Ley 2/2023: the whistleblowing channel Spain's authority requires, explained
Ley 2/2023 of 20 February, on the protection of persons who report breaches (Spain) · Updated: julio de 2026
What is it, and what does it require of you?
Ley 2/2023 requires every Spanish company with 50 or more employees (and the whole public sector) to run an internal reporting channel that guarantees confidentiality and anonymity, acknowledges receipt within 7 days and answers within 3 months at most. With Spain's whistleblower protection authority now operational, fines reach €1,000,000.
Who does it apply to?
Companies with 50 or more employees, all political parties, unions and employers' associations, and the whole public sector (with nuances for small municipalities). Companies over 250 have been covered since June 2023; those with 50–249 since December 2023. A group may share resources, but each covered entity answers for its own compliance.
Key dates
See also the Spain–Latin America compliance calendar.
Penalties
Compliance checklist
- Check your channel takes verbal, written and ANONYMOUS reports — an ethics@ mailbox doesn't qualify.
- Guarantee acknowledgement within 7 calendar days, with a record that proves it.
- Watch the 3-month response deadline (extendable to 6 in complex cases, with reasons).
- Appoint and document the officer responsible for the internal reporting system.
- Protect the reporter's identity: encryption, restricted access, access logging.
- Keep evidence of every step: the authority doesn't ask whether you have a channel — it asks whether it works.
- A complete whistleblowing channel: reports by web, app, phone or QR with real technical anonymity.
- Statutory deadlines watched automatically: the 7-day acknowledgement and the 3-month resolution don't depend on anyone remembering.
- Secure dialogue between handler and reporter, preserving anonymity.
- A single file with dated evidence, ready to show the authority.
Frequently asked questions
Which companies must have a whistleblowing channel?
All those with 50 or more employees, plus the public sector, political parties, unions and employers' associations. The duty has applied since June 2023 (250+) and December 2023 (50–249).
What are the fines under Ley 2/2023?
Very serious infringements carry fines of €600,001 to €1,000,000, plus a possible ban on grants and public contracting for up to four years.
What is Spain's whistleblower authority?
The Autoridad Independiente de Protección del Informante (AIPI), the national body that supervises compliance with Ley 2/2023, handles external reports and exercises enforcement powers. It is operational and already reviewing internal channels.
Will an email inbox do as a whistleblowing channel?
No. The channel must guarantee confidentiality, allow anonymity, record the deadlines (7-day acknowledgement, 3-month answer) and protect the data under GDPR. An ethics@company.com mailbox can evidence none of that.
Can group subsidiaries share a channel?
Resources can be shared in certain cases, but each covered entity keeps its own responsibility: the files, deadlines and evidence of ITS channel must be individually identifiable and defensible.
For information only — this is not legal advice. Check dates and thresholds with your adviser.
This obligation is organised with an international management system standard. If your group is already certified, you have half the road done — and the same holds in the other countries where you operate.