How to reduce fraud and share only the necessary information from a criminal record certificate

The criminal record certificate is an official document required to access employment, apply for nationality, sit for civil service examinations, or adopt. However, sharing the full certificate exposes sensitive information protected under the General Data Protection Regulation (GDPR), which explicitly prohibits private companies from processing data related to criminal convictions without a specific legal basis. This creates a persistent tension between the legitimate need for verification and the fundamental right to privacy.

Blockchain-based verifiable credentials provide an alternative that addresses both needs simultaneously. They make it possible to prove the absence of a criminal record through cryptographic verification without disclosing unnecessary information, thereby reducing fraud while safeguarding personal data.

The criminal record certificate is an official document issued by the Ministry of Justice that certifies the existence or absence of criminal records in the Central Registry of Convicted Offenders. It includes only final convictions imposed by judicial ruling in Spanish or European courts. It does not reflect administrative fines, traffic violations, or police records without a judicial conviction.

Its status as a public document with a presumption of authenticity makes it a common requirement in multiple contexts. It is requested for access to employment in sectors such as security, education, or financial services, where employers assess the suitability of candidates. Competitive examinations for police, administrative, and military bodies require it as a mandatory document.

It is also essential in adoption and foster care procedures, where it demonstrates the moral suitability of applicants. Residence and nationality applications require it without exception. Professional associations for lawyers, doctors, and other regulated professions include it among their admission requirements. It is even required for firearms licenses or the ownership of potentially dangerous animals.

However, it is important to note that this certificate does not attest to “good conduct” in a broad sense. Its scope is strictly limited to the absence of final judicial convictions, making it a specific and narrowly defined verification instrument that is nonetheless widely accepted both in Spain and internationally.

You can apply for a criminal record certificate through three main channels. The online option is the most recommended, as it is available 24 hours a day via the electronic headquarters of the Ministry of Justice and allows you to download the certificate immediately or within a maximum period of 24 to 72 hours.

The fee is €3.86 for all processing methods.he online process requires accessing sede.mjusticia.gob.es using an electronic ID (DNIe), digital certificate, or the Cl@ve system.

After completing the form, you pay the fee through the Spanish Tax Agency (AEAT) payment gateway and receive the certificate in PDF format with a secure verification code (CSV) that allows its authenticity to be verified

The in-person application is submitted at the Territorial Offices of the Ministry of Justice or at the Central Office in Madrid. It is mandatory to book an appointment in advance via telephone (060) or online. You must present a valid DNI or NIE, the completed Form 790, and proof of payment of the fee.

The postal option is available for those who do not have access to electronic means. You must send Form 790, a certified copy of your DNI or passport, and proof of payment to the Territorial Office corresponding to your autonomous community. From abroad, the certificate can be requested through Spanish consulates or by means of a legal representative with notarized power of attorney.

Sharing the full criminal record certificate entails significant legal and privacy risks. The GDPR explicitly prohibits private companies from processing data related to criminal convictions without a specific legal basis, even with your consent. By sharing the complete document, you expose sensitive information that may be stored indefinitely, become subject to security breaches, or be used for discriminatory purposes.

Article 10 of the GDPR establishes that the processing of data relating to criminal convictions may only be carried out under the control of official authorities. Spain’s Organic Law on Data Protection and Guarantee of Digital Rights (LOPDGDD) mirrors this prohibition for Spanish companies, without exception.

Consent is not a valid legal basis for a company to process this type of data. In employment contexts, there is no genuine alternative, since refusing effectively means losing the job opportunity. Moreover, Article 10 of the GDPR expressly prohibits relying on consent for processing data related to criminal convictions.

Specific risks include the irreversible datafication of the document, which may remain stored in corporate systems without guarantees of subsequent deletion. Security breaches in organizations with weak systems can expose highly sensitive information, including records that may have already been expunged but could still be misused for discrimination. Risk profiling based on such data lacks legal justification.

Verifiable credentials are digitally signed documents issued cryptographically by an authorized issuer that allow the holder to fully control what information is shared, when, and with whom. Unlike a traditional paper or PDF certificate, these credentials offer protection against forgery through irrefutable cryptography and automatic verification in seconds.

The mechanism involves three actors. The issuer, such as the Ministry of Justice, verifies and issues the digital credential. The holder stores it in a secure digital wallet and controls access to it. The verifier, whether an employer or public administration, validates its authenticity without needing to contact the issuer.

Fraud reduction is achieved through four cryptographic protections:

1. Immutability guarantees that any modification invalidates the credential immediately, making it impossible to alter without detection.
2. Instant verification allows the Ministry’s cryptographic signature to be validated in seconds.
3. Automatic validation means the software rejects altered or untrusted credentials.
4. Zero-knowledge proofs make it possible to prove assertions without revealing the underlying data, such as proving a “clean certificate” without showing the details of the record.

Citizens gain sovereign control over their data and can apply selective disclosure, sharing only the attributes required for each context. Verifiers confirm authenticity in real time, reduce operational costs, and improve trust in processes.

ISBE (Spanish Blockchain Services Infrastructure) facilitates the issuance, exchange, and verification of official certificates through blockchain technology with legal validity. It allows entities such as the Ministry of Justice to issue verifiable credentials in which the citizen maintains full control and can selectively share only the strictly necessary information.

ISBE is the first national Spanish blockchain infrastructure designed for public-private collaboration, with regulatory compliance built in by design. Its architecture allows the Ministry of Justice to issue digital credentials for criminal record certificates with legal validity under the eIDAS2 framework.

The process works in four steps.

1. The Ministry issues a verifiable credential that includes your criminal record status, the date of issuance, and a cryptographic signature.
2. You store that credential in your secure digital wallet, protected by passwords or biometrics.
3. When applying for a job, you present specifically “Clean certificate: Yes/No” without disclosing full details, or “No sexual offense record” without showing other data if any exist.
4. The employer validates the cryptographic signature in seconds without contacting the Ministry, with an automatic audit trail recorded.

The specific advantages for the citizen include that companies only record that the validation was successful, without storing a copy of the full document. Your credential has cross-border interoperability under the eIDAS2 framework, recognized throughout the European Union. ISBE automatically implements the GDPR data minimization principle through selective disclosure.

What is the time validity of a criminal record certificate?

A criminal record certificate issued in Spain is valid for 90 calendar days from the date of issuance. After this period, even if your status has not changed, most public administrations and employers require a more recent one to ensure the information is up to date. We recommend requesting it just before submitting it in the procedure that requires it, especially in immigration or citizenship processes where timing is critical.

Is a criminal record certificate the same as the certificate for sexual offenses?

No, they are completely different documents with separate registries. The general certificate includes all final convictions for any crime and costs 3.86 euros, while the certificate for sexual offenses reflects only sexual offenses, is free of charge, and has been mandatory since 2016 for working with minors. If you are going to work with minors in Spain, you specifically need the sexual offenses certificate, not the general one.

How can I legalize my certificate so that it is valid abroad?

You need the Hague Apostille, recognized in 129 countries that are parties to the 1961 Convention. When requesting your certificate online through the Ministry of Justice’s electronic headquarters, you can select the “Apostille” option and it is generated digitally in the same PDF at no additional cost. For countries that are not parties to the Convention, you will need to complete diplomatic legalization through embassies. If the destination country uses a language other than Spanish, you will also need a certified sworn translation.

Can a private company require me to present my criminal record certificate?

The general answer is no. A private company cannot legally require you to present your criminal records without a specific legal basis established by law. Article 10 of the LOPDGDD is explicit: it is not possible to require candidates to provide a certificate that may only be processed in exceptional cases authorized by law. There are exceptions for police forces, professions involving minors, and senior executives of financial institutions, but most companies do not have this legal basis.

What happens if my request to expunge criminal records is denied?

You will receive formal notice explaining the reasons for the denial, which are usually failure to meet the legal waiting period, commission of a new offense during the waiting period, or unpaid compensation. You have the right to submit a new request if circumstances change, request a review for administrative error, or appeal before the Ministry of Justice. In addition, if 3 months pass without an express decision, the request is deemed approved by administrative silence under Law 39/2015.