Spain's Law 2/2023: how to comply with an internal whistleblowing channel

Law 2/2023, of 20 February, on the protection of persons who report regulatory breaches and on the fight against corruption, requires every company in Spain with 50 or more employees to have an internal whistleblowing channel. This isn't a best-practice recommendation: it's a legal obligation, and failing to meet it is penalised as a very serious infringement.

The law transposes the EU Whistleblowing Directive (EU) 2019/1937, and its implementation deadlines have already passed: June 2023 for companies with more than 250 employees and December 2023 for those with 50 to 249. Even so, many SMEs still have no channel at all — or run one on a generic email inbox that doesn't meet half the legal requirements.

What a whistleblowing channel is and what the law demands

A whistleblowing channel — also called an ethics channel, and referred to in the law as the internal information system — is the mechanism that lets people report regulatory breaches and misconduct within an organisation confidentially or anonymously: workplace or sexual harassment, fraud, corruption, discrimination, conflicts of interest or environmental breaches.

The logic behind Law 2/2023 is straightforward: if someone spots an irregularity, they must be able to report it without fear of retaliation and with the guarantee that it will be investigated within a set timeframe. That's why the law doesn't just require an inbox to exist — it regulates who manages it, how quickly you must respond and how the whole process is documented.

Which companies must have a whistleblowing channel

Organisations covered by Law 2/2023

• All private companies with 50 or more employees, regardless of sector.
• Regardless of size: financial services firms, entities subject to anti-money-laundering rules, and those in transport safety and environmental protection.
• Political parties, trade unions, employers' organisations and foundations that receive or manage public funds.
• The entire public sector: public administrations, public bodies, independent authorities, public universities and companies with majority public ownership.

One nuance that often gets overlooked: companies with 50 to 249 employees may share resources for handling investigations, and can even outsource the running of the channel to a third party. What they can't do is delegate accountability — the company remains responsible for compliance.

The requirements the channel has to meet

This is where most improvised channels fall short. The law doesn't just require a way to get in touch — it requires a system with specific, verifiable safeguards.

Legal requirements of the internal information system

• Confidentiality: it must protect the identity of the reporter, the person concerned and any third party mentioned in the report.
• Anonymity: the system has to allow reports to be submitted without identifying the reporter, and keep the follow-up dialogue open with an anonymous informant.
• Open to third parties: not only to staff, but also to former employees, job candidates, interns, freelancers, suppliers, contractors and shareholders.
• A designated System Officer, appointed by the governing body, who acts autonomously and independently.
• A channel policy approved by the governing body, after consulting the employees' legal representatives.
• A register of reports received, kept confidential and made available to the competent authority on request.
• GDPR compliance and compliance with Spanish data protection law throughout, involving the data protection officer where there is one.
• An accessible, documented procedure explaining the available channels, the reporter's rights and the consequences of knowingly false reports.
• An express ban on retaliation against the reporter and the people around them.

The deadlines you cannot miss

Law 2/2023 sets a strict timetable from the moment a report comes in. Losing track of these deadlines is one of the most common ways to fall out of compliance without realising it.

The timeline of a report

• 7 calendar days to send the reporter an acknowledgement of receipt.
• 10 working days to decide whether the report is admitted for processing.
• 5 working days to notify a rejection, with reasons, if the report isn't admitted.
• 3 months at most to close the investigation, extendable by another 3 months in especially complex cases, with the reporter informed of the extension.

The System Officer: who runs the channel

The governing body must appoint an individual — or a collegiate body — as the officer responsible for the internal information system. They must carry out their duties autonomously and independently, cannot be instructed on how to handle each case, and their appointment is notified to the competent authority.

A very common practical problem in SMEs shows up here: if the channel is run by the same person who heads HR and the report concerns a team leader in their department, impartiality is compromised. That's why it helps to be able to appoint several officers and case handlers and distribute cases by report type, with restricted access to each file.

Protecting the reporter and the ban on retaliation

The heart of the law isn't the inbox — it's the protection. The law prohibits any form of retaliation against the reporter for two years after the investigation ends, including dismissal, changes of role or duties, denial of training, harassment, discrimination or any unfavourable treatment.

It is for the company to prove that the measure taken was justified and unrelated to the report made.

That reversal of the burden of proof is decisive: if an employee who filed a report is dismissed months later, it is the company that has to show the decision had nothing to do with the report. Without documentary traceability — dates, case files, reasoned decisions — that evidence is virtually impossible to build.

Protection also extends to the people around the reporter: family members, colleagues, legal representatives and entities connected to the person who reported the breach.

Penalties: what a company without a channel risks

Not having a whistleblowing channel when you're required to, or preventing one from working properly, is a very serious infringement. The penalty regime under Law 2/2023 is one of the toughest in Spanish compliance law.

Penalty amounts

• Minor infringements: up to €10,000 for individuals and up to €100,000 for legal entities.
• Serious infringements: from €10,001 to €30,000 for individuals and from €100,001 to €600,000 for legal entities.
• Very serious infringements: from €30,001 to €300,000 for individuals and from €600,001 to €1,000,000 for legal entities.
• Additional penalties in very serious cases: publication of the penalty, and a ban on contracting with the public sector and on receiving subsidies for up to 3 years.

On top of that comes the indirect cost: an irregularity that finds no internal channel ends up surfacing through the authority's external channel, through the Labour Inspectorate, or straight through the press. If you want a sense of the scale of employment-related penalties in Spain, you can use our penalty calculator.

Why an email address isn't a whistleblowing channel

The most common improvised solution is to set up an address like reports@company.com and call it done. It isn't — and the reason becomes obvious as soon as you hold it up against the legal requirements.

What an email inbox cannot guarantee

• No real anonymity: the sender's address, email signature and metadata identify the reporter.
• No deadline control: nobody warns you that the acknowledgement is due in two days or that a case is about to hit three months.
• No register and no audit trail to prove to the authority what was done and when.
• No separation of access: anyone with the inbox password reads every case, including the ones they're involved in.
• No anonymous reply route: if the reporter stays anonymous, the case handler can't go back for clarification.

How to comply with Law 2/2023 using Horalia's whistleblowing channel

Horalia includes a whistleblowing channel built into the same platform where you already manage working time, absences and employment paperwork. There's no second tool to buy and no project to run: you switch it on in the settings and publish the link.

Everything the law requires, solved in the platform

• A guided form organised by category — harassment, fraud, corruption, discrimination, conflicts of interest or environmental breaches — accessible from a phone or a computer.
• Anonymous or identified reports, at the reporter's choice, with a tracking code to follow the case and answer the handler without revealing their identity.
• As many officers and case handlers as you need, each with restricted access to their own files.
• Automatic alerts for the 7-calendar-day acknowledgement and for the 3-month deadline.
• An exportable register and a tamper-proof audit trail to prove compliance to the competent authority.
• End-to-end encryption, servers located in the European Union and automatic deletion of data once it is no longer needed.

And because compliance doesn't stop at the ethics channel, the same platform covers mandatory time tracking, absence management and document management with electronic signature. Discover Horalia or try it for free and have your channel live the same day.