Occupational Risk Prevention in Spain (PRL)

What Is PRL (Prevención de Riesgos Laborales)?

Prevención de Riesgos Laborales (PRL) is Spain’s comprehensive occupational health and safety (OHS) framework. The primary legislation is Ley 31/1995 de 8 de noviembre de Prevención de Riesgos Laborales, supplemented by numerous sector-specific regulations and Royal Decrees covering specific risks (manual handling, display screen equipment, chemical agents, construction, noise, vibration, asbestos, etc.).

The law transposes EU Directive 89/391/CEE into Spanish law and establishes that employer obligations regarding worker health and safety are mandatory, non-delegable, and not waivable — even if the worker consents to a risk, the employer remains liable.

Core Employer Obligations

1. Risk Assessment (Evaluación de Riesgos)

The risk assessment is the foundation of all PRL activity. The employer must identify all risks present in the workplace, evaluate their severity and probability, and document the results. The evaluation must cover:

• Physical risks (noise, temperature, vibration, radiation)
• Chemical risks (exposure to hazardous substances)
• Biological risks (pathogens, in healthcare and food sectors)
• Ergonomic risks (repetitive strain, manual handling, display screen work, awkward postures)
• Psychosocial risks (work pace, autonomy, workplace violence, harassment, burnout)

The risk assessment must be reviewed when working conditions change, when a work accident or occupational illness occurs, or when health surveillance data indicates risk.

2. Prevention Plan (Plan de Prevención)

Based on the risk assessment, the employer must adopt a prevention plan that integrates safety management into the company’s general management systems. The plan describes:

• The organisational structure of prevention
• Who is responsible for PRL functions at each level
• The procedures for identifying, evaluating, and controlling risks
• The documentation and record-keeping system

3. Information and Training (Información y Formación)

Every worker must receive:

• Information on the risks specific to their job and workplace
• Training on how to perform their work safely

Training must be:

• Adequate for the specific role and risks
• Given at the start of employment, on transfer to a new role, on introduction of new equipment or processes, and when significant changes occur
• Paid by the employer and conducted during working hours
• Repeated periodically where required by sector regulations

4. Health Surveillance (Vigilancia de la Salud)

Employers must offer workers periodic health surveillance (medical check-ups). Health checks are:

• Voluntary for the worker (with narrow exceptions where the health check is essential to protect third parties — e.g., professional drivers, food handlers)
• Confidential: results are communicated only to the occupational health service and the worker; the employer receives only fitness-for-work conclusions (fit, fit with restrictions, unfit)

Health records are kept by the occupational health service, not the employer.

5. Emergency and Evacuation Plan

The employer must establish:

• Emergency procedures and evacuation plans
• Designation of first aid and fire prevention workers (trabajadores designados)
• Regular fire evacuation drills
• Coordination with emergency services

6. Accident Investigation and Notification

Every work accident must be investigated. Serious, very serious, or fatal accidents and collective accidents (involving 4+ workers simultaneously) must be notified to the ITSS (Inspección de Trabajo y Seguridad Social) within 24 hours via the DELTA (Declaración Electrónica de Accidentes de Trabajo) system.

All accidents (including minor ones) must be recorded and notified to the mutual insurance society (mutua) for Social Security processing.

Prevention Service Modalities

Employers must organise their prevention activities through one of four modalities:

1. Self-Management by the Employer (Asunción por el Empresario)

Available only to companies with fewer than 10 workers (or fewer than 25 in a single-location company), provided the employer works regularly at the workplace and has the required training (minimum 30-hour basic PRL course for low-risk companies). Cannot cover health surveillance.

2. Designated Workers (Trabajadores Designados)

The employer designates one or more workers to perform prevention activities. Designated workers must have the required PRL qualifications (basic, intermediate, or upper level depending on risk) and must be given sufficient time and resources.

3. Own Prevention Service (Servicio de Prevención Propio — SPP)

Mandatory for companies with 500+ workers, or 250+ workers in activities listed in Annex I of the RD (construction, mining, explosives, etc.). The SPP is an internal specialist unit covering at least two of the four prevention disciplines: safety, industrial hygiene, ergonomics/psychosociology, occupational medicine.

4. External Prevention Service (Servicio de Prevención Ajeno — SPA)

Most common for SMEs. An accredited external company (SPA) contracted to provide PRL services — risk assessment, training, health surveillance, technical advice. The employer remains ultimately responsible but delegates operational delivery to the SPA.

Joint Prevention Service (Servicio de Prevención Mancomunado)

Available to groups of companies or companies in the same industrial park or sector. A shared prevention service covering multiple employers.

Worker Rights Under PRL

Workers have:

• Right to information on risks, protection measures, and emergency procedures
• Right to training on safe work practices
• Right to stop work when they detect an immediate, serious risk that cannot be addressed through normal channels, and seek employer resolution (derecho de paralización)
• Right to participate in PRL through health and safety delegates (delegados de prevención) and Joint Health and Safety Committees (Comités de Seguridad y Salud)

Delegation of Prevention (Delegados de Prevención)

Companies with 6+ workers must have delegados de prevención — worker representatives with specific PRL functions. The number of delegates is proportional to the workforce size. In companies with 50+ workers, a Joint Health and Safety Committee (Comité de Seguridad y Salud) must be established, meeting at least quarterly.

Liability and Penalties

Administrative Penalties (LISOS)

Repeat infractions and accidents resulting in serious injury attract penalties at the higher end. Additional consequences:

• Recargo de prestaciones: A surcharge of 30–50% on all Social Security benefits arising from a work accident or occupational illness caused by lack of prevention measures. This surcharge is paid entirely by the employer, not covered by insurance.
• Exclusion from public procurement for companies with final penalties for very serious PRL infractions.

Criminal Liability

Where a PRL infraction leads to serious injury or death, criminal liability may follow under Articles 316–318 of the Spanish Criminal Code, for:

• Failure to provide prevention measures putting workers at risk of serious harm
• Causing harm through reckless disregard for PRL obligations

Company managers, directors, and PRL officers may be personally liable.

Frequently Asked Questions

Must self-employed workers (autónomos) comply with PRL? Autónomos who work alone have no specific PRL obligations toward themselves (no workers). However, when an autónomo works at a client company’s workplace or on a construction site, the coordinating company has obligations to ensure the autónomo is included in risk assessment and receives adequate information. Autónomos who employ workers must comply with full PRL obligations.

Does the risk assessment need to be updated every year? Not necessarily annually, but the law requires review when working conditions change, when an accident or occupational illness occurs, when health surveillance detects health risks, or when a court or ITSS inspection orders a review. Good practice recommends annual review even without triggering events.

Can a company outsource all PRL obligations to an SPA? No. The employer is always the responsible party. The SPA provides technical services but cannot replace the employer’s legal obligations. Signing an SPA contract does not exempt the employer from fines if the SPA’s services were inadequate or the employer did not implement the measures recommended.

What documentation must a company maintain for PRL? At minimum: risk assessment records, prevention plan, training records (signed by workers), health surveillance records, accident and near-miss reports, emergency plan, ITSS correspondence, and SPA or prevention service contracts. These must be available for inspection at all times.

Are there special PRL rules for remote workers? Yes. Ley 10/2021 (remote work law) extends PRL obligations to the remote workspace. The employer must conduct a risk assessment of the home office (typically via a worker self-assessment questionnaire validated by the occupational health service) and provide ergonomic guidance and equipment.