Whistleblowing channel management: who runs it and what responsibilities it carries

Having a whistleblowing channel is not just about installing a mailbox and forgetting about it. Ley 2/2023 (Spain’s whistleblower protection act) requires someone to genuinely run it: receive reports, handle them diligently, respect the deadlines and protect the whistleblower. And managing it badly is penalised just as heavily as not having one at all. In this guide we explain who should manage the whistleblowing channel, what requirements that person must meet and what responsibilities they take on day to day.

Who should manage the whistleblowing channel?

When it comes to handling reports within a company, the first thing to be clear about is who will be responsible for the process. Under Ley 2/2023, the person in charge of the channel must be appointed by the entity’s administrative or governing body and, once named, notified to the Autoridad Independiente de Protección del Informante (the Independent Whistleblower Protection Authority, or AAI).

This role is technically known as the Information System Officer (or whistleblowing channel officer). It may be a natural person or a collegiate body, and the appointment must be formalised in writing. An informal designation is not enough: if you are inspected, you will need to prove who holds the role and since when.

Requirements for the person managing the whistleblowing channel

The person responsible for handling reports must meet a series of requirements to guarantee the transparency and integrity of the entire process. These are the essential ones:

Independence

The officer must operate in an independent and autonomous manner in relation to the rest of the entity’s bodies. This is crucial to ensure that reports are handled impartially and free from outside influence.

Capability and competence

They must have the capability and competence required to run the internal information system and the reporting channels, in both technical and organisational terms.

Legal knowledge

The officer must be familiar with the regulations on whistleblower protection and the handling of reports. This ensures that every action complies with Ley 2/2023 and the RGPD (the EU General Data Protection Regulation).

Integrity

Upright, ethical conduct is a fundamental pillar. The officer must ensure the confidentiality and proper handling of the information received in order to maintain the workforce’s trust in the channel.

Independence of the role

If the officer holds a management position, they must carry out their duties independently of the administrative body. This avoids conflicts of interest and guarantees objectivity in the handling of every case.

Responsibilities of running the whistleblowing channel

Running the channel entails a series of responsibilities that ensure its effectiveness and its compliance with the law. These are the main ones:

Approving the procedure

The officer must make sure that the reporting management procedure has been approved by the entity’s administrative or governing body and that it is kept up to date.

Diligent handling

The officer must respond diligently when processing reports and ensure that the internal information system meets all legal requirements at all times.

Identifying the channels

It is the officer’s responsibility to identify the internal channels associated with reports and to guarantee that information on how to report is clear and accessible to employees, former employees, suppliers and contractors.

Acknowledgement of receipt

The officer must send an acknowledgement of receipt to the whistleblower within seven calendar days of receiving the report. This is one of the most frequently missed deadlines, and one of the easiest to demonstrate in an inspection.

Response deadline

A maximum deadline for responding to investigative actions must be set, which as a general rule should not exceed three months (extendable to six in particularly complex cases).

Communication with the whistleblower

The officer must maintain communication with the whistleblower and request additional information from them where necessary. This aids the investigation and ensures that all relevant information is gathered, while always preserving the whistleblower’s identity.

Confidentiality and data protection

All information must be handled confidentially and in line with the RGPD. Access to the case file data must be limited to those strictly necessary to investigate the matter.

Managing the whistleblowing channel with LapsoWork

This is where LapsoWork comes in, the HR software that integrates the whistleblowing channel smoothly and efficiently. With its whistleblower module, employees can report incidents and concerns easily and securely, either anonymously or identified, and the officer has an intuitive interface to handle them in accordance with the law.

From the reports tab, the officer can manage every communication received: change its status, review all the case file information and hold a conversation with the whistleblower through a private chat that is recorded within the application, respecting anonymity whenever it is requested.

The officer also has a section within each report where they can upload private documentation that the whistleblower cannot access, and filter reports to quickly locate the one they need. The entire case file is tracked and available should the AAI request it.

As part of a complete HR suite, you have the whistleblowing channel integrated alongside the document manager software, time tracking and holiday management, without duplicating tools or data. And if any question arises, you have technical support so a professional can help you whenever you need it.

Conclusion

Running the whistleblowing channel well is just as important as having one: formally appointing an independent officer, respecting the 7-day deadline for the acknowledgement of receipt and the 3-month deadline to resolve the case, and guaranteeing confidentiality at every step. Meeting these points protects you from penalties and, above all, shows your workforce that reports are taken seriously.

If you want to see how a case is handled from start to finish, discover our whistleblowing channel or contract it and try it out with your own cases.