Supplier Code of Conduct Spain (Código de Conducta de Proveedores)

A Supplier Code of Conduct Spain (Código de Conducta de Proveedores) is a formal policy document under Código Civil Article 1255 — which establishes freedom of contract (libertad de pactos) within the limits of law, public morality, and public order — that a Spanish company issues to its suppliers, subcontractors, and third-party service providers to establish minimum standards of legal, ethical, environmental, and social conduct as a condition of the commercial relationship. The Código de Conducta de Proveedores has gained mandatory legal grounding in Spain through several converging legislative frameworks that have materially expanded corporate supply chain obligations since 2018.

Ley 2/2023, de 20 de febrero, reguladora de la protección de las personas que informen sobre infracciones normativas y de lucha contra la corrupción (Spain's Whistleblower Protection Act), transposing Directive (EU) 2019/1937, requires companies with 50 or more employees to establish internal reporting channels (canales de denuncia interna). The Código de Conducta de Proveedores typically extends these reporting obligations to the supply chain — suppliers must maintain equivalent reporting mechanisms and report breaches of the company's conduct standards through designated channels.

Ley Orgánica 3/2018, de 5 de diciembre, de Protección de Datos Personales y garantía de los derechos digitales (LOPDGDD), implementing Reglamento (UE) 2016/679 (RGPD/GDPR), requires that suppliers processing personal data on behalf of the company act as encargados del tratamiento under Article 28 RGPD — the Código de Conducta must establish minimum data protection obligations for all suppliers handling personal data of employees, customers, or third parties.

The Estatuto de los Trabajadores (RDL 2/2015) and Ley Orgánica 3/2007, de 22 de marzo, para la igualdad efectiva de mujeres y hombres (LO 3/2007) impose obligations on Spanish companies regarding gender equality plans (planes de igualdad) for companies with 50 or more employees under Real Decreto 901/2020. Leading Spanish corporates extend these obligations through their Código de Conducta de Proveedores, requiring suppliers to maintain their own equality plans and to demonstrate compliance with the Ley para la igualdad retributiva entre mujeres y hombres.

Environmental obligations in the supply chain are driven by Ley 7/2022, de 8 de abril, de residuos y suelos contaminados para una economía circular (transposing Directive (EU) 2018/851), Real Decreto 163/2014 on carbon offset labels, and Spain's Ley 9/2006 de evaluación de los efectos de determinados planes y programas sobre el medio ambiente. The Código de Conducta de Proveedores typically requires suppliers to comply with applicable ISO 14001 environmental management standards and to disclose their carbon footprint aligned with the Greenhouse Gas Protocol and Spain's Oficina Española de Cambio Climático (OECC) guidelines.

At European level, the forthcoming Corporate Sustainability Due Diligence Directive (CS3D — Directive (EU) 2024/1760), which Spain must transpose by July 2026, will impose binding due diligence obligations on large Spanish companies to identify, prevent, and mitigate actual and potential adverse human rights and environmental impacts throughout their supply chains — making a strong Código de Conducta de Proveedores a legal necessity rather than merely a best-practice document.

The legal framework governing the Supplier Code of Conduct Spain (Código de Conducta de Proveedores) in Spain draws on several key statutes and regulatory bodies. Under the Ley de Sociedades de Capital (LSC) RDL 1/2010, the Registro Mercantil maintains the register of Spanish companies. The Código de Comercio 1885 governs commercial obligations. The Agencia Estatal de Administración Tributaria (AEAT) administers Impuesto sobre Sociedades (IS) under Ley 27/2014. The Comisión Nacional de los Mercados y la Competencia (CNMC) enforces competition law. The Código Civil governs general contractual obligations under Article 1255. Parties executing a Supplier Code of Conduct Spain (Código de Conducta de Proveedores) in Spain should confirm the document reflects current law, including any amendments enacted since the original drafting date. The Código Civil art. 1255 (freedom of contract); Ley 2/2023 de protección de denunciantes sets the foundational requirements.

A Supplier Code of Conduct Spain is needed whenever a Spanish company engages external suppliers, subcontractors, agents, or third-party service providers and wishes to contractually impose minimum standards of legal, ethical, labour, environmental, and data protection conduct as a condition of the supply relationship.

A Código de Conducta de Proveedores is needed when a Spanish company with 50 or more employees must comply with the whistleblower reporting channel requirements of Ley 2/2023 — the code extends the company's compliance obligations into its supply chain, requiring suppliers to maintain equivalent internal reporting mechanisms.

The document is needed when a Spanish company acts as a data controller under RGPD and engages suppliers who process personal data on its behalf — the Código de Conducta de Proveedores establishes the contractual basis for the data processing agreements required by Article 28 RGPD, enforced by the Agencia Española de Protección de Datos (AEPD).

A Supplier Code of Conduct is needed when a Spanish listed company (sociedad cotizada) or public-interest entity (entidad de interés público — EIP) must produce a Non-Financial Information Statement (Estado de Información No Financiera — EINF) under Ley 11/2018, de 28 de diciembre, transposing the EU Non-Financial Reporting Directive (NFRD). The EINF must cover due diligence processes applied to the supply chain — a formal Código de Conducta de Proveedores is evidence of this due diligence.

A Código de Conducta de Proveedores is needed when a Spanish company participates in public procurement under Ley 9/2017 (Ley de Contratos del Sector Público — LCSP) — contracting authorities may require compliance with social and environmental conditions across the contractor's supply chain under Articles 202 and 202 bis LCSP.

The document is needed when a Spanish company operates in regulated sectors — banking (supervised by the Banco de España), insurance (supervised by the Dirección General de Seguros y Fondos de Pensiones — DGSFP), or capital markets (supervised by the Comisión Nacional del Mercado de Valores — CNMV) — where supervisory guidance requires supplier risk management and conduct standards as part of operational risk frameworks under EBA Guidelines on ICT and security risk management.

A Supplier Code of Conduct is needed to prepare for compliance with the Corporate Sustainability Due Diligence Directive (CS3D — Directive (EU) 2024/1760), which Spain must transpose by July 2026, imposing mandatory human rights and environmental due diligence obligations across the value chain for large Spanish and EU-based companies.

Under the Ley de Sociedades de Capital (LSC) RDL 1/2010, the Registro Mercantil maintains the register of Spanish companies. The Código de Comercio 1885 governs commercial obligations. The Agencia Estatal de Administración Tributaria (AEAT) administers Impuesto sobre Sociedades (IS) under Ley 27/2014. The Comisión Nacional de los Mercados y la Competencia (CNMC) enforces competition law. The Código Civil governs general contractual obligations under Article 1255.

A thorough Supplier Code of Conduct Spain aligned with Spanish law and leading corporate governance standards must contain the following elements to be contractually effective and to satisfy regulatory due diligence requirements.

Scope and Application: The code must clearly define which entities are bound — direct suppliers (proveedores directos), subcontractors (subcontratistas), agents (agentes), and, where applicable, sub-tier suppliers. The scope clause should state that acceptance of a purchase order, supply agreement, or service contract constitutes acceptance of the Código de Conducta de Proveedores, establishing its contractual force under Código Civil Article 1255.

Labour and Human Rights Standards: Minimum requirements aligned with the International Labour Organization (ILO) Core Conventions — prohibition of child labour (ILO Conventions No. 138 and 182), forced labour (Conventions No. 29 and 105), freedom of association (Convention No. 87), and the right to collective bargaining (Convention No. 98). Spanish law requirements under the Estatuto de los Trabajadores (RDL 2/2015) — minimum wage compliance (salario mínimo interprofesional), working time limits (Article 34 ET), and health and safety obligations under Ley 31/1995 de Prevención de Riesgos Laborales (LPRL) — must be expressly referenced.

Gender Equality and Non-Discrimination: The code must require suppliers to comply with Ley Orgánica 3/2007 on gender equality, Real Decreto 901/2020 on equality plans, and the Ley Orgánica 10/2022, de 6 de septiembre, de garantía integral de la libertad sexual (Ley del solo sí es sí) — covering harassment prevention obligations enforced by the Inspección de Trabajo y Seguridad Social (ITSS).

Health and Safety (Prevención de Riesgos Laborales): Suppliers must maintain a documented occupational risk prevention system under Ley 31/1995 (LPRL) and Real Decreto 171/2004 on coordination of business activities (coordinación de actividades empresariales — CAE). The CAE protocol is mandatory when supplier workers carry out activities at the company's premises — the code must require suppliers to maintain their own plan de prevención de riesgos laborales, evaluación de riesgos, and plan de emergencia.

Data Protection (RGPD / LOPDGDD): Suppliers processing personal data on behalf of the company must comply with Reglamento (UE) 2016/679 (RGPD) and Ley Orgánica 3/2018 (LOPDGDD). The code must require suppliers acting as encargados del tratamiento to: implement appropriate technical and organisational security measures (Article 32 RGPD); maintain a record of processing activities (Article 30 RGPD); notify data breaches within 72 hours (Article 33 RGPD); and not subcontract processing without prior written authorisation, supervised by the Agencia Española de Protección de Datos (AEPD).

Anti-Corruption and Ethics: The code must prohibit bribery (cohecho), improper payments, and conflicts of interest — aligned with Ley Orgánica 10/1995 (Código Penal) Articles 286 bis through 286 quater (corruption in business) and Article 427 (active bribery of public officials). Suppliers operating in Spain that engage with public sector entities must also comply with Ley 19/2013, de 9 de diciembre, de transparencia, acceso a la información pública y buen gobierno.

Whistleblowing and Reporting Channels: Consistent with Ley 2/2023 (Whistleblower Protection Act), the code must require suppliers to: maintain internal reporting channels for breaches of the code; protect whistleblowers from retaliation; and report material breaches of the code to the company through the designated canal de denuncia. The Autoridad Independiente de Protección del Informante (A-ISP), established by Ley 2/2023, oversees the national whistleblowing framework.

Environmental Compliance: Minimum obligations under Ley 7/2022 (residuos y economía circular), Ley 26/2007 de Responsabilidad Medioambiental, and applicable ISO 14001 environmental management standards. Suppliers should be required to report their carbon footprint and progress toward Spain's national decarbonisation objectives under the Plan Nacional Integrado de Energía y Clima (PNIEC 2021-2030).

Audit Rights and Monitoring: The company must retain the right to audit suppliers' compliance with the code — either directly or through accredited third-party auditors. Audit frequency and notice requirements should be specified, together with remediation timelines for identified breaches. Persistent non-compliance should be a ground for termination of the supply agreement.

Forms-legal.com provides this Supplier Code of Conduct Spain template as a practical drafting reference. The code should be reviewed by a qualified abogado or compliance specialist registered with the Consejo General de la Abogacía Española, and updated annually to reflect changes in Spanish legislation, EU Directives, and the evolving CS3D obligations that will apply from 2026.

Under the Ley de Sociedades de Capital (LSC) RDL 1/2010, the Registro Mercantil maintains the register of Spanish companies. The Código de Comercio 1885 governs commercial obligations. The Agencia Estatal de Administración Tributaria (AEAT) administers Impuesto sobre Sociedades (IS) under Ley 27/2014. The Comisión Nacional de los Mercados y la Competencia (CNMC) enforces competition law. The Código Civil governs general contractual obligations under Article 1255.