When a search is possible

Business owners in Spain often genuinely do not understand why Guardia Civil or Policía Nacional appeared at their office door. The most common reason is not their own guilt, but procedural logic: the company is listed as a legal entity under investigation, or its business partner is under investigation, and documents and devices are needed as evidence of transactions between the parties.

The second scenario involves tax matters: Agencia Tributaria through its Inspección discovers discrepancies in declarations or a scheme involving fictitious suppliers, and the case moves into criminal territory. The third scenario involves an employee complaint that has escalated into proceedings.

The fourth situation involves the company or person not being suspected at all, but merely as witnesses: a server belonging to a business partner is seized where your correspondence was also stored. Being a witness does not mean being guilty, but it does not always protect against a search of premises where evidence might remain. Understanding the scenario of the case determines the line of behavior—so the first step when investigators appear is not panic, but calling a lawyer.

Who has the right to conduct a search and seizure

A search and seizure of devices can be conducted by several authorities. General criminal proceedings are handled by Policía Nacional in cities or Guardia Civil in rural areas; where regional police operate, such as Mossos d'Esquadra in Catalonia. All of them act on the orders of the investigating judge and under the control of the juzgado de instrucción.

In tax cases, the key role is played by Agencia Tributaria and its Inspección: they gather evidence and, in case of signs of crime, pass materials to the prosecutor, after which police can join the seizure. At the scene, it is worth immediately noting who represents which structure and on what basis.

The first rule of any search: demand an ID from everyone who enters and the order that authorizes the action. A person without an ID has no grounds to be in the premises—state this loudly, and it will be recorded in the protocol.

The letrado de la Administración de Justicia—a court secretary—is responsible for the formal part of the procedure and certifies the legality of the action. Their presence matters for any subsequent appeal.

Court order: what it allows and what it does not

A search of premises—entrada y registro—is only possible on the basis of auto judicial, a reasoned order from the investigating judge. This is a constitutional requirement: a home—domicilio—is protected by Article 18 of the Spanish Constitution, and interference without the consent of the resident or a court order is an exception. For commercial premises, the regime is more lenient, but a standard court order still applies.

The order must contain the exact address, the case, the purpose of the search, the categories of items, and the time limits of the action—this is what you have the right to read at the threshold. An order for one location does not give grounds to search another office of the same company at a different address.

If the order does not explicitly mention computer equipment or cloud services, seizing these categories requires separate permission—this is why intervención de dispositivos often appears as a separate item in the order. A device seized without such permission can become the subject of a successful appeal.

Do not sign a document you have not read. You have the right to read the act in full, request a copy, and submit written comments to the protocol—precisely at the moment of signing, not later.

How to behave during a search

Your behavior in the first minutes affects the entire course of the case. The main rule is to call a lawyer before the search actually begins and inform the investigators that you are waiting for their arrival or consulting with them. A reasonable delay of a few minutes usually does not create procedural problems.

Physical resistance to investigators' actions or aggressive behavior does not protect your rights but creates grounds for obstruction charges. The strongest position is calm, documented fixation of every step.

If the search occurs at an office, employees should be instructed in advance: do not comment, immediately notify management and the company handling the case. Panic and contradictory statements without a lawyer often cause more harm than the fact of the search itself.

Search affects more than just business

The most important thing to understand: search and seizure of devices in Spain is not exclusively a story about offices and companies. The same procedure, the same authorities, and the same auto judicial can affect a private apartment, a car, a phone seized at a border crossing, or a family member's device who did not even know the case existed.

The difference between a business search and a home search is substantial precisely at the level of constitutional protection: domicilio is protected more strongly than commercial premises, so the basis for entering an apartment must be justified more carefully. When searching a home, it is even more important to carefully check whether the order concerns this specific address and residents.

A separate category is border control. A phone or laptop that you are asked to unlock at a border is legally in a completely different regime: different authorities apply and a different standard for what an official can demand from a person not even suspected of a crime.

A real situation arises when a business owner's search affects the wife's phone, an adult child's laptop who lives separately, or a friend's device who was visiting that day. Formally, these people may have no connection to the case, but their devices were physically in the premises under the order. It is worth immediately stating who owns each device and insisting that this be entered in the protocol.

Being a witness is also a procedural status that requires protection. A person may be summoned not as a suspect but as a witness in someone else's case, and this is where many refuse a lawyer, thinking they "don't need one as a witness". In practice, a witness is most easily giving testimony that will later affect themselves.

Practical advice for families where at least one member has a business in Spain: agree on a single lawyer contact for the entire family and a rule—when investigators appear, first call this lawyer.

Protecting phones, laptops and cloud accounts

This is not about obstructing a lawful search—that is both illegal and pointless, since obstruction only worsens a person's position. This is about ordinary hygiene that protects confidential information while the court decides which part of the data relates to the case.

The basic level is full disk and device encryption as a standard practice, not an emergency measure on the day of the search: it does not obstruct the lawful procedure but protects against leaks if a device is lost or copied in violation of procedure. The second level is two-factor authentication on work accounts. The third level is separating work and personal data: when one phone is used for both work and private life, its seizure affects personal correspondence unrelated to the case. A separate work profile narrows what gets seized.

Less data on a device means less risk regardless of the case outcome. A minimization policy—where only what is needed for current tasks is stored on a work device and the rest sits in a controlled cloud storage—reduces the volume that ends up in investigators' hands when one device is seized.

The fourth level is managed backups separate from primary devices. If a server is seized for weeks or months, a business with good backups continues working from backup infrastructure, while a company without this practice effectively stops on the day of the search.

The fifth level is protecting executives' devices from spy and stalker software: checking for hidden tracking apps, updating systems. It is also worth reducing the public digital footprint of business owners: less personal data in open sources means less material for pressure outside the case. All these measures are about keeping confidential information protected while the procedure determines what is subject to review, not about concealing or destroying evidence: such an attempt is a separate crime and almost always worsens a person's position.

What happens to seized devices

Each seized item—phone, laptop, server, disk—must be entered into a description with serial number and sealed in the presence of the owner or company representative. This act is the basis for subsequent actions, and a copy should be obtained immediately.

Equipment is sent for forensic examination, where experts make a data copy. A company or individual has the right to request a copy of working data without evidential value but needed for operation—accounting files, client databases. This right almost always requires a separate application through a lawyer.

The periods for holding seized property are not fixed in advance: property remains seized as long as it is needed for the case, in practice—months. The law provides two appeal instruments: recurso de reforma to the same judge requesting a review of the decision, and apelación—an appeal to a higher court. Both have clear deadlines, and missing them means losing the ability to challenge the measure.

Appealing the seizure itself is a separate action from appealing the case on the merits. You can agree that the investigation has the right to investigate the case and at the same time appeal the scope or method of device seizure—for example, if devices clearly unrelated to the subject matter were seized.

Equipment return accelerates when precise records are kept from day one: a copy of the seizure act, a list of serial numbers of company devices in advance—this allows you to quickly prove exactly what was seized.

How Dorosh & Partners helps

A search rarely happens without any prior warning: a check from Agencia Tributaria, a letter from a business partner about their own investigation troubles, a complaint from a former employee—all of this accumulates over years as "minor issues" until it grows into a criminal case. The first and underestimated service is an audit of search readiness before it happens: is documentation in order, do staff understand how to act, are data protection technical measures configured.

The second element is staff training: a brief briefing on who to call, what can and cannot be said, how to record investigators' actions. Companies where at least one employee knows these rules by heart get through the search day more calmly.

The third element, most practical in a moment of crisis, is the presence of a lawyer on site during the search or efficient remote support. The lawyer's role here is not to obstruct the investigators' lawful actions—that is impossible and harmful—but to verify the order's scope, require correct preparation of the act, and record every procedural violation that will later become grounds for appeal.

This is where the power of the lawyer plus advocate pairing that Dorosh & Partners applies in cases involving court and criminal proceedings in Spain becomes apparent: the client speaks to the lawyer in plain language, and the lawyer translates the situation into legal language for the advocate—abogado—who directly represents the client's interests in the process—and steers them to where the client really needs results. The lawyer controls the advocate's work, tracks the deadlines for recurso de reforma and apelación, and keeps the case moving.

The fourth element is business recovery after device seizure: support for applications for copies of working data and equipment return, interaction with banks and business partners, coordination with IT specialists for restoring work on backup infrastructure. A company with structured support returns to work many times faster than one sorting things out on its own.

These principles apply equally to business and individuals: a business owner wanting to protect their structure in advance will find more detail on the business in Spain page, while someone undergoing legalization and wanting to understand how a criminal or tax case will affect residency status will find it on the migration and legalization in Spain page. A general overview of the firm's work is collected on the Dorosh & Partners in Spain page. Companies wanting to verify readiness for investigators' appearance will find an article about business inspections in Spain useful, while those whose case has already reached court will benefit from material about court and criminal cases in Spain, which explains the role of the lawyer plus advocate pairing.

Regardless of the stage of the case—an early warning, the search day itself, or already seized equipment that needs to be returned—a consistent legal position recorded from the first moment remains the most effective tool for protecting the client's interests.

Questions and answers

Can I refuse investigators entry to the premises?

If the investigators have a valid court order—auto judicial—that permits entrada y registro of the premises, there is no lawful basis for refusing entry, and physical resistance will only worsen your situation. Your right is to verify the document, ensure it concerns this specific address and case, and call a lawyer before the action begins.

Can they seize my personal phone if the search concerns the company?

If the device is physically in the premises stated in the order and the investigation believes it may contain data relating to the case, seizure is possible even if the phone is formally personal. This is why it is important to immediately state who owns each device and insist that this be recorded in the protocol.

What should I do if I am called only as a witness?

Witness status does not eliminate the need for legal support: a witness can give testimony that will later affect them or related persons. The right to a lawyer's presence should be used regardless of procedural status.

How long can the investigation hold seized equipment?

There is no predetermined period: the property remains seized as long as there is procedural necessity. This is why it is important to immediately file applications for copies of working data and assess the grounds for recurso de reforma or apelación against the measure itself.

Will disk encryption help hide data from the investigation?

No, and the purpose of encryption is entirely different: it is a practice of protecting confidential information from unauthorized access—theft, device loss, leaks—not a way to obstruct the lawful procedure. The investigation acts within the scope of the court permit, while attempting to destroy or conceal information during a lawful search is a separate crime and almost always worsens a person's position.

Cases involving search and seizure of devices in Spain rarely come down to a single day: behind the formal procedure lies months of investigation, several levels of appeals, and real consequences for business and family, so consistent legal support from the first sign of danger matters as much as behavior on the search day itself.

Матеріал має інформаційний характер і не замінює юридичну консультацію.