Ley 2/2023 whistleblowing channel: what it requires and how to comply

If you run an SME and the Ley 2/2023 whistleblowing channel (Spain’s whistleblowing law) still sounds like gibberish, you are not alone. This law requires thousands of Spanish companies to set up an internal channel so that employees and collaborators can report irregularities without fear of reprisals. In this article we explain, in plain language, what the law is trying to achieve, who it affects, what requirements it imposes and how to comply without making your life difficult.

Purpose of Ley 2/2023

Ley 2/2023, de 20 de febrero, which regulates the protection of people who report regulatory breaches and combat corruption, transposes into Spanish law the Directiva (UE) 2019/1937, better known as the whistleblowing directive.

Its purpose is twofold:

To protect anyone who decides to report an irregularity —fraud, corruption, serious regulatory breaches— from reprisals such as dismissals, penalties, changes of role or any unfavourable treatment.
To reinforce a culture of compliance and integrity within organisations, giving companies a preventive mechanism to detect and correct problems before they escalate.

In practice, the law seeks to ensure that reporting bad practice within a company stops being an act of personal risk and becomes a safe and confidential route.

Scope of the law

Ley 2/2023 reaches both the public sector and the private sector, and its protection is not limited to staff on the payroll. The law covers people who, in a work or professional context, have information about breaches:

Employees and self-employed workers.
Shareholders, partners and members of administrative or management bodies.
Contractors, subcontractors and suppliers.
Interns, trainees and volunteers, whether paid or not.
Candidates in selection processes or pre-contractual negotiation.
People in the whistleblower’s circle (relatives or colleagues who could suffer reprisals because of their connection).

This breadth is key: the law does not only protect those on a permanent contract, but the entire ecosystem of people who deal with the company.

Requirements imposed by the legislation

The law requires the affected organisations to have an Internal Information System that allows irregularities to be reported with full guarantees. The essential requirements are:

Confidentiality: the identity of the whistleblower and of any third party mentioned in the report must be protected.
Possibility of anonymous reporting: the channel must accept reports without the need to identify oneself.
Acknowledgement of receipt and response deadlines: the company must confirm receipt within a maximum of 7 days and respond within a period of no more than 3 months.
Secure recording of all reports, guaranteeing traceability without compromising privacy.
Appointment of a person responsible for the System (individual or collective) who manages the channel independently.
Express prohibition of reprisals against anyone who reports in good faith.

A suggestion box or a generic email account is not enough: the channel must meet technical and organisational requirements that guarantee security and data protection in line with the RGPD (Spain’s data protection regulation).

How do you comply with Ley 2/2023?

Check whether your company is required to comply

The obligation applies, among others, to private companies with 50 or more workers, to political parties, trade unions and employers’ organisations, and to all public sector entities. The adaptation deadlines have already passed:

Companies with 250 or more workers and public sector entities: the deadline expired in June 2023.
Companies with between 50 and 249 workers: the deadline ended on 1 December 2023.

This means that, as of today, any company subject to the obligation that still does not have its channel is out of time and exposed to penalties. The Autoridad Independiente de Protección del Informante (A.A.I., Spain’s independent whistleblower protection authority) can impose fines ranging from a few thousand euros for minor breaches up to €1,000,000 for very serious ones, in addition to other consequences such as a ban on contracting with the public sector.

Rely on specialist software

Setting up a homemade channel that complies with the law is more complicated than it seems: you have to guarantee anonymity, encrypt communications, monitor response deadlines and keep an auditable record. That is why the simplest and safest route is to rely on specialist software that already comes prepared for Ley 2/2023.

With LapsoWork you get a whistleblowing channel compliant with the regulation, with confidential and anonymous receipt, automatic acknowledgement of receipt, deadline control and secure recording of every report. And, by integrating with the rest of the people management modules —from time tracking to document management— you avoid having scattered tools for each legal obligation.

In summary

Ley 2/2023 is not an optional formality: it is an obligation with deadlines that have already passed and real penalties. If your company has 50 or more people and still does not have a compliant whistleblowing channel, the time to act is now. Setting up a system that complies with the law protects you as a company and the people who work with you, and reinforces a culture of transparency that today is a competitive advantage.