Spain: why confirm a former employee's job?
Every Spanish employer already hands the worker a company certificate, the certificado de empresa, when employment ends, and it records more than the dates and the job title we ask about. Confirming them takes a minute and helps the person into their next job. certo asks on their behalf, with their explicit consent.
Law as of 26 October 2026 · Ley Orgánica 3/2018 (LOPDGDD) and Real Decreto Legislativo 8/2015 (Ley General de la Seguridad Social), consolidated texts on the BOE as last updated on 27 December 2025 and 21 October 2026
In short
- The facts are already on paper. When employment ends, the employer must give the worker a company certificate, the certificado de empresa (LGSS art. 298(d)), within ten days (Royal Decree 625/1985, art. 27). It records the type of contract, the date and cause of its end and the contribution bases. We ask less: only the dates and the job title, which your records already hold.
- It helps the person who worked for you. A record confirmed by a former employer is what the next employer trusts. Answering takes about a minute and needs no account.
- certo asks on their behalf, with their explicit consent. The GDPR and the Spanish data protection act (LOPDGDD) let you disclose personal data with the person's consent (GDPR Art. 6(1)(a); LOPDGDD art. 6). The person started this check themselves, for these facts and no others.
- You do not have to answer. No Spanish law obliges an employer to answer certo. Declining is fine.
Labour and social security law
We found no provision of the Workers' Statute (Estatuto de los Trabajadores, Royal Legislative Decree 2/2015) that obliges an employer to give a reference or a work certificate, or that limits what a former employer may say about an employee. Quoted from the consolidated texts on the BOE, Spain's official gazette.
General Social Security Act (LGSS), art. 298(d): the company certificate
Son obligaciones de los empresarios: … d) Entregar al trabajador el certificado de empresa, en el tiempo y forma que reglamentariamente se determinen.
In English: employers must give the worker the company certificate, at the time and in the form set by regulation.
Royal Decree 625/1985, art. 27: within ten days
Los empresarios y, en su caso, las Administraciones Públicas estarán obligados a facilitar a los trabajadores, en el plazo de diez días, a contar desde el siguiente a su situación legal de desempleo, el certificado de Empresa conforme al modelo que se acompaña como anexo …
In English: employers must give workers the company certificate, on the model annexed to the decree, within ten days of the day after they become legally unemployed. The certificate serves the unemployment benefit and carries far more than we ask; your records already hold the dates and the job title.
LOPDGDD, art. 9(1): what is never asked
… a fin de evitar situaciones discriminatorias, el solo consentimiento del afectado no bastará para levantar la prohibición del tratamiento de datos cuya finalidad principal sea identificar su ideología, afiliación sindical, religión, orientación sexual, creencias u origen racial o étnico.
In English: to prevent discrimination, the person's consent alone is not enough to lift the ban on processing data whose main purpose is to identify their ideology, trade union membership, religion, sexual orientation, beliefs or racial or ethnic origin. certo never asks about any of these, nor about performance, pay, the reason for leaving, health, family or a criminal record.
Personal data
The GDPR applies directly in Spain; Organic Law 3/2018 on the protection of personal data and the guarantee of digital rights (LOPDGDD) supplements it.
LOPDGDD, art. 6(1): consent
… se entiende por consentimiento del afectado toda manifestación de voluntad libre, específica, informada e inequívoca por la que este acepta, ya sea mediante una declaración o una clara acción afirmativa, el tratamiento de datos personales que le conciernen.
In English: consent means any free, specific, informed and unambiguous indication of the person's wishes by which they accept, by a statement or a clear affirmative action, the processing of personal data concerning them.
- GDPR Art. 6(1)(a), consent. The legal basis for your answer. The person's request names your organisation and the exact facts.
- GDPR Art. 7(1), proof of consent. certo records which account asked, when, and for which facts. Write to support@certo.bio and we send you the record for your request.
- GDPR Art. 5(1)(c), data minimisation. You confirm or leave unticked only the facts listed. Add nothing else: anything beyond them is not covered by the person's consent.
What this means for your answer
- Tick only what your HR, payroll or personnel records show.
- Not sure it is the same person? Press "We can't find a matching record". Never confirm a record you are not sure is theirs.
- Your policy is not to answer? Press "We do not answer these requests". The record shows your organisation declined, and nobody else there is asked.
Sources
- Ley Orgánica 3/2018, de 5 de diciembre, de Protección de Datos Personales y garantía de los derechos digitales, consolidated text (BOE, Spain's official gazette)
- Real Decreto Legislativo 8/2015, Ley General de la Seguridad Social, consolidated text, art. 298 (BOE)
- Real Decreto 625/1985, de 2 de abril, consolidated text, art. 27 (BOE)
- Real Decreto Legislativo 2/2015, Estatuto de los Trabajadores, consolidated text (BOE)
- Regulation (EU) 2016/679, the GDPR (EUR-Lex)
This page is not legal advice. It reflects the law as it stood on 26 October 2026.