Whistleblowing channel protocol: what it is and how to write it step by step

Having a whistleblowing channel is no longer optional: Ley 2/2023 requires every Spanish company with 50 or more employees to have one. But setting up a mailbox is not enough. The law requires that channel to run on a written protocol guaranteeing confidentiality, deadlines and protection for the whistleblower. In this guide we explain what that protocol is, what it must contain and how to write it and roll it out step by step, with the deadlines and regulations updated to 2026.

What is the whistleblowing channel protocol?

The whistleblowing channel protocol is the document that sets out the objectives, the scope and all the procedures that will apply to the channel. It is, essentially, the internal instruction manual: who can report, how each communication is received, who manages it, within what deadlines and with what safeguards.

It is not just another bureaucratic formality. Without a protocol, the channel has no evidentiary value before the Autoridad Independiente de Protección del Informante (AAI) (Spain’s independent whistleblower protection authority) or in the event of an inspection. It is the document that proves the company does not merely have a mailbox, but a genuine complaint-management system that complies with Ley 2/2023.

What should the whistleblowing channel protocol look like?

The protocol must explain how the whistleblowing channel works within your organisation in a clear and orderly way. As a minimum, a well-drafted protocol includes:

• Introduction and purpose. Why the channel exists and what the company commits to.
• Objectives. Detecting and correcting irregularities, and protecting whoever reports them.
• Scope of application. Who can use the channel: employees, former employees, candidates, freelancers, suppliers, interns and anyone with an employment or professional relationship with the company.
• Safeguards. Confidentiality of the whistleblower’s identity, prohibition of reprisals and presumption of good faith.
• Responsible bodies. Who receives, investigates and resolves reports, applying criteria of impartiality and conflict-of-interest management.
• Full procedure. From receipt of the report through to closing the case, with the legal deadlines.
• Data protection. Processing measures compliant with the RGPD and the LOPDGDD.

The more specific the document, the better. A generic protocol copied from a template that does not fit your company is almost as risky as not having one at all.

How do you implement a whistleblowing channel?

Rolling out the channel and its protocol comes down to six steps.

1. Establish a secure way to report

The first step is to provide employees with a secure, confidential route to raise their concerns. It must be easily accessible and clearly communicated. The recommended approach is specialised software that allows written and anonymous reports, with acknowledgement of receipt and traceability, rather than improvised solutions such as a physical mailbox or a generic email address, which guarantee neither anonymity nor a proper record.

2. Appoint one or more people in charge

You need to designate one or more people responsible for receiving and managing reports. They should be impartial, trustworthy individuals, trained to handle information confidentially. The protocol must also anticipate what happens when the designated person is involved in the report, so that no case is left without an impartial investigation.

3. Draw up rules and regulations

The next step is to develop rules and regulations that describe in detail how reports are submitted, the response deadlines, the confidentiality criteria and the steps to follow in each case, all aligned with Ley 2/2023.

4. Define the procedure for handling each report

Establish a clear procedure with the steps from receipt to resolution: acknowledgement of receipt within 7 days, gathering of evidence, protection of confidentiality and a thorough, impartial investigation. The law sets a maximum deadline of 3 months to resolve each report (extendable to 6 in complex, duly justified cases), so the protocol must reflect these time milestones.

5. Keep a record of reports and their status

You are legally required to keep a detailed record of every report received and its processing status. This record makes it possible to follow up, assess the channel’s effectiveness and adopt any necessary measures. It is also the documentary evidence the company can present to the AAI if asked to prove the channel is working.

6. Publicise the channel so anyone can use it

A channel nobody knows about is of little use. Publicise it through meetings, posters, emails and the intranet, and include it in the onboarding of new hires. The aim is to foster a culture of openness and trust in which reporting irregularities is seen as something normal and protected, never as a betrayal.

Which companies have to implement a whistleblowing channel?

All companies with 50 or more employees are required to have a whistleblowing channel, under Ley 2/2023. The adaptation deadlines have already passed: companies with more than 250 employees had until 21 May 2023, and those with fewer than 250 employees until 1 December 2023.

Also required, with no minimum headcount threshold, are public administrations and companies operating in certain regulated sectors (financial services, anti-money-laundering, transport safety or the environment), as well as political parties, trade unions, foundations and entities that receive public or European funds.

Since the deadlines have passed, the AAI can now impose sanctions. Very serious breaches —such as failing to have a channel or breaching its safeguards— can result in fines of up to 1,000,000 € for legal entities. If your company still does not have one, the priority is to put it in place as soon as possible, backed by a solid protocol.

The good news is that getting it up and running is quick when you use the right tool. The LapsoWork whistleblowing channel includes an anonymous mailbox, protocol, deadline management and records, all integrated with the rest of the HR modules such as the time-tracking software. If you want to see it working with your own cases, you can get the whistleblowing channel with no commitment.