Public safety, public order and other offences
In short
The Criminal Code (Código Penal) does not have a single chapter on cybercrime. Two types of conduct are grouped under that label:
The situations we are most often consulted about are accessing another person’s email or social media account, using data from a former employer, phishing, ransomware attacks on businesses and sharing photos or videos without permission. For threats and harassment on social media, see our page on threats and coercion.
| Conduct | Penalty | Article |
|---|---|---|
| Accessing an information system without authorisation by breaching its security measures, or remaining in it against the owner’s wishes | 6 months to 2 years in prison | 197 bis.1 |
| Intercepting non-public data transmissions | 3 months to 2 years in prison or a fine of 3 to 12 months | 197 bis.2 |
| Seizing emails, messages or documents, or intercepting communications, to discover secrets or invade privacy | 1 to 4 years in prison and a fine of 12 to 24 months | 197.1 |
| Accessing, using or modifying confidential personal data held in files | 1 to 4 years in prison and a fine of 12 to 24 months | 197.2 |
| Disclosing what was discovered in the above cases | 2 to 5 years in prison | 197.3 |
| Sharing without permission intimate images obtained with consent, where this seriously undermines privacy | 3 months to 1 year in prison or a fine of 6 to 12 months | 197.7 |
| Producing or supplying programs or passwords to commit these offences | 6 months to 2 years in prison or a fine of 3 to 18 months | 197 ter |
| Seriously deleting, damaging, altering or making inaccessible someone else’s data or programs | 6 months to 3 years in prison | 264 |
| Seriously obstructing or interrupting someone else’s computer system | 6 months to 3 years in prison | 264 bis |
| Computer fraud and fraudulent use of cards or payment data | 6 months to 3 years in prison | 249 |
Penalties increase if the acts are committed within a criminal organisation or group (article 197 quater), if they affect particularly sensitive data or minors (article 197.5), if there is a profit motive (article 197.6) or if the computer damage is particularly serious or affects essential services (article 264.2). Companies can also be convicted of these offences; we explain this on our corporate criminal compliance page.
Offences involving the discovery and disclosure of secrets, such as getting into another person’s email or mobile phone, can only be prosecuted if the injured party or their legal representative files a complaint (article 201). No such complaint is needed when the offence affects the general interest, several people, a minor or a person with a disability in need of special protection. The victim’s pardon ends the criminal proceedings, subject to the exceptions in the law.
This changes the strategy: in many disputes between former business partners, former employees or relatives, an agreement can bring the proceedings to an end.
If you have been summoned to give a statement, first read our page on being summoned as a suspect and call us.
In their basic forms, these offences carry maximum penalties of between one and four years in prison. If the sentence does not exceed two years and you have no relevant prior convictions, article 80 allows it to be suspended. Offences with a maximum penalty of up to five years become time-barred after five years (article 131). For the offences in paragraphs 2 and 3 of article 197 and computer damage under article 264, extended confiscation of assets of unexplained origin is also possible (article 127 bis).
The first thing to do is preserve the evidence: dated screenshots, links, emails with their headers, bank statements and any messages received. Do not delete anything, and change your passwords from a secure device. If you have been the victim of online fraud, notify your bank immediately and see our fraud page.
Then report it and consider joining the proceedings as a private prosecutor (acusación particular) to request investigative measures, such as identifying account holders or IP addresses, and to claim compensation. If the sharing of intimate images or control of your phone comes from your partner or ex-partner and you are a woman, it may amount to gender-based violence: we can help you through our specialist website, abogadaviolenciadegenero.com.
Yes. Seizing another person’s messages or emails without their consent to discover their secrets or invade their privacy is punished with one to four years in prison and a fine (article 197.1 of the Criminal Code). If what was discovered is also disclosed, the penalty is two to five years. It makes no difference that you know the password: what matters is that you do not have their permission.
Accessing an information system, or part of one, without authorisation by breaching its security measures is punished with six months to two years in prison (article 197 bis). If data is also seriously deleted, altered or made inaccessible, the offence of computer damage under article 264 may be added, with six months to three years in prison.
Yes. Anyone who shares without consent intimate images they obtained with the permission of the person concerned faces three months to one year in prison or a fine (article 197.7). And anyone who receives them and forwards them to others without the consent of the person concerned also commits an offence, punishable by a fine of one to three months.
No. The Criminal Procedure Act allows third parties who know how a system works to be ordered to provide information to access it, but it expressly excludes the suspect (article 588 sexies c.5). In addition, to access the contents of a seized phone or computer, the police generally need judicial authorisation.
Call your bank to try to block the transaction, keep all the evidence without deleting anything and report it as soon as possible. Computer fraud is punished with six months to three years in prison (article 249). Joining the proceedings as a private prosecutor allows you to ask for the money to be traced and to claim its return from those responsible.
Do you need help now?
On this page
Related services
