What is a whistleblowing channel and how does it work in your company?

More and more Spanish companies are hearing the same message from their advisers: “you need to have a whistleblowing channel.” But what exactly is it? Is it only there to “report on” colleagues? Is it mandatory for your business or only for large corporations? In this guide we explain, without the legal jargon, what a whistleblowing channel is, how it works, what Ley 2/2023 requires and what you stand to lose if you fail to put one in place.

What is a whistleblowing channel?

A whistleblowing channel is an internal mechanism that allows anyone to report suspected malpractice, irregularities or breaches committed within an organisation, confidentially and, if they wish, anonymously. We are talking about conduct such as fraud, corruption, workplace harassment, regulatory non-compliance, safety risks or any illegal action or behaviour that goes against the company’s ethics.

Its purpose is not to “police” the workforce, but quite the opposite: to provide a safe route so that a problem comes to light inside the company before it blows up outside (in an inspection, in the courts or in the press). A good whistleblowing channel promotes an ethical culture and protects, in equal measure, both the person who reports in good faith and the organisation itself.

Whistleblowing channel software

In practice, most companies no longer manage this with a physical suggestion box or an ordinary email account, but with whistleblowing channel software. These platforms make it possible to receive reports confidentially and securely, guaranteeing the whistleblower’s anonymity, logging every communication with a timestamp and making it easy to track each case through to resolution.

The advantage of a specialised tool is that it meets the technical requirements of the law by design: encryption, traceability, restricted access control, response deadlines and secure retention of the information. At LapsoWork we offer the whistleblowing channel integrated into the same environment where you already manage time tracking, holidays or your team’s documentation, so you don’t have to contract or maintain a separate system.

Why a whistleblowing channel matters for companies

Beyond the legal obligation, having a whistleblowing channel brings real benefits:

• It detects problems in time, while they are still manageable and not yet a crisis.
• It reinforces transparency and ethics within the organisation.
• It builds trust among employees, clients and partners, who see that there is a serious mechanism for reporting irregularities.
• It protects the company’s reputation by preventing internal conflicts from ending up in the public arena.

Legislation and requirements for whistleblowing channels in Spain

The whistleblowing channel has gone from being a good-practice recommendation to a legal obligation in Spain. Here is what you need to know.

Ley 2/2023 and whistleblower protection

The reference regulation is Ley 2/2023, de 20 de febrero (the Spanish law of 20 February 2023 governing the protection of persons who report regulatory breaches and the fight against corruption). This law transposes Directiva (UE) 2019/1937 on whistleblower protection (known as the whistleblowing directive).

Its core idea is to protect the person who raises the alarm. The law safeguards the whistleblower’s confidentiality and expressly prohibits reprisals (dismissals, penalties, detrimental changes of role, and so on) against anyone who reports in good faith. Oversight of the system falls to the Autoridad Independiente de Protección del Informante (A.A.I.) (the Independent Whistleblower Protection Authority), which can investigate and penalise breaches.

Which companies are required to have a whistleblowing channel?

The following entities, among others, are required to have an internal whistleblowing channel:

• Private-sector companies with 50 or more employees.
• Companies of any size in sensitive sectors, such as financial services, money-laundering prevention or transport and environmental safety.
• All public administrations and public-sector entities.
• Political parties, trade unions, employers’ organisations and foundations that receive public funds.

The adaptation deadlines set out by the law have already passed: companies with more than 250 employees were required to have it operational from June 2023, and those with 50 to 249 employees by 1 December 2023 at the latest. In other words: if your company falls within the scope of the law and still doesn’t have a channel, it is already past the deadline and exposed to penalties.

Operating and management requirements

The law is not satisfied with the mere existence of a suggestion box: it requires the channel to meet a series of requirements:

• Confidentiality and anonymity: it must guarantee the protection of the whistleblower’s identity and allow anonymous reports.
• Management procedure: acknowledgement of receipt within a maximum of 7 days and a response to the whistleblower within a maximum of 3 months.
• System manager: an independent person or team must be appointed to receive and process communications.
• Secure record-keeping: all reports must be documented and stored securely, in compliance with the RGPD.
• Protection against reprisals: mechanisms that guarantee that reporting has no negative consequences for those who do so in good faith.

Benefits of implementing a whistleblowing channel

Preventing and detecting irregularities

A whistleblowing channel enables the early detection of irregular conduct within the company. The sooner a problem is known —a harassment case, a fraud, a safety breach— the easier (and cheaper) it is to resolve. What’s more, acting in time can help avoid criminal liability for the company and its directors.

Compliance with other regulations

The whistleblowing channel doesn’t work in isolation. It fits naturally alongside other obligations you are probably already aware of: the criminal compliance programme, the RGPD on data protection, the rules on money-laundering prevention or certifications such as ISO 37001 (anti-bribery) and ISO 27001 (information security). Having a well-managed channel reinforces your entire compliance system.

Protecting the company’s reputation

Having a whistleblowing channel demonstrates a genuine commitment to ethics and transparency. That builds trust among employees, clients and partners, and that trust translates into greater loyalty and a stronger brand image. At a time when a reputation can be lost in a single headline, having an internal mechanism to resolve conflicts is a competitive advantage.

Scope and operation of a whistleblowing channel

Who can use the channel?

The channel must be available to a broad range of people connected to the company, not just the workforce. It can be used by:

• Employees (with a current contract, on a probationary period or even in recruitment processes).
• Former employees whose employment relationship has already ended.
• Freelancers, contractors and suppliers working for the company.
• Partners, directors and management staff.

Protection and confidentiality of the whistleblower

The cornerstone of the system is that no one should be afraid to report. That is why the channel must keep the whistleblower’s identity secret, allow reporting without fear of reprisals and have technical and organisational safeguards so that only the authorised team can access the information.

How a report is submitted and recorded

The procedure has to be clear and accessible. The law allows several means to be made available: an online platform, mobile app, telephone line or even an in-person meeting at the whistleblower’s request. Each communication is logged, assigned a tracking code and documented so that its status can be checked at any time.

Managing and resolving reports

The team in charge analyses each report objectively and impartially, investigates it and takes whatever measures are appropriate, always guaranteeing confidentiality. A good system provides reports and statistics that make it possible to monitor cases and to demonstrate, if the need arises, that the company manages the channel diligently.

How to implement a whistleblowing channel step by step

1. Assess your needs and design the system. Identify your legal obligations, define which channels you will offer (online, telephone, in person) and establish the internal procedure.
2. Communicate and train the workforce. A channel no one knows about is useless. Explain to your team what it is, what it is for and that reporting in good faith has no negative consequences.
3. Deploy the tool and appoint the person in charge. Roll out the platform and appoint the person or team who will receive and process communications independently.
4. Evaluate and improve continuously. Periodically review how the channel is working, gather feedback and adjust the procedure so it becomes ever more effective.

Penalties for not having a whistleblowing channel

Failing to set up the channel (or doing so incorrectly) can be very costly. Ley 2/2023 provides for a severe penalty regime:

• Very serious infringements for legal entities: fines of up to 1.000.000 €.
• Infringements for the individuals responsible: fines of between 1.001 € and 300.000 €.

On top of this come other possible consequences, such as publication of the penalty, a ban on contracting with the public sector or on receiving subsidies for a period of time. In short: the cost of non-compliance is far greater than that of setting up a channel.

In summary

A whistleblowing channel is today a legal obligation for many companies and a good practice for all of them. Well managed, it doesn’t create conflict: it prevents it, protects your team and shields your business’s reputation. The key is to implement it with a tool that complies with the law by design and doesn’t add to your workload.

If you are looking for a straightforward solution, LapsoWork integrates the whistleblowing channel alongside the rest of your company’s people management. And if you want to see how it fits into your day-to-day, you can get the whistleblowing channel or take a look at our pricing.