Article 197 Spanish Criminal Code: Disclosure of Secrets (2026)

Unauthorised intrusion into another person's privacy: seizing their emails, messages or personal data, intercepting their communications or using listening or recording devices without consent, in order to discover their secrets. The basic penalty is imprisonment of 1 to 4 years plus a fine.

Accessing another person's communications or accounts without consent —including your partner's— in order to discover their secrets can be an offence under art. 197 CP. Marriage or cohabitation does not authorise violating the other person's privacy.

Disseminating intimate images or recordings obtained with consent but disclosed without it (so-called 'revenge porn') is a specific offence under art. 197.7 CP, punished with imprisonment of 3 months to 1 year or a fine, and aggravated if the victim is a partner or a minor.

No. Evidence obtained in violation of fundamental rights (art. 11 LOPJ) is null and cannot be used at trial, and it carries with it the nullity of everything derived from it. This is one of the main lines of defence against this type of evidence.

Seizing correspondence or intercepting communications (Art. 197.1 CP) and the unauthorised access to or use of personal data held in files (Art. 197.2 CP) carry 1 to 4 years in prison and a fine of 12 to 24 months. Where the person who discovered or obtained that data then disseminates, reveals or transfers it, the penalty is 2 to 5 years in prison (Art. 197.3, first paragraph, CP). By contrast, a third party who, knowing the unlawful origin and without having taken part in the discovery, merely passes it on faces 1 to 3 years in prison and a fine of 12 to 24 months (Art. 197.3, second paragraph, CP). If the acts are committed by the person in charge of or responsible for the files, the penalty rises to 3 to 5 years (Art. 197.4 CP).

The penalty is imposed in its upper half where the data affected reveals ideology, religion, beliefs, health, racial origin or sexual life, or where the victim is a minor or a person with a disability in need of special protection (Art. 197.5 CP). It is also aggravated where the acts are committed for profit (Art. 197.6 CP), and where they involve profit and sensitive data the penalty is 4 to 7 years in prison. If the offender is an authority or public official acting outside the cases permitted by law and abusing their office, Art. 198 CP applies the penalties in their upper half plus absolute disqualification for 6 to 12 years.

The limitation period depends on the maximum penalty for each form, under Art. 131 CP. The basic forms of Art. 197 (paragraphs 1 to 4, with penalties reaching five years) become time-barred after five years. Disseminating intimate images obtained with consent (Art. 197.7 CP), being a less serious offence punished with 3 months to 1 year in prison or a fine, also becomes time-barred after five years, the minimum period under Art. 131 CP for less serious offences. By contrast, the form in Art. 197.6 CP that punishes acts committed for profit involving sensitive data with 4 to 7 years in prison exceeds a five-year maximum and becomes time-barred after ten years. The period runs from the day the act is committed.

Recording a conversation in which you yourself take part is not an offence of discovery and disclosure of secrets, because Art. 197 CP punishes seizing or intercepting other people's communications, not one's own. The settled case law distinguishes between recording a conversation you are part of, which is lawful, and intercepting or listening to third parties' communications without their knowledge, which does fall under Art. 197.1 CP. It is a separate question whether later disseminating that recording may harm the other speaker's privacy or reputation and give rise to liability on other grounds.

As a general rule a complaint from the injured party or their legal representative is required to prosecute the offences in this chapter, and the victim's pardon extinguishes the criminal action (Art. 201 CP). No complaint is needed where the offence affects the general interest or a plurality of persons, where the victim is a minor or a person with a disability in need of special protection, or where it is committed by an authority or public official under Art. 198 CP. Separately, unauthorised access to an information system in breach of its security measures carries 6 months to 2 years in prison (Art. 197 bis CP).