Country：西班牙 · Employment & Visas
Spain · Employment & Visas
In May 2025, the RD 1155/2024 reform substantially relaxed rules for non-EU workers: the first work permit is valid 1 year, renewals up to 4 years, and 5 consecutive years of residence qualify for long-term residence. The 2025 minimum interprofessional wage (SMI) rose to €1,184/month (14 payments). Employer social security is about 29.9% plus occupational accident insurance, and employees about 6.35%. The digital nomad visa requires 200% of SMI (about €2,762/month); the golden visa was abolished in 2025. For Chinese company postings, the Spanish employer must first obtain a work authorization.
Key points
- 2025 reform (RD 1155/2024, effective 2025-05-20): first non-EU work permit valid 1 year (previously some only 6 months); renewals up to 4 years (previously 2); 5 consecutive years of residence qualify for long-term residence (up to 10 years).
- SMI 2025: €1,184/month (14 payments) or €1,381/month (12 payments); some sector collective agreements set higher standards.
- Employer social security: general regime about 29.9% plus occupational accident insurance (about 1.5%); employees about 6.35% (both deducted from gross wages and paid by the employer).
- Work visa routes: ordinary employment (employer obtains work authorization first → employee applies for visa abroad → TIE foreigner ID within 30 days of entry); highly qualified/EU Blue Card (€40,000 technical posts / €54,000 management posts); ICT intra-company transfer; digital nomad visa (200% SMI).
- Digital nomad visa: income ≥ 200% SMI (about €2,762/month), renewable to 5 years after the first year, enjoys the Beckham Law preferential rate (24% for the first 6 years).
- Golden visa: officially abolished in 2025; existing ones can be renewed.
- Standard working hours 40 hours/week; statutory minimum annual leave (often 30 days in collective agreements); a 37.5-hour standard week is proposed for 2025, pending approval.
Procedure
- The Spanish employer must register with the social security and labor authorities and obtain eligibility to recruit foreign employees.
- The employer applies for work authorization with the provincial foreigners office (Oficina de Extranjería) (ordinary posts must first compare against the shortage occupation list, which can waive the labor market test).
- The employee applies for a work and residence visa at the Spanish consulate in the home country within 1 month.
- Obtain the TIE foreigner ID within 30 days of entry.
- The employer must register the employee for social security (Seguridad Social) before the first day of work.
Hard requirements
- Employer work authorization.
- Employee NIE/visa/TIE.
- Social security registration and wage compliance (SMI).
- Highly qualified/EU Blue Card salary thresholds.
Costs
Visa and TIE fees (€60–80+).Employer social security about 30%+ of wages.Immigration lawyer/gestoría assistance fees.⏱ ⏱ Timeline：Work authorization takes 1–3 months; visa processing 20–45 days (highly qualified) or 3–6 months (ordinary); TIE must be obtained within 30 days of entry.⚠ Common risks
- Ordinary work authorization approval is slow (1–3 months), lengthening posting cycles
- Starting work without a TIE or social security registration is a violation
- Golden visa abolished, narrowing investor-immigration routes
- Rising SMI increases labor costs
Handbook
📘 Step-by-Step Handbook (with owner / timeline / cost / penalties)
Applies to：Chinese-funded entities in Spain hiring non-EU (including Chinese) employees must obtain work authorization, visas, TIE, and social security registration per RD 1155/2024 (effective 2025-05-20).
Prerequisites
- The Spanish employer is registered with the social security and labor authorities and is eligible to recruit foreign employees
- A valid employment contract is prepared (meeting SMI and duration requirements)
- The employer maintains clean AEAT and TGSS records (no tax or social security arrears)
- The applicable route is identified (ordinary employment, highly qualified, EU Blue Card, ICT, digital nomad)
| Step | Action | Owner | Timeline | Cost | Official form / system | Notes & penalties |
|---|---|---|---|---|---|---|
| 1 | Spanish employer registers eligibility to recruit foreign employees. The Spanish employer is registered with the social security and labor authorities and is eligible to recruit foreign employees. | Employer and TGSS | Registration immediate or within days | — | Employer social security and labor registration | Penalty：Employers without eligibility may not hire foreign labor. |
| 2 | Employer applies for work authorization. The employer applies for work authorization with the provincial foreigners office (Oficina de Extranjería) (ordinary posts must first compare against the shortage occupation list, which can waive the labor market test). | Provincial foreigners office (Oficina de Extranjería) | 1–3 months (ordinary); faster for highly qualified posts | Administrative fee (Modelo 790 cód.052, approx. €38–80, per published rates) | Work authorization application | Penalty：Hiring foreign workers without authorization is unlawful. |
| 3 | Employee applies for a work and residence visa at the Spanish consulate. The employee applies for a work and residence visa at the Spanish consulate in the home country (within 1 month). | Employee + consulate | 20–45 days (highly qualified) / 3–6 months (ordinary) | Visa fee | Work residence visa application | Penalty：Working without a visa is unlawful. |
| 4 | Obtain TIE foreigner ID within 30 days of entry. Obtain the TIE foreigner ID at the police station within 30 days of entry. | Employee + police | Within 30 days of entry | TIE card fee approx. €16 (per published rates) | EX-17 / TIE (Modelo 790 cód.012) | Penalty：Residence status becomes unlawful after the deadline. |
| 5 | Employer registers social security before the first day of work. The employer registers the employee for social security (Seguridad Social) before the first day of work; employer social security approx. 29.9% plus occupational accident insurance, employee approx. 6.35% (both paid by the employer). | Employer + Seguridad Social | Alta before starting work | Employer social security approx. 29.9% plus accident insurance; employee approx. 6.35% (both paid by the employer) | Social security registration (alta, TA.2 / TA.1) | Penalty：Starting work without social security registration is a violation and may lead to application rejection. |
| 6 | Wage compliance and minimum interprofessional wage (SMI). Wage compliance and minimum interprofessional wage (SMI): 2025 SMI is €1,184/month (14 payments) or €1,381/month (12 payments); some sector collective agreements set higher standards. | Employer | Ongoing | 2025 SMI is €1,184/month (14 payments) | Payroll | Penalty：Paying below SMI is unlawful. |
| 7 | Renewal and long-term residence routes. Renewal and long-term residence routes: first issuance 1 year, renewals up to 4 years, and 5 consecutive years of residence qualify for long-term residence (up to 10 years). | Employee + foreigners affairs authority (Extranjería) | First issuance 1 year, renewals up to 4 years, long-term residence at 5 years | Renewal fee | Renewal application | Penalty：Gaps may affect residence continuity. |
✅ Self-check list
⚠ Common pitfalls
Slow ordinary work authorization (1–3 months)影响：Longer posting cycles, order delays规避：Start early and prepare visa materials in parallel
Starting work without TIE or social security registration影响：Violation may lead to rejection or fines规避：Strictly obtain TIE within 30 days of entry and complete alta before starting work
Golden visa abolished影响：Narrowed investor-immigration routes规避：Use work visas, digital nomad visas, or entrepreneur visas instead
Rising SMI increases costs影响：Budget overruns规避：Budget compensation plans with headroom for SMI increases
Employer Hacienda/social security arrears影响：Work authorization rejected规避：Employer must maintain clean AEAT and TGSS records
Highly qualified salary threshold not met影响：Blue Card rejected规避：Salary contracts must reach €40,000 / €54,000
📅 Ongoing post-incorporation obligations
- Continue social security contributions and issue monthly payroll
- TIE renewal and long-term residence (5-year) applications
- Employer maintains AEAT/TGSS compliance (no violation records)
- Report work permit changes or employer changes promptly
- Annual employment ledger and minimum wage compliance review
🔗 Official portals
用工数据子模板
🔐 Employee Personal Data — GDPR Obligations (EU)
Benchmarked against the twin landmines Deel / Remote / Papaya-style EOR platforms keep hitting — 'worker misclassification + cross-border employee data'. This checklist turns the scattered GDPR employee-data obligations into do-this steps, not statute recitals.
Hiring an employee in any EU country (including via an EOR nominal employer, or by mislabeling someone as a contractor) triggers the full set of GDPR obligations over employee personal data. If the Chinese parent can access EU employee data, cross-border transfer (SCC) obligations stack on top. Misclassification does not change where data-protection responsibility sits under the factual employment relationship.
触发场景：Hiring employees in any EU country (DE / ES / GR), including via an EOR nominal employerMonitoring employees (attendance, email, CCTV, productivity software, GPS / field tracking)Transferring EU employee data back to China HQ or any non-adequacy third countryProcessing sensitive / special-category data (health, race, union, biometrics)Using contractors / freelancers who are in fact managed and controlled (misclassification risk)
Handbook
📘 Step-by-Step Handbook (with owner / timeline / cost / penalties)
Applies to：EU-member-state employers, EOR nominal employers, and Chinese parent / affiliate companies that can access EU employee data (as joint controllers or recipients).
Prerequisites
- Confirm the employment law relationship: employee / contractor / EOR — this decides who the current GDPR controller is
- Map the employee-data flow (collection points, storage location, whether it leaves the EU to China)
- If the Chinese company has no EU establishment, appoint an EU Representative under Art.27
| Step | Action | Owner | Timeline | Cost | Official form / system | Notes & penalties |
|---|---|---|---|---|---|---|
| 1 | Establish the legal basis for processing (Art.6) Do NOT rely on 'consent' as the primary basis for employee data (power imbalance makes it easily invalidated); use 'necessary to perform the contract', 'legal obligation', or 'legitimate interests' with a documented LIA balancing test. | DPO / HR + Legal | Finalize before onboarding | 0 | Records of Processing Activities (RoPA) | Penalty：Wrong basis: fines up to 2% of global annual turnover or €10M (whichever is higher) |
| 2 | Issue the Employee Privacy Notice (Art.13/14) Provide employees a privacy notice: purposes, legal basis, data categories, retention, cross-border transfer arrangements and how to exercise rights; in EOR setups disclose the joint-controller relationship and respective roles. | HR | On the first day of employment | 0 | Employee Privacy Notice | Penalty：Lack of transparency is a frequent enforcement trigger |
| 3 | Special-category data assessment (Art.9) Health, race, union membership, biometrics are prohibited in principle; if genuinely needed, rely on an explicit exemption and apply technical isolation and least-access. | DPO | Before processing | 0 | Data classification inventory | Penalty：Special-category breaches carry heavier fines (4% / €20M) |
| 4 | Employee monitoring & DPIA (Art.35) Any systematic monitoring (CCTV, email review, productivity tracking, GPS) requires a Data Protection Impact Assessment (DPIA); high-risk processing must be consulted with employee representatives / works council first. | DPO + Employee representatives | Before monitoring goes live | 0 | DPIA report | In Germany, consult the Betriebsrat (works council) in parallel Penalty：Failure to run a DPIA is a standalone penalty item |
| 5 | Cross-border transfer to China (Chapter V) China is not an adequacy country; transfers to HQ require Standard Contractual Clauses (SCC) plus a Transfer Impact Assessment (TIA), with supplementary measures (encryption / pseudonymization) where needed. | DPO + China Legal | Before first transfer | 0 | SCC + TIA | Mirrors the 'China data export' obligations in the data dimension Penalty：Unlawful transfer: fines 4% / €20M |
| 6 | Respond to employee data-subject rights (Art.15-22) Operate an access / rectification / erasure / portability / restriction (DSAR) channel, respond within 1 month; handle post-exit retention per policy. | DPO | Ongoing | 0 | DSAR workflow | |
| 7 | Appoint DPO and EU Representative (Art.37/27) If core activities involve large-scale systematic monitoring or special-category processing, appoint a Data Protection Officer (DPO); a Chinese company without an EU establishment must appoint an EU Representative. | Management | Before processing activities start | 0 | DPO appointment / EU Rep agreement |
✅ Self-check list
⚠ Common pitfalls
Relying on 'employee consent' as the processing basis影响：Under power imbalance, consent can be invalidated by the regulator, breaking the lawfulness of the entire processing chain规避：Use contract performance / legal obligation / legitimate interests, and keep the LIA on file
Mislabeling an employee as a contractor to dodge employer duties (Deel-type misclassification)影响：Under the factual employment relationship, both GDPR employee-data duties AND labor-law employer liability return; misclassification also triggers tax back-pay, social-insurance recovery and heavy fines规避：Determine the relationship by 'factual control'; in EOR setups sign a joint-controller agreement and clarify data flow and respective duties
China HQ reads EU employee data directly with no SCC影响：Constitutes an unlawful cross-border transfer, fines 4% / €20M规避：Sign SCC + complete TIA, with encryption / pseudonymization as supplementary measures
Monitoring employees without DPIA or works-council consultation影响：In high-regulation countries like Germany, easily triggers complaints and penalties, and poisons labor relations规避：Run DPIA before monitoring + consult the Betriebsrat / employee representatives
Unclear retention of ex-employee data影响：Over-retention violates the data-minimization principle规避：Define a retention schedule and destroy / archive on time
📅 Ongoing post-incorporation obligations
- Maintain RoPA (records of processing activities) continuously
- Re-assess transfer measures every 12 months
- Keep the data-subject rights channel running as business-as-usual
- Re-run DPIA on material processing changes (new system / new monitoring)
🔗 Official portals
📎 Source：GDPR (Reg. 2016/679) Art.6/9/13/27/30/33/35/37/44; EDPB employee-monitoring guidance; Germany BDSG and Betriebsrat co-determination rules. This card is an operational checklist, not legal advice — rely on counsel and official publications for implementation.
📎 Source：Spanish Immigration Law and Royal Decree RD 1155/2024 (effective 2025-05-20); Ministry of Social Security (Seguridad Social); Lexidy/Moving2Europe employment and visa guides
Want to turn this into an actionable compliance workflow?
CompliGo · Outbound Compliance Automation
You now have the essentials. Hand it to CompliGo: auto-generate compliance documents, real-time validation, and one-click regulatory alerts. Free trial for new users.
CompliGo is an independent SaaS operated by the outbound team. This knowledge base only drives acquisition and never handles funds or collects/pays on your behalf.