The Pegasus spyware case, revealed in July 2021, also impacted Spanish politics when a report produced by Citizen Lab denounced that Catalan independentists had been surveilled using this software. The scandal — known as Catalangate — highlighted the need for a thorough audit of these surveillance capacities in the hands of the Spanish intelligence service. Using Catalangate as a case study, this article analyses whether Spanish mechanisms for controlling the surveillance capacities of the National Intelligence Centre (CNI) have followed the procedures established in Spanish legislation. Our conclusion is that the Spanish control system worked effectively. When the Parliamentary committee was unable to fulfill its duties, another actor within the democratic system, the Ombudsman, filled that gap. Secondly, the article analyses if Spanish control mechanism meets the more recent standards of case law from the European Court of Human Rights (ECHR), and the Court of Justice of the European Union (CJEU). This case law emphasises the importance of procedural guarantees for legitimising both bulk and targeted surveillance procedures, showing the need for potential improvements in Spanish regulations.