Article 197 Spanish Criminal Code: Disclosure of Secrets (2026)

The offence of discovery and disclosure of secrets is set out in Article 197 of the Spanish Criminal Code (CP) and protects privacy. It punishes anyone who, without consent, seizes another person's messages, papers or data or intercepts their communications, and it punishes more severely anyone who disseminates what was discovered. Penalties range from one to four years' imprisonment and a fine of twelve to twenty-four months (Arts. 197.1 and 197.2 CP) to two to five years' imprisonment if the material is revealed to third parties (Art. 197.3 CP), and reach four to seven years' imprisonment in the most serious case, under Art. 197.6 CP.

What Art. 197 CP Says: Unofficial Translation of Sections 1 to 7

Below is the wording currently in force, as it appears in the consolidated text published in the Boletín Oficial del Estado (BOE), Spain's official gazette, in our own unofficial English translation, for guidance only: only the Spanish text is legally binding. The dissemination of intimate images in section 7 was introduced by the 2015 reform (Organic Law 1/2015), and its second paragraph, on forwarding, by the 2022 reform (Organic Law 10/2022).

Unofficial English translation:

1. Anyone who, in order to discover the secrets or breach the privacy of another person, without their consent, seizes their papers, letters, email messages or any other documents or personal effects, intercepts their telecommunications or uses technical devices for listening to, transmitting, recording or reproducing sound or images, or any other communication signal, shall be punished with imprisonment of one to four years and a fine of twelve to twenty-four months.

2. The same penalties shall be imposed on anyone who, without being authorised, seizes, uses or modifies, to the detriment of a third party, reserved data of a personal or family nature of another person that are recorded in computer, electronic or telematic files or media, or in any other type of public or private file or register. The same penalties shall be imposed on anyone who, without being authorised, accesses those data by any means, and on anyone who alters or uses them to the detriment of the data subject or of a third party.

3. A penalty of imprisonment of two to five years shall be imposed if the data or facts discovered, or the images captured, referred to in the preceding sections are disseminated, revealed or transferred to third parties.

Anyone who, knowing of their unlawful origin and without having taken part in their discovery, engages in the conduct described in the preceding paragraph shall be punished with imprisonment of one to three years and a fine of twelve to twenty-four months.

4. The acts described in sections 1 and 2 of this article shall be punished with imprisonment of three to five years when:

a) they are committed by the persons in charge of or responsible for the files, computer, electronic or telematic media, archives or registers; or

b) they are carried out through the unauthorised use of the victim's personal data.

If the reserved data have been disseminated, transferred or revealed to third parties, the penalties shall be imposed in their upper half.

5. Likewise, when the acts described in the preceding sections affect personal data revealing ideology, religion, beliefs, health, racial origin or sex life, or the victim is a minor or a person with a disability in need of special protection, the penalties provided shall be imposed in their upper half.

6. If the acts are carried out for profit, the penalties respectively provided in sections 1 to 4 of this article shall be imposed in their upper half. If, in addition, they affect data of the kinds mentioned in the preceding section, the penalty shall be imprisonment of four to seven years.

7. Anyone who, without the authorisation of the person affected, disseminates, reveals or transfers to third parties images or audiovisual recordings of that person which they obtained with that person's consent in a home or in any other place out of sight of third parties, where the disclosure seriously undermines that person's personal privacy, shall be punished with imprisonment of three months to one year or a fine of six to twelve months.

A fine of one to three months shall be imposed on anyone who, having received the images or audiovisual recordings referred to in the preceding paragraph, disseminates, reveals or transfers them to third parties without the consent of the person affected.

In the cases covered by the preceding paragraphs, the penalty shall be imposed in its upper half when the acts have been committed by the spouse or by a person who is or has been joined to the victim by a similar emotional relationship, even without cohabitation, when the victim is a minor or a person with a disability in need of special protection, or when the acts have been committed for profit.

If You Have Been Reported for Disclosure of Secrets: What It Means and What Happens Next

A complaint is not a conviction. For the offence to exist, three elements must be present: accessing something that belongs to someone else (messages, documents, communications, data or images), doing so without consent or authorisation, and doing it in order to discover secrets or breach the privacy of another person. For several of the conducts in section 2, the law also requires detriment to the data subject or to a third party.

Save for exceptions, the offence is prosecuted only if the aggrieved person files a complaint (denuncia) (Art. 201 CP). The investigating court will then open preliminary proceedings (diligencias previas) and summon you to give a statement as a person under investigation (investigado), assisted by a lawyer. Messages, screenshots, access logs or a forensic copy of the device are commonly requested, and how they were obtained can be decisive. Most of these cases follow the abbreviated procedure (procedimiento abreviado), which the Criminal Procedure Act (LECrim) reserves for offences punishable by up to nine years' imprisonment (Art. 757 LECrim).

The Forms of the Offence: What Each Section Punishes

• Section 1: reading another person's email or messages, keeping their papers, intercepting their calls or recording them covertly, for example with a hidden camera.
• Section 2: reserved data held in files or registers, such as a person with access to the system consulting someone else's medical records.
• Sections 3 to 6: aggravated forms for disseminating what was discovered, for being the person in charge of the file or using the victim's data, for affecting sensitive data or vulnerable victims, and for acting for profit. The four-to-seven-year band in section 6 is the only one in Art. 197 that exceeds five years' imprisonment.
• Section 7: dissemination of intimate images obtained with permission, which we discuss below.

Table of Penalties Under Art. 197 CP and Limitation Periods

The limitation period (the deadline for prosecuting the offence) depends on the maximum penalty (Art. 131 CP). Sections 1 to 5 are less serious offences (delitos menos graves), and forwarding under section 7, second paragraph, is a minor offence (delito leve).

If the acts are committed within a criminal organisation or group, the penalties one degree higher apply (Art. 197 quater CP).

Arts. 197 bis to 200 CP: The Rest of the Chapter

• Art. 197 bis: accessing an information system by circumventing its security measures (prison of six months to two years) or intercepting non-public transmissions of computer data (prison of three months to two years or a fine of three to twelve months). See the offence of unlawful access to information systems and our cybercrime practice area.
• Art. 197 ter: producing, acquiring, importing or supplying software designed to commit these offences, or passwords and access codes, with the intention of facilitating them (prison of six months to two years or a fine of three to eighteen months).
• Art. 197 quinquies: where a legal person is liable, a fine of six months to two years.
• Art. 198: an authority or public official acting by abusing their position. Its boundary with Art. 417, which punishes the official who reveals what they learn through their post, is covered in disclosure of secrets versus official secrets.
• Art. 199: revealing secrets learned through one's trade or employment, or breaching the duty of professional confidentiality. See Art. 199 and professional secrecy.
• Art. 200: extends the chapter to the reserved data of legal persons.

Accessing a Partner's Phone or a Work Email Account

Reading a partner's or ex-partner's messages, logging into their email or social media to "check" something, or installing a monitoring app on their phone may fall under Art. 197.1 CP. Marriage or cohabitation does not authorise anyone to breach the other person's privacy. The most disputed point is whether there was consent to that specific access: knowing the password or sharing the device does not prove it on its own. We analyse this in our guide on a partner's phone and company email and in the one on spyware on a partner's phone.

At work, Article 87 of Organic Law 3/2018 on data protection only allows the employer to access the digital devices it provides in order to monitor compliance with employment obligations and to safeguard the integrity of those devices, and it requires the employer to set criteria for their use and inform staff of them. Access outside that framework may be examined under Art. 197 CP. An employee who takes reserved data with them may be liable under Art. 197.2 CP or, if the data are trade secrets, under the industrial espionage provisions of Arts. 278 to 280 CP.

Recording a conversation in which you yourself take part is different: Art. 197 punishes seizing or intercepting other people's communications, not recording your own. Examining the secrecy of communications under Art. 18.3 of the Spanish Constitution, the Constitutional Court held that a person who records a conversation with someone else does not, by that fact alone, act contrary to that provision (STC 114/1984 of 29 November). What may have consequences is how the recording is used afterwards.

Intimate Images (Art. 197.7 CP): What It Covers and What It Does Not

Art. 197.7 CP punishes disseminating, without permission, images or recordings that were obtained with the consent of the person concerned in a place out of sight of third parties, where this seriously undermines their privacy. It also punishes, with a fine, anyone who receives them and forwards them. The penalty rises to its upper half if the perpetrator is or was the victim's partner, if the victim is a minor or a person with a disability in need of special protection, or if there is a profit motive.

If the images were captured covertly, the facts may fall under Art. 197.1, which carries a heavier penalty. Nor is section 7 the route for montages created with artificial intelligence (deepfakes), which are not images obtained with the consent of the person depicted: we explain this in our guide on AI deepnudes and data protection. For Art. 197.7 in detail, see the non-consensual distribution of intimate images and, if you are accused, our page on sexting defence.

Complaint, Victim's Pardon and Limitation Period

A complaint by the aggrieved person or their legal representative is required (Art. 201.1 CP), unless the acts are committed by an authority or public official (Art. 198 CP), affect the general interest or a plurality of persons, or the victim is a minor or a person with a disability in need of special protection (Art. 201.2 CP). The pardon of the victim (perdón del ofendido) extinguishes the criminal action (Art. 201.3 CP), but not where the victim is a minor or a person with a disability in need of special protection (second paragraph of Art. 130.1.5 CP).

The victim can also join the proceedings as a private prosecutor (acusación particular), a party alongside the Public Prosecutor's Office. Most forms of the offence become time-barred after five years; the other periods are shown in the table.

Defence Strategies

1. Consent or authorisation: if the holder allowed the access or the recording, or the person who accessed the data was authorised, an element of the offence is missing.
2. No such purpose: Art. 197.1 requires acting in order to discover secrets or breach privacy; accidental access, or access for another proven purpose, does not fit.
3. Data not reserved, or no detriment: under section 2, the data must be reserved and, in the conducts that require it, cause detriment.
4. Unlawful evidence: evidence obtained, directly or indirectly, in breach of fundamental rights shall have no effect (Art. 11.1 of the Organic Law of the Judiciary, LOPJ). The defence reviews how the messages or the forensic copy were obtained and whether their integrity has been preserved.
5. Reparation of the damage: repairing it or reducing its effects before the trial hearing (juicio oral) allows the mitigating circumstance of Art. 21.5 CP. If the final sentence does not exceed two years and the requirements of Art. 80 CP are met, including being a first-time offender, the court may be asked to suspend its execution.

What to Do (and What Not to Do) If You Are Reported or If You Are the Victim

If you have been reported: do not give a statement without a lawyer; do not delete messages, accounts or files, which may serve as evidence in your favour; do not contact the complainant to get the complaint withdrawn; and do not share the material again. Gather whatever shows the context: permissions, earlier conversations or the shared use of a device.

If you are the victim: keep the evidence without altering it (dated screenshots, links, profile names) and, if the material is circulating on social media, ask the platform to remove it. Except in the cases of Art. 201.2 CP, there will be no proceedings without your complaint.