked to statute of limitations for the infraction under Estatuto de los Trabajadores).

Employee Rights: Statement of all RGPD rights — access, rectification, erasure, restriction, portability, and objection — and the procedure for exercising them through the company's HR department or DPO. The right to lodge a complaint with the AEPD must be mentioned. In Spain, the right to disconnection (derecho a la desconexión digital) under LOPDGDD Article 88 must also be addressed.

Third-Party Data Processors: Identification of HR software providers, payroll bureaus (gestorías laborales), occupational health providers (servicios de prevención), and other encargados del tratamiento who process employee data on the employer's behalf, with reference to the data processing agreements (contratos de encargo del tratamiento) under RGPD Article 28. Forms-legal.com provides this HR Data Protection Policy Spain template as a starting framework. Every policy must be tailored to the employer's specific data processing activities and reviewed by a qualified abogado laboralista or data protection specialist.

Under Spanish employment and data protection law, the LOPDGDD (Ley Orgánica 3/2018) and the RGPD (UE) 2016/679 jointly govern employee data. The Estatuto de los Trabajadores (RDL 2/2015) governs employment rights. The AEPD enforces data protection. The Inspección de Trabajo y Seguridad Social enforces labour law. Comités de empresa and delegados de personal represent workers' interests in information and consultation procedures.

Additional compliance elements for a HR Data Protection Policy Spain (Política de Protección de Datos RRHH) used in Spain include: Under the Estatuto de los Trabajadores (ET) RDL 2/2015, Spanish employment law governs contracts, dismissals, and working conditions. The Tesorería General de la Seguridad Social (TGSS) administers social security contributions. The Servicio Público de Empleo Estatal (SEPE) manages unemployment benefits. The Inspección de Trabajo y Seguridad Social enforces labour compliance. The Juzgados de lo Social hear employment disputes under the Ley Reguladora de la Jurisdicción Social (Ley 36/2011). Forms-legal.com provides this template as a starting point for Spain-compliant documentation.