Law 2/2023, of February 20, regulates the protection of persons who report regulatory violations through whistleblower channels. Known as the ‘Whistleblowing Law’, it establishes which private sector entities are obliged to implement an internal reporting system. It applies to companies with 50 or more employees, political parties, trade unions, business organizations, among others.

On the other hand, the second paragraph of the same article indicates that those companies that are not bound by the obligations imposed in Article 10. They may establish their own information system, as long as they comply with the provisions of the law.

For these companies, there is a wide range of formats for implementing their whistleblowing channels. For example, web portal, mail, telephone, mailbox, or even through a designated person. All of them, however, must comply with the minimum requirements of the law.

whistleblower channel

What Are the Whistleblower Channel Requirements?

Information: The channel procedure must be clearly defined. It should establish the person in charge of managing the complaints. As well as the steps to follow in each of the complaint procedures by means of a protocol.


It is recommended that all interested companies enable more than one whistleblower channel. This is so that workers can report irregularities in writing or verbally. They can identify the most appropriate model of the system depending on the circumstances of each company.


If the company chooses to appoint an internal whistleblower system manager(s), the Independent Whistleblower Protection Authority must be notified of their appointment and removal. In addition, this person will have to comply with certain minimum functions. For example, sending notifications, maintaining communications with the complainant, and transmitting the relevant information to the Public Prosecutor’s Office.

The company may choose to designate a collegiate entity to manage the complaints channel. It must choose an employee to manage and process communications with this entity, in accordance with the second paragraph of Article 8.

Accessibility: The whistleblowing channel(s) must be fully accessible to all workers, regardless of whether they work in the office or at home. All employees should have the same right to denounce irregularities within the company.

What Other Whistleblower Channel Requirements Are Imposed?

Communication: The company has to communicate clearly to employees about the implementation of a whistleblowing channel. They must state the procedure and the security guaranteed to those employees who wish to use this system.

Confidentiality and security: The confidentiality and protection of the complainant must be guaranteed at all times. This includes at the time of the complaint, as well as during the processing and in all communication with the competent bodies or authorities. All data and information provided by the complainant must be securely stored and kept confidential at all times.

It should be noted that the subsidiaries of multinational groups with commercial activity in Spain are also obliged to comply with the mandates imposed by the first paragraph of article 10 of the aforementioned law.

It is recommended that all interested companies enable more than one whistleblower channel. This is so workers can report irregularities. They can do so in writing or verbally, identifying the most appropriate model of the system depending on the circumstances of each company.

The company may choose to designate a collegiate entity to manage the complaints channel. However, it must choose an employee to manage and process communications with this entity, in accordance with the second paragraph of Article 8.