Reconectando con el servidor

Mantén esta pestaña abierta: tu trabajo no se ha perdido.

No hemos podido reconectar

Recarga la página para continuar donde lo dejaste.

La sesión ha caducado

Vuelve a cargar la página para iniciar sesión de nuevo.

English
ES EspañolPT PortuguêsEN English
Free assessment· 1h
Spain's authority is now operating and tick-box channels are under review. Would yours hold up?Act now →
Corporate integrity ›

Whistleblowing and case handling

An internal reporting channel compliant with Spain's Ley 2/2023

Ley 2/2023 doesn't ask for an inbox: it requires an internal reporting system with verifiable confidentiality guarantees, fixed deadlines and a register that can be handed to the authority. Since September 2025 the Spanish whistleblower protection authority has been checking that it exists and that it works.

5 screens of the programme
app.dsacompliance.net Whistleblowing and case handling
01A case inbox with the statutory clock in plain sight
02A file with the reporter shielded and the account sealed
03Status traceability against the art. 9 deadlines
04A dashboard for the compliance body
05A public reporter portal with a tracking code
DSA Compliance

Screens from DSA Compliance v6.2 in a demo environment. All data shown is fictitious.

The obligation, precisely

What the rule requires, and in which article

For information only, not legal advice. Always check against the consolidated text in force.

Art. 5 Ley 2/2023
The internal system must allow anonymous reporting, guarantee the confidentiality of the reporter and of any third parties named, and be run by a formally appointed officer.
Art. 9.2 Ley 2/2023
Acknowledgement to the reporter within 7 calendar days of receipt, and resolution of the investigation within a maximum of 3 months, extendable with justification.
Art. 26 Ley 2/2023
A register of reports received and internal investigations, kept only as long as strictly necessary and accessible solely to the competent authority on request.
Art. 36 Ley 2/2023
Ban on retaliation: any detriment arising from the report is void and gives rise to liability.
Penalty regime

Very serious infringements of Ley 2/2023: up to €1,000,000 for legal persons, with a possible ban on public contracting and on receiving grants.

Rules it covers
Ley 2/2023Whistleblowers · ESDir. 2019/1937EU whistleblowingLey Karin21.643 · CL

The badges identify the obligation the program digitises. They are not certifications or conformity accreditations.

What it leaves as evidence

What gets handed over when somebody asks

  • A timestamped acknowledgement, within the 7 days of art. 9.2
  • A register of reports, exportable for the authority
  • Tamper-proof traceability of every action, with user and timestamp
  • The case handler's declaration of no conflict of interest
  • A reasoned decision and the corrective measures taken
Who it applies to
Companies with 50 or more employees
Every company in the art. 10.2 sectors (finance, AML, transport, environment) with no threshold
Political parties, unions and foundations receiving public funding
Public sector bodies
Companies operating in Chile, under Ley Karin 21.643
International framework

This programme implements certifiable ISO standards. If your organisation already is, here you see which part is solved and which laws it covers in each country where you operate.

ISO 37301 · Compliance management systems
Frequently asked questions

What we get asked about Whistleblowing

Will an ethics@company.com mailbox do?

No. Art. 5 requires guaranteed anonymity and confidentiality, and a mailbox leaves an identity trail, doesn't control access, and can't evidence the art. 9.2 deadlines.

What does the authority check when it inspects a channel?

That it exists and is published, that it accepts anonymous reports, that it has an appointed officer, that acknowledgement and resolution deadlines are met, and that the art. 26 register exists.

Can the channel be shared across group companies?

Ley 2/2023 allows it within groups and for entities under 250 employees, subject to conditions. The platform is multi-entity: each company keeps its own file and register separate.

Vea Whistleblowing running with their cases

A 30-minute guided demo on the real platform, or a one-hour assessment session with a consultant.

Other programmes from Corporate integrity
Crime prevention AI governance Security Signature and evidence
← The 21 programmes of the platform