Are phishing simulations on employees legal? GDPR and Spanish employment law

By Kike Gandia · Co-Founder & CEO, OSCP

Yes, running phishing simulations on employees is legal in Spain, provided they are designed as a proportionate security measure rather than a trap: with a lawful basis other than consent, telling staff that periodic exercises will take place (without revealing when or with what pretext), involving workers' representatives, recording only the data strictly needed and never using the results to discipline anyone. This guide covers what the GDPR, the Spanish Data Protection Act (LOPDGDD) and the Workers' Statute (Estatuto de los Trabajadores) require, where pretexts should stop and a pre-campaign checklist. It is general information, not legal advice.

Short answer: the conditions for a lawful simulation

No Spanish law expressly bans or regulates phishing simulations. Whether one is lawful follows from general rules: data protection, because the campaign records what each employee does with an email; employment law, because it is a measure the employer takes over its staff; and common sense in how the deception is designed. These are the conditions worth meeting under GDPR and Spanish employment law:

Condition	What it means in practice	Reference
An appropriate lawful basis	Legitimate interest in security or the employer's monitoring power under the employment contract, never individual consent	GDPR Art. 6(1) and Recitals 43, 47 and 49
Transparency	Staff know there will be periodic exercises, why and what is recorded; they do not know when or with what pretext	GDPR Arts. 5(1)(a) and 13; LOPDGDD Art. 87(3)
Representatives involved	Email use criteria drawn up with them and a prior report from the works council	LOPDGDD Art. 87(3); Workers' Statute Art. 64(5)
Dignity and proportionality	Pretexts that do not humiliate or play on fear of dismissal or health	Workers' Statute Art. 20(3)
Data minimisation	The "credentials submitted" event is recorded, never the password	GDPR Arts. 5(1)(c) and 25
Purpose limitation	Results are used for training, not for discipline	GDPR Art. 5(1)(b)
Contract with the provider	Data processing agreement signed before the first email	GDPR Art. 28

Which lawful basis covers the simulation (and why not consent)

A simulated phishing campaign processes personal data: each employee's email address, a unique identifier per recipient and what they do with the message (open it, click, enter credentials or report it). It therefore needs one of the lawful bases in Article 6(1) GDPR. In practice, three are used:

Legitimate interest (Art. 6(1)(f)): the most common fit. Recital 47 expressly mentions the relationship with someone who is "in the service of the controller", and Recital 49 recognises as a legitimate interest processing that is strictly necessary and proportionate to ensure network and information security. It requires a documented balancing test between the company's interest and staff rights, and gives each employee a right to object on grounds relating to their particular situation (Art. 21).
Employment contract and monitoring power (Art. 6(1)(b) GDPR and Art. 20(3) of the Workers' Statute): the Spanish Data Protection Agency (AEPD) guide on employment relationships places the main basis for workplace processing in the employment contract, and the basis for monitoring measures in Article 20(3) of the Workers' Statute (Estatuto de los Trabajadores), provided they pass a proportionality test.
Legal obligation (Art. 6(1)(c)): Article 32 GDPR requires security measures and regular testing of their effectiveness, and frameworks such as Spain's National Security Framework (ENS), DORA or the NIS2 Directive include awareness among the required measures. That helps justify why the exercise is needed, but none of them mandates phishing simulations specifically, so on its own it is a weaker basis.

Consent is not a good basis. In its Guidelines 05/2020 on consent, the European Data Protection Board (EDPB) notes that, given the dependency between employer and employee, an employee is unlikely to be able to refuse without fear of consequences, and that for most processing at work the lawful basis "cannot and should not be the consent of the employees". In a simulation it would also backfire: asking each person announces the exercise, whoever refuses drops out of the measurement and whoever agrees can withdraw at any time. Choosing and documenting the basis is a decision for the controller and its DPO.

Spanish employment law: the Workers' Statute and the LOPDGDD

Article 88 GDPR lets each Member State set more specific rules for processing in the employment context, with particular attention to transparency and workplace monitoring systems. In Spain those rules are split between the Spanish Data Protection Act (Ley Orgánica 3/2018, LOPDGDD) and the Workers' Statute (Estatuto de los Trabajadores), and several bear directly on a phishing simulation:

Workers' Statute, Article 20(3): the employer may adopt the monitoring and control measures it sees fit to verify that employees meet their work obligations, with due regard for their dignity. Even if a simulation's purpose is training, it produces data on each employee's behaviour, so it should carry the same safeguards as a monitoring measure.
LOPDGDD, Article 87: recognises the right to privacy when using digital devices provided by the employer and requires criteria for their use to be drawn up with the participation of workers' representatives and communicated to staff. The corporate email use policy is the natural place to announce that phishing exercises will take place.
LOPDGDD, Article 88: the right to digital disconnection. A test email can wait in the inbox, but simulated calls or text messages outside working hours are hard to justify.
LOPDGDD, Article 91: collective agreements may add safeguards for employee data. Check yours before designing the campaign.
Workers' Statute, Article 64(5): the works council is entitled to issue a prior report on the introduction and review of work organisation and control systems (letter f) and on vocational training plans (letter e). Whether a simulation counts as a control system is debatable; the prudent route is to treat it as one, present the programme to the council and respect the fifteen-day deadline Article 64(6) sets for its report. Where there is no works council, staff delegates have the same powers (Art. 62(2)).

The AEPD guide on data protection in employment relationships (La protección de datos en las relaciones laborales) sums up the test any monitoring measure must pass: it must be suitable for its aim, necessary because no less intrusive measure would be equally effective, and proportionate in the strict sense, meaning it brings more benefits than harm.

Do employees have to be told? Transparency without ruining the measurement

Staff must be informed, but not about everything. The transparency the GDPR requires (Arts. 5(1)(a) and 13) concerns the processing: that it exists, what it is for, what data is recorded, who sees it, how long it is kept and what rights each person has. It does not require revealing the date or content of each exercise. The usual balance:

What you disclose: that the company runs periodic simulated phishing exercises by email (and, where relevant, by text message or corporate phone), their training and measurement purpose, the data recorded, the retention period, who can see results, that they will not be used for discipline and how to exercise data rights. If the basis is legitimate interest, you must explain what that interest is (Art. 13(1)(d)).
What you do not disclose: when a campaign will run, what pretext it will use or which groups it will target.
Where: in the digital devices use policy (the one required by Art. 87(3) LOPDGDD), in the employee privacy notice and in onboarding for new joiners. A reminder in the annual awareness training reinforces the message without spoiling the surprise.

Announcing the exact date ruins the measurement: that week staff distrust everything and the result says nothing about their real behaviour. Announcing that exercises will happen, on the other hand, pursues the same goal as the programme: making people more suspicious of unexpected emails. If the general notice achieves that, the programme is already working.

What data to record and how long to keep it

The data minimisation principle (Art. 5(1)(c)) and data protection by design (Art. 25) translate into concrete decisions when configuring the platform:

Data	Record it?	Comment
Email delivered	Yes	Needed to calculate rates
Link clicked	Yes	The main indicator
Credentials submitted	The event only	The fake page must not store or transmit what is typed
Password entered	Never	Neither in clear nor encrypted: turn off form data capture
Attachment opened	The event only	With an inert file that collects nothing from the device
Email reported	Yes	The behaviour you want to reinforce
Email opened	With caution	Tracking pixels are unreliable and add little
IP, browser and location	Only if needed	Useful to rule out automated clicks by security filters; delete soon

Retention (Art. 5(1)(e)): set a period for individual data —as long as the follow-up training for that campaign needs— and after it keep only aggregates. Rates per campaign and per department are enough to track progress over the years.

Results: the management report is aggregated by department, site or risk profile, with no names. Be careful with very small groups, where a percentage identifies a specific person. Access to individual detail is limited to whoever runs the follow-up training, not each team's line managers.

Documentation: records, impact assessment and the provider contract

A well-run campaign leaves a paper trail before the first email goes out:

Record of processing activities (Art. 30 GDPR): add phishing simulations and awareness as an activity, with its purpose, data categories, recipients and erasure deadlines.
Legitimate interest balancing test: if that is the chosen basis, put in writing why the measure is necessary, why no less intrusive alternative would be equally effective and which safeguards offset the impact on staff.
Data protection impact assessment (Art. 35 GDPR): a simulation with minimal data and aggregated results is not usually high-risk processing on its own. The assessment changes if individual "human risk" profiles are built and matched against performance reviews, if it is combined with other monitoring systems or if it is applied at large scale. Decide with the DPO, whose advice Article 35 itself requires when carrying out the assessment, and check the list of processing operations requiring one published by the AEPD.
Data processing agreement (Art. 28 GDPR): the platform provider or the firm running the campaign processes your staff's data on your behalf. The contract must set instructions, confidentiality, security measures, sub-processors, return or deletion of data at the end and, if servers are outside the European Economic Area, the international transfer mechanism.
Written internal authorisation: who approves the campaign, its scope, its dates and the procedure to stop it if something goes wrong.

Pretexts: how far the deception can go

The pretext is what makes a simulation believable, and also where the mistakes with the biggest legal and workplace consequences are made.

Real brands and public bodies. Impersonating a bank, a courier or a real supplier is what attackers do, but in an internal exercise it is worth assessing first: it may raise trademark issues, the lookalike domain may end up on blocklists or receive a takedown request from the brand owner's protection service, and if the email leaks outside the company the reputational damage is yours. With public bodies —the Spanish Tax Agency, Social Security, the traffic authority or the police— even more caution is due: on top of the risks above, you teach staff to doubt genuine official communications. Alternatives that work just as well: plausible fictitious brands, internal services (with the impersonated department's permission) or real suppliers who authorise it in writing.

Cruel pretexts. Fake bonuses or pay rises, layoffs, redundancy procedures, medical results, sick leave, COVID, disaster relief or family matters. They work precisely because they play on fear or need, which is why they destroy trust in the programme and clash with the due regard for employees' dignity. In December 2020 GoDaddy had to apologise publicly after a test that promised its staff a holiday bonus that did not exist.

Never cross into real fraud. No exercise should move money, ask for real bank or personal details, install code that collects information from the device or target employees' personal accounts, devices or social media. Attachments must be inert and landing pages unable to store what is typed. Calls and text messages go only to corporate numbers and within working hours.

Can you discipline employees who fall for the simulation?

It is the most frequent question and the short answer is that you should not, for legal and practical reasons.

Legally, Article 58 of the Workers' Statute allows employers to sanction breaches of work duties according to the grading of offences in the law or the collective agreement, and every sanction can be challenged before the employment courts. Falling for a deception the company itself designed to be convincing hardly amounts to a culpable breach, unless there was a clear, known instruction the employee ignored. And if staff were told the results would be used for training, using them later for discipline clashes with the purpose limitation principle (Art. 5(1)(b) GDPR). We are not aware of settled Spanish case law on sanctions arising from phishing simulations, so any decision in this area should go through employment counsel first.

In practice, punishment has the opposite effect: people stop reporting suspicious emails for fear of exposing themselves, and fast reporting is what lets you contain a real phishing attack before it spreads. What works:

Short, immediate training after the click, without an accusatory tone.
Training follow-up for repeat clickers, not a disciplinary file.
Recognition for the teams that report the most.
Keeping simulations separate from real incidents: gross negligence in a real incident is handled through the ordinary disciplinary route, with its own safeguards, not with data from the exercise.

Dos and don'ts

A summary of the decisions that weigh most on whether a campaign is lawful:

Do	Avoid
State in the security policy that periodic exercises will take place	Announcing the date or the pretext
Rely on legitimate interest or the monitoring power, with the balancing test in writing	Asking each employee for individual consent
Present the programme to workers' representatives before starting	The works council finding out from staff complaints
Record only the "credentials submitted" event	Storing passwords, even encrypted
Reports aggregated by department	Named rankings or lists of who fell for it sent to line managers
Plausible pretexts with fictitious or authorised brands	Impersonating the Tax Agency, Social Security or real brands without assessing it
Immediate, positive training after the click	Sanctions, humiliation or public call-outs
A processing agreement with the provider	Platforms with no contract or control over where data ends up

Checklist before launching the campaign

Before the first email goes out, each area should have signed off:

Management: written approval of the programme, its scope and the commitment not to use results for discipline.
HR and employment counsel: review of the collective agreement, the digital devices use policy and the communication to staff; a decision on external staff with corporate accounts (subcontractors, temporary agency workers), whose employment relationship is with another company.
DPO or data protection lead: lawful basis and balancing test, entry in the record of processing, privacy notice, retention periods, decision on the impact assessment and contract with the provider.
Workers' representatives: presentation of the programme, time for their report and, ideally, an agreed scope (channels, frequency and excluded pretexts).
IT and security: allowlisting in the email gateway and link filters so the campaign arrives and does not generate false clicks, a heads-up to the SOC or helpdesk so they do not treat it as a real incident, a stop procedure and a check that the report button works.
Provider: signed processing agreement, password capture turned off, inert attachments and a deletion plan at the end.

All of the above is general information based on the rules in force as of October 2026 under GDPR and Spanish law, and it is not a substitute for legal advice: every company has its own collective agreement, internal policy and context, so review it with your DPO and employment counsel before the first campaign.

FAQ

Do I need each employee's consent to run a phishing simulation?

No, and it is not advisable. The EDPB considers that consent at work is rarely freely given because of the dependency between employer and employee, and asking for it would announce the exercise. The usual approach is to rely on a legitimate interest in security or on the monitoring power in Article 20(3) of the Spanish Workers' Statute, with a documented balancing test and staff informed.

Do employees have to be told before a phishing simulation?

They must be told that the company runs periodic exercises, what they are for, what data is recorded and who sees it, usually in the security policy and the employee privacy notice. What is not announced is the date or the pretext, because that ruins the measurement. The scope is best agreed with HR and workers' representatives.

Do I have to inform the works council?

It is the prudent course. The Spanish Data Protection Act (LOPDGDD) requires digital device use criteria to be drawn up with workers' representatives, and the Workers' Statute gives the works council the right to a prior report on work control systems and training plans. Where there is no works council, staff delegates have the same powers.

Can I discipline an employee who falls for the simulation?

It is not advisable. Falling for a deception designed to be convincing is hardly a culpable breach, using data collected for training to sanction someone clashes with the purpose limitation principle, and punishment makes staff stop reporting. Before any disciplinary step, check with employment counsel.

Can I use a bank's or the Tax Agency's logo in the fake email?

It is best avoided or at least assessed first: it may raise trademark issues, the domain may be blocked or reported by the owner and, with public bodies, you teach staff to distrust genuine official communications. Plausible fictitious brands, internal services or suppliers who authorise it in writing give equally useful results.

What data can I keep and for how long?

The events needed to measure: delivery, click, credentials submitted (the event only, never the password), attachment opened and reports. Individual data is kept as long as the campaign's follow-up training requires and then reduced to aggregate figures per campaign and department.

Do I need a data protection impact assessment?

Not always. A campaign with minimal data and aggregated results is not usually high-risk processing, but it can become so if individual profiles are built and matched against performance reviews or it is combined with other monitoring systems. Decide with your DPO and document the decision.

Sources

Plan a phishing simulation with the right safeguards