Spain permits participant recording under criminal law: if you are part of the conversation, recording it is not an offence under Article 197 of the Código Penal. But Spain also has one of Europe's most active data-protection regulators, and the LOPDGDD applies in full regardless.
Spain hosts Mobile World Congress, Fitur and a dense calendar of industrial shows. The criminal bar is low; the data-protection bar is not.
Not legal advice. A practical summary for sales teams. Have your DPO or counsel review your process before an event.
Article 197 Código Penal: the criminal position
Article 197 CP protects the secrecy of communications, criminalising the interception of telecommunications or the use of recording devices to capture the communications of another person without authorisation.
The Spanish Supreme Court (Tribunal Supremo) has consistently held that recording a conversation in which you participate does not violate the secrecy of communications, because you are not intercepting someone else's exchange — you are documenting your own. The leading reasoning is that a participant already lawfully has access to everything said.
So on the criminal question, Spain aligns with the Netherlands and the UK rather than with Germany.
The LOPDGDD layer, which is where the real risk sits
Spain implements GDPR through Ley Orgánica 3/2018 de Protección de Datos Personales y garantía de los derechos digitales (LOPDGDD), supervised by the Agencia Española de Protección de Datos (AEPD).
The AEPD is worth taking seriously. It issues more sanctions annually than most European authorities, and unlike some regulators it pursues small and mid-sized businesses, not just large platforms. Its published decisions on recording, consent quality and transparency are extensive.
Whatever the criminal code permits, the AEPD requires:
- A lawful basis under Article 6 GDPR
- Transparency at the moment of collection (Articles 13–14)
- Data minimisation (Article 5(1)(c))
- Defined retention
- Demonstrable accountability (Article 5(2))
Which lawful basis
Consent, Article 6(1)(a), is the practical choice for booth recording. It is easy to obtain in conversation, easy to log, and easy to explain to a regulator.
Legitimate interests is available in principle. The LOPDGDD does contain business-friendly provisions — Article 19 addresses processing of contact data of individuals acting in a professional capacity. But that provision is aimed at basic professional contact details, not audio recordings of conversations. Stretching it to cover recording would be optimistic.
Use consent.
What to say at a Spanish booth
"Estoy grabando nuestra conversación para que mis notas sean precisas, ¿le parece bien?" ("I am recording our conversation so my notes are accurate — is that alright with you?")
In Catalonia, at Barcelona shows such as MWC, Catalan is widely appreciated: "Estic gravant la nostra conversa perquè les meves notes siguin precises, li sembla bé?"
Then:
- Wait for an explicit sí
- Keep the recording indicator visible
- Log that consent was obtained, with a timestamp
- Stop immediately on any objection
Transparency in practice
At the moment of collection the prospect must be told who you are, why you are recording, how long you keep it, that consent can be withdrawn, and that they can complain to the AEPD.
That is more than fits in a booth conversation, which is why the standard pattern is a short spoken summary plus a QR code to the full política de privacidad. The AEPD accepts layered information notices — a first layer given verbally or on a card, with the full notice one click away.
Minimisation: your best defence
Article 5(1)(c) requires data limited to what is necessary. Applied to booth recording: if the purpose is capturing an accurate lead, keeping raw audio after the fields are extracted serves no declared purpose.
Extract name, company, requirement and next step; delete the audio. Smaller breach surface, shorter retention, and a far easier conversation with the AEPD. This is how Confee is designed — the conversation becomes structured CRM fields and the raw recording need not be retained.
Spanish booth checklist
Before the show
- Privacy policy in Spanish (and Catalan for Barcelona events) via QR code
- Lawful basis documented — consent recommended
- Retention period defined
- Register of processing activities updated
Per conversation
- Ask before starting
- Wait for an explicit yes
- Recording indicator visible
- Log the consent
- Stop on objection
After the show
- Delete raw audio once fields extracted
- Handle rights requests within one month
The short version
Spain will not prosecute you for recording your own conversation. But the AEPD will absolutely take an interest if you process personal data without a basis, without transparency, or without limits.
Ask, get a sí, keep it visible, log it, delete the audio. That is comfortably compliant, and it takes four seconds per conversation.
Related reading:
- Is Recording Sales Conversations Legal? — the cross-jurisdiction overview
- Recording Consent at German Trade Shows — the strictest EU regime
- GDPR-Compliant Lead Capture — the data-protection side in full
FAQ
Can you record a conversation you take part in under Spanish law?
Generally yes. Article 197 Código Penal targets intercepting the communications of others. The Tribunal Supremo has held that a participant recording their own conversation does not commit this offence, making Spain a one-party consent jurisdiction on the criminal question.
Does the LOPDGDD still apply if recording is not a crime?
Yes, fully. Ley Orgánica 3/2018 applies whenever you process personal data. You need a lawful basis, must give transparency information, and must apply minimisation and retention limits regardless of the criminal position.
How active is the AEPD in enforcement?
Very. It issues more sanctions than most European supervisory authorities, including against small and mid-sized businesses, with extensive published practice on recording, consent quality and transparency.
What should a rep say before recording at a Spanish booth?
"Estoy grabando nuestra conversación para que mis notas sean precisas, ¿le parece bien?" Wait for an explicit sí, keep the indicator visible, and log the consent.