Internal or external whistleblowing channel: what Spain’s Law 2/2023 says and which to choose in your SME

When a Spanish SME reaches 50 employees and has to set up its whistleblowing channel, the first doubt is usually one of vocabulary: internal or external whistleblowing channel, which one to choose? The question hides two different things. On one hand, Law 2/2023 distinguishes the internal channel the company must have from the external channel run by the Independent Whistleblower Protection Authority, and the informant may use either. On the other, the company itself may manage its internal channel in-house or entrust it to an external third party. This article clarifies both, summarises what the law requires of the internal system and explains which option fits depending on the company’s size and structure.

Two channels, two roles: the company’s internal one and the Authority’s external one

Law 2/2023 of 20 February, which transposes the EU Whistleblower Protection Directive, organises reporting of infringements along two routes:

The internal channel (Title II). Every company with 50 or more workers must have one, as must all public administrations and certain entities such as political parties or foundations receiving public funds. It is the organisation’s own system: it receives reports, investigates them and resolves them. The law treats it as the preferred route, because it allows the problem to be corrected where it occurs.
The external channel (Title III). It is run by the Independent Whistleblower Protection Authority, which has operated the State external channel since 1 September 2025, and by the regional authorities created for the purpose. The informant may go to it directly or after using the internal channel, and enjoys the same protection against reprisals.

The company does not choose between these two: it must have the internal one, and the external one exists regardless of what it does. What it does decide is how to organise its own.

What the law requires of the internal channel

Whoever manages it, the internal reporting system must comply with articles 5 to 9 of the law:

Approval by the governing body and appointment of a System Manager, whose identity is notified to the Authority.
Accessible channels in writing, verbally or both, with the possibility of an in-person meeting if the informant asks, and acceptance of anonymous reports.
Confidentiality of the identity of the informant and of any third party mentioned, and data protection under the GDPR, with access restricted to authorised staff.
A published management procedure: acknowledgement of receipt within a maximum of seven calendar days, a response period of three months extendable by another three in especially complex cases, communication with the informant and a register of reports received.
Visible information on the internal channel and on the Authority’s external channel, on the company website and intranet.
Prohibition of reprisals and guarantees for the informant and the person concerned.

Companies with between 50 and 249 workers may share the system and resources for handling reports, respecting confidentiality. And article 6.3 opens the door to the second decision in this article: the system “may be managed within the entity itself or by turning to an external third party”.

In-house management or outsourced management: the decision that is yours

Managing it within the company

The company appoints the System Manager from among its staff (compliance, legal, management) and handles reports with its own or a contracted platform.

For: knowledge of the business, speed to investigate and correct, contained cost. Against: in an SME it is hard to guarantee the manager’s independence from whoever may be reported, and confidentiality suffers when the person receiving the report shares a corridor with the informant and the person reported. It also requires specific training and availability to meet deadlines.

Entrusting management to an external third party

A law firm, a compliance consultancy or the platform provider receives the reports, performs the first analysis and coordinates the investigation with the company, which remains responsible for resolving.

For: perceived and real independence, stronger confidentiality, legal knowledge of the procedure and compliance with deadlines without depending on an internal person. Against: additional cost, the need for a data-processor agreement and a clear protocol on what the third party decides and what the company decides. Legal liability is not outsourced: it remains with the organisation.

How to decide

SME of 50 to 100 employees with no compliance department: outsourced management or, at least, external receipt of reports is usually the most realistic way to guarantee independence and deadlines.
Company with a compliance or legal area separate from operational management: in-house management with a platform that ensures anonymity, encryption and traceability.
Group of several SMEs: a shared system among those with fewer than 250 workers, with one manager per entity.
In every case, the platform must allow anonymous reports, encrypt identity, record each step of the case with its deadlines and produce the report the Authority may request.

How LapsoWork solves it

LapsoWork’s whistleblowing channel is designed for both forms of management:

Anonymous, encrypted reports: the informant decides whether to keep their identity private and the channel manager sees only what the informant authorises.
Traceable case file: each report opens a case with acknowledgement of receipt, legal deadlines, replies and final resolution.
Branded internal channel or external management: a custom portal run by your System Manager, or outsourced management as an independent external channel.
Compliant with Law 2/2023: protocol, deadlines and procedure designed to the rule, with publication of the channel on the company website.
Ready in 48 hours, from €299.99 a year plus VAT, as an add-on to the HR platform.

See the details on the whistleblowing channel page. And if you first want to know whether your company is obliged, we have the guide on the mandatory whistleblowing channel and the article on the whistleblowing channel procedure.

What happens if you do not have one

Not having an internal reporting system is a very serious infringement of Law 2/2023, punishable for legal entities with between €600,001 and €1,000,000, plus a public reprimand and a ban on subsidies for up to four years. Serious infringements range from €100,001 to €600,000 and minor ones from €1,001 to €100,000. We detail it in penalties for not having a whistleblowing channel.

Frequently asked questions

What is the difference between the internal and the external whistleblowing channel?

The internal channel is the reporting system a company with 50 or more workers must have to receive, investigate and resolve reports of infringements. The external channel is run by the Independent Whistleblower Protection Authority or the corresponding regional authority, and the informant may go to it directly. The company is obliged to have the internal one and to inform about the existence of the external one.

Can an SME entrust its whistleblowing channel to an external company?

Yes. Article 6.3 of Law 2/2023 allows the internal system to be managed within the entity or by turning to an external third party. Responsibility remains with the company, which must appoint a System Manager and sign the corresponding data-processor agreement with the third party.

Does the informant have to use the internal channel first?

No. The law treats the internal channel as preferred, but the informant may go directly to the Authority’s external channel, or do so after using the internal one, without losing protection against reprisals.

What are the whistleblowing channel deadlines?

Acknowledgement of receipt within a maximum of seven calendar days of receipt, and a response to the informant within a maximum of three months, extendable by another three in especially complex cases. The system must register reports and keep the data only for as long as the investigation requires.

Which companies must have a whistleblowing channel?

Those with 50 or more workers, all public administrations and certain entities such as political parties, trade unions, employers’ organisations and foundations receiving public funds, as well as those in the financial sector regardless of size. Those with 50 to 249 workers may share the system.

Conclusion

Law 2/2023 does not let you choose between an internal and an external channel: the external one is run by the Authority and you must have the internal one if you exceed 50 employees. What you do choose is whether you manage yours within the company or with an independent third party, and the answer depends on whether you can guarantee independence, confidentiality and deadlines with your own staff. Whichever option, you need an anonymous, encrypted, traceable platform. You can have one in 48 hours with LapsoWork’s whistleblowing channel.