Recording meetings in Spain.
Spain goes further than the Regulation in one respect that matters here: it legislates digital rights inside the employment relationship, which is exactly the context most meeting recording lives in.
The General Data Protection Regulation applies here of its own force rather than through a national translation of it, and the national act below handles the parts member states are left to decide for themselves. The supervisory authority enforces both. In Spain that national act is LO 3/2018, which adds a set of digital rights in the workplace on top of the Regulation. Alongside both, Article 197 of the Código Penal addresses intercepting communications or using recording devices to capture them without consent, and separately addresses disclosing what was obtained.
The employment dimension is what distinguishes Spain in practice. LO 3/2018 sets out rights around digital privacy at work, and recording staff routinely engages them directly. The AEPD is one of the most active enforcement authorities in the EU by volume of decisions, so its published criteria function as a practical guide rather than a theoretical one. On the criminal side, Article 197 treats disclosure as conduct separate from capture, so a recording that was properly made can still raise a question when it is shared.
- The data protection instrument
- Ley Orgánica de Protección de Datos Personales y garantía de los derechos digitales (Organic Law on Personal Data Protection and Guarantee of Digital Rights), LO 3/2018
- Who supervises this
- Agencia Española de Protección de Datos (Spanish Data Protection Agency)
Criminal provisions
These sit alongside data protection law rather than replacing it. They generally address conduct that is covert or that involves conversations the recorder was not part of, which is a narrower category than everyday meeting recording, and a considerably more serious one.
Código Penal, Article 197
Criminal Code
Discovery and disclosure of secrets. The provision addresses intercepting another person's communications or using recording devices to capture them without consent, and separately addresses disclosing what was obtained.
What is specific to this country
- The GDPR applies directly in Spain rather than through a national equivalent. A meeting recording that identifies the people in it is personal data, so making, storing and sharing it is processing, and it needs a lawful basis under Article 6.
- Transparency is a separate obligation from lawful basis. Article 13 requires that people are told what is being collected and why at the time it is collected, which for a meeting means at the start rather than afterwards.
- LO 3/2018 goes further than the Regulation in places, particularly on digital rights in the employment relationship, which is the context most meeting recording sits in.
- The AEPD is among the most active enforcement authorities in the EU by volume of decisions, so its published criteria are a practical guide rather than a theoretical one.
What to do in practice
The practice below is not the legal minimum in every jurisdiction. It is the practice that is defensible in all of them, which is a more useful target when your calls cross borders.
- Say it out loud at the start, before anything substantive is discussed, and say what the recording is for. Not a line in the invite nobody read.
- Give people a real way to decline. An announcement that leaves no room to object is closer to a notification than to consent.
- Write it down. A line in the notes recording that the meeting was recorded, and that nobody objected, is worth more later than anyone's memory of the moment.
- Keep external meetings to a higher standard than internal ones. Colleagues share an employment context; a customer, a candidate, or a supplier does not.
- Decide how long you keep recordings, and actually delete them. Indefinite retention converts a small, well-handled recording into a growing liability.
- Treat sharing as a fresh decision. The question is not whether you were allowed to record, it is whether this particular person was meant to hear it.
Questions
Does Spanish law add anything beyond the GDPR?
Yes. LO 3/2018 legislates digital rights in the employment relationship, which is directly relevant when an employer records meetings. That is genuinely additional rather than a restatement of the Regulation.
Is sharing a recording treated separately from making it?
Article 197 addresses disclosure as its own conduct. Under the Regulation, sharing is also a separate processing operation needing its own basis and its own transparency. Both point the same way: treat sharing as a fresh decision.
How active is the regulator?
The AEPD issues a high volume of decisions relative to other EU authorities, so there is more published material to check your position against than in most member states.
Sources
Primary sources, so you can check this rather than take our word for it.
Recording that announces itself.
Canto's notetaker joins as a named participant the organiser admits, and the recording, the transcript and who can see it stay under your control. 300 minutes a month, free forever.