Secretly Recorded in Spain? Your Rights, the GDPR & What to Do Right Now
Is Secret Recording Illegal in Spain?
Is Secret Recording Illegal in Spain?
Yes, and it can be illegal under several laws simultaneously. Spain has one of the most robust privacy protection frameworks in the world, thanks both to the European Union's General Data Protection Regulation (GDPR) and its own national legislation. The combination of these laws means that secretly recording someone — whether in a bathroom, a bedroom, a workplace, or any space where there is a reasonable expectation of privacy exposes the perpetrator to serious criminal and civil liability.
The challenge for most victims is knowing which law covers their specific situation and which authority to approach first. That is what this guide is here to clarify.
The Laws That Protect You
GDPR-General Data Protection Regulation (2018)
The GDPR is the cornerstone of privacy protection in Spain and across the entire EU. It applies to any processing of personal data, and under the law, video footage of you, photographs of you, and audio recordings of you are all classified as personal data. If someone collected, stored, or shared that material without your consent, they have violated the GDPR.
The law is enforced by the Spanish Data Protection Agency (Agencia Española de Protección de Datos, or AEPD), which has the authority to investigate complaints, issue orders, and recommend sanctioning proceedings. The AEPD can also order the immediate takedown of content and the deletion of all copies without requiring a court case to be concluded first.
Penalties under the GDPR: fines of up to 20 million euros or 4% of global annual turnover, whichever is higher; orders for immediate deletion of content; provisional suspension of data processing.
LOPDGDD Organic Law on Data Protection and Guarantee of Digital Rights (2018)
This Spanish law complements and develops the GDPR within the national legal framework. It includes specific protections for the right to digital erasure, the right to digital disconnection at work, and the regulation of video surveillance. It explicitly recognises the right to privacy against the use of recording devices, and is the law Spanish judges apply directly in domestic proceedings.
Penalties under the LOPDGDD: very serious infringements carry fines from 300,001 to 20 million euros; serious infringements from 40,001 to 300,000 euros; minor infringements up to 40,000 euros.
Spanish Penal Code Articles 197 to 201
The Penal Code criminalises the discovery and disclosure of secrets, including the interception of private communications, the capture of images in private places without consent, and the non-consensual distribution of intimate images, commonly known as revenge porn.
Penalties under the Penal Code: illegal capture of images carries 1 to 4 years imprisonment under Article 197; non-consensual distribution of intimate images carries 3 months to 1 year imprisonment or a fine under Article 197.7; if the perpetrator is a spouse or partner, the sentence is increased by half; aggravating factors apply if the victim is a minor or has a disability.
Law 34/2002 — Information Society Services Act (LSSI)
If the recording was shared online through Facebook, Instagram, TikTok, WhatsApp, Telegram, or any other platform the LSSI applies on top of the other laws. It obliges intermediaries and platforms to remove illegal content when notified, and establishes joint liability for platforms that fail to act. In practical terms, this means the person who shared your footage online faces significantly heavier combined penalties than someone who merely made the recording.
Organic Law 1/1982 Civil Protection of the Right to Honour, Privacy, and Personal Image
This law protects the right to personal and family privacy and to one's own image. Any unlawful intrusion capturing images in private places, revealing intimate personal data — can give rise to civil compensation entirely separately from criminal liability. Both avenues are compatible and can be pursued simultaneously.
Your Immediate Rights Under Spanish Privacy Law
One thing victims consistently do not know is that you have rights you can act on right now, without waiting for a criminal case to conclude.
Right to Access: You can demand to know what recordings of you exist, who holds them, and how they have been used.
Right to Erasure (Right to be Forgotten): Under the GDPR, you can demand the permanent deletion of any recording or image of you. This right applies directly to individuals, companies, websites, and applications operating in Spain or anywhere in the EU.
Right to File a Complaint with the AEPD: The Spanish Data Protection Agency handles complaints directly and online. Filing a complaint can trigger an official investigation, content deletion orders, and a sanctioning procedure, all without needing to hire a lawyer first.
Right to Civil Damages: Under Organic Law 1/1982, victims can pursue civil compensation for privacy violations. This runs entirely separately from criminal prosecution, meaning you can seek compensation at the same time as criminal charges are being pursued.
Right to Injunctive Relief: Courts can issue urgent orders to stop further sharing or distribution of footage while a case is ongoing. Your lawyer can apply for this immediately.
Right to Object: You can object at any time to the processing of your personal data, including recordings, when there is no legal basis for it.
Step by Step: What to Do If You Were Secretly Recorded in Spain
Knowing you have rights is the first step. Using them quickly and correctly is what actually makes a difference. Here is the exact sequence to follow.
Step 1: Preserve everything before you do anything else
Screenshot every URL, post, chat message, or reference to the footage. Note the date, time, platform, and the username or account that shared it. Save these screenshots to a secure location your personal email, cloud storage, or a trusted device not connected to the person who recorded you. Do not delete anything from the platform yet, even if seeing it is distressing. Courts and investigators need evidence that the content existed and was accessible. Evidence preservation is the single biggest factor in whether a case moves forward. A notary can certify online content electronically with full legal evidentiary value in Spain.
Step 2: Report the content to the platform
File a privacy or non-consensual intimate image report directly on the platform where the footage appears. Facebook, TikTok, Instagram, Telegram, and most major platforms have specific reporting categories for this. Use "Non-Consensual Intimate Image", "Privacy Violation", or the closest available equivalent. Most platforms respond to verified reports within 24 to 72 hours. If the content appears in Google Search results, submit a separate removal request through Google's privacy removal portal. You can also request removal through the AEPD's specific tool for the right to be forgotten in search engines.
Step 3: File a complaint with the AEPD
Go to aepd.es and file a complaint directly with the Spanish Data Protection Agency. You can do this entirely online. In your complaint, cite the GDPR and the LOPDGDD specifically, describe the nature of the recording and how you became aware of it, and attach your screenshots as evidence. The AEPD can issue a resolution ordering the cessation of unlawful processing, require the deletion of all material, and refer the case for administrative sanctions, all within a single proceeding. The AEPD helpline is 901 100 099 for situations where you are unsure how to proceed.
Step 4: File a criminal complaint with the National Police or Civil Guard
You have two main options. The Technology Investigation Brigade (Brigada de Investigación Tecnológica, or BIT) of the National Police specialises in crimes committed via the internet, including the distribution of intimate images and non-consensual recording. The Civil Guard also has specialist cybercrime units (EDITE). When filing your complaint, specifically name the applicable laws: Articles 197 and following of the Penal Code, the LOPDGDD, and the GDPR as relevant. Naming the laws signals that you understand what violations occurred and ensures your report is routed to the right unit. Request an official copy of your complaint receipt before you leave. You can also file a complaint online through the electronic offices of the National Police or the Civil Guard.
Step 5: Contact INCIBE helpline 017
The National Cybersecurity Institute (Instituto Nacional de Ciberseguridad, or INCIBE) operates the free cybersecurity helpline 017, available Monday to Friday, which includes specific support for victims of non-consensual distribution of intimate content and other digital privacy violations. They coordinate with the National Police, Civil Guard, and AEPD, and can escalate your complaint across jurisdictions if needed.
Step 6: Consult a lawyer — free options are available
The Public Defender service (Turno de Oficio) provides free legal representation to those who meet the economic requirements, and can help you file criminal charges, apply for urgent injunctive measures, and pursue civil damages simultaneously. There are offices in every province and city in Spain. The Bar Associations (Colegios de Abogados) also offer a free Legal Guidance Service (Servicio de Orientación Jurídica) available to everyone, with no means test required. Either option can help you send a formal demand letter requiring immediate deletion of all footage and payment of damages — often the fastest way to get results without waiting for a full criminal case. If your case involves gender-based violence, the 016 helpline can direct you to specialised free legal assistance regardless of your income level.
What If the Recording Happened in the Workplace?
Secret recording in the workplace by an employer, supervisor, or colleague is treated as a serious LOPDGDD and GDPR violation when it involves personal spaces such as bathrooms, changing rooms, or any area where employees have a reasonable expectation of privacy. Employers who install covert cameras in these spaces face both criminal charges and substantial fines from the AEPD. Legitimate workplace surveillance must be visibly signposted, proportionate, and cannot cover intimate spaces. If this has happened to you, report simultaneously to the AEPD and the Labour Inspectorate (Inspección de Trabajo), and request an investigation under both the LOPDGDD and the Workers' Statute.
Key Contact Numbers
- 016 — gender-based violence helpline, available 24 hours, free, includes digital violence
- 017 — INCIBE cybersecurity helpline, Monday to Friday, free
- 901 100 099 — Spanish Data Protection Agency
- 091 — National Police
- 062 — Civil Guard
- 112 — general emergencies
Conclusion
If you have been secretly recorded, filmed without consent, or had intimate footage shared without your permission in Spain, the law gives you real, actionable protection. The GDPR, the LOPDGDD, the Penal Code, and the LSSI all work together to give you multiple simultaneous avenues criminal prosecution, civil damages, platform takedowns, and AEPD orders.
Act fast. Preserve your evidence first, report to the platform, file a complaint with the AEPD, and file a criminal complaint with the National Police or Civil Guard naming the specific laws that apply. Contact the Turno de Oficio or your local Bar Association's Legal Guidance Service if you need free legal help.
Spain has strong privacy laws. The agencies are accessible. The process is navigable. You do not have to face this alone, and you do not have to wait for someone to give you permission to use these rights they are already yours.
Frequently Asked Questions
Is secret filming in bathrooms or changing rooms illegal in Spain?
Yes, absolutely. Recording someone in a bathroom, changing room, or any space where they have a clear expectation of privacy is a criminal offence under Article 197 of the Penal Code and can carry up to 4 years imprisonment. If the footage is shared online, penalties increase and additional liability arises under the GDPR and the LOPDGDD.
What is the penalty for sharing someone's private video without their consent in Spain?
Under Article 197.7 of the Penal Code, distributing intimate images without consent carries 3 months to 1 year imprisonment or a fine. If the images were also obtained without consent through covert recording, penalties are higher at 1 to 4 years. Each act of distribution can be treated as a separate offence, and additional financial sanctions of up to 20 million euros can apply under the GDPR.
Can I report a secret recording online without going to a police station?
Yes. You can file a complaint with the AEPD at aepd.es entirely online, contact INCIBE through the 017 helpline, and file with the National Police or Civil Guard through their electronic offices, all without leaving home.
Is there free legal help available to victims of non-consensual recording in Spain?
Yes. The Turno de Oficio provides free legal representation to those who meet the economic requirements, and the Legal Guidance Service of the Bar Associations is free for everyone. If the case involves gender-based violence, the 016 helpline can direct you to specialised free legal assistance regardless of your income.
What should I do if someone shared my video on Facebook or Instagram without my consent?
Report it directly to the platform using their non-consensual intimate image or privacy violation reporting tool. Simultaneously file a complaint with the AEPD at aepd.es, submit a Google removal request if the content appears in search results, and file a criminal complaint with the Technology Investigation Brigade of the National Police or the EDITE unit of the Civil Guard, citing Article 197.7 of the Penal Code.
What is the difference between the GDPR and the LOPDGDD in Spain?
The GDPR is the European regulation that applies directly across all EU countries and sets the highest fines, up to 20 million euros or 4% of global turnover. The LOPDGDD is the Spanish law that complements and develops it within the national legal order, adding specific rights such as the right to digital erasure on social networks, the regulation of workplace surveillance, and digital rights guarantees. Both coexist and in many cases can be invoked together before the AEPD.