Whistleblowing Channel Protocol Spain (Canal de Denuncias)

A Whistleblowing Channel Protocol Spain (Protocolo del Canal de Denuncias) is a formal internal document required by Ley 2/2023, de 20 de febrero, reguladora de la protección de las personas que informen sobre infracciones normativas — Spain's transposition of EU Directive 2019/1937 (Whistleblower Protection Directive) — establishing a structured internal reporting system through which employees and third parties can confidentially report breaches of EU law, Spanish law, and company policies. Article 5 of Ley 2/2023 obliges organisations with 50 or more employees, all public sector entities regardless of size, and legal entities in certain regulated sectors to implement a formal internal reporting channel (canal interno de información) meeting specific procedural and confidentiality requirements.

The Canal de Denuncias is not merely a suggestion box — Ley 2/2023 imposes binding obligations on how reports are received, acknowledged, investigated, and resolved. Article 9 of Ley 2/2023 requires that the channel manager (responsable del sistema interno de información) acknowledge receipt of reports within seven calendar days, carry out diligent follow-up, and inform the reporting person of the actions taken within three months. Reports may be submitted anonymously — Article 24 of Ley 2/2023 explicitly requires that anonymous reports be processed, and the protocol must provide for their receipt even where the organisation cannot identify the reporter.

The Autoridad Independiente de Protección del Informante (A.A.I.) was created by Ley 2/2023 as the independent supervisory authority at state level, operating alongside autonomous community equivalents (Comunidades Autónomas with their own transposition legislation). The A.A.I. receives external reports, investigates whistleblower protection violations, and may impose sanctions for failure to implement compliant internal channels or for retaliatory conduct against reporting persons under Articles 62 through 64 of Ley 2/2023.

Protection against retaliation is the cornerstone of Ley 2/2023. Article 36 prohibits any adverse measure — dismissal, disciplinary sanction, demotion, harassment, discrimination, unfavourable treatment — against reporting persons, facilitators (persons who assist reporters), and third parties connected to the reporter (family members, colleagues). The burden of proof is reversed under Article 39 of Ley 2/2023 — if a reporting person suffers an adverse consequence, the employer must prove the adverse measure was taken for reasons wholly unrelated to the report, a significant departure from standard employment law principles under the Estatuto de los Trabajadores (RDL 2/2015).

The scope of Ley 2/2023 covers reports of breaches of EU law in the areas listed in the Annex to Directive 2019/1937 — financial services, anti-money laundering, product safety, environmental protection, food safety, public health, consumer protection, data protection, network security, competition law, and corporate taxation — as well as breaches of Spanish national law including criminal offences and serious administrative infractions. The protocol must clearly define the scope of reportable conduct so that employees understand what qualifies for protection.

Data protection obligations under the Reglamento General de Protección de Datos (RGPD) — Regulation (EU) 2016/679 — and Ley Orgánica 3/2018 (LOPDGDD) apply to all personal data processed through the whistleblowing channel. Article 32 of Ley 2/2023 requires that the identity of the reporting person, the identity of any person mentioned in the report, and all related personal data be treated with strict confidentiality, accessible only to the channel manager and persons directly involved in the investigation. Data must be deleted once the investigation is closed and the applicable retention period has expired — generally no longer than 10 years per Article 33 of Ley 2/2023 and RGPD data minimisation principles.

The Whistleblowing Channel Protocol Spain must be communicated to all employees, suppliers, contractors, and other relevant third parties who interact with the organisation. Article 5.3 of Ley 2/2023 requires that the existence and procedures of the internal channel be clearly published and accessible. The Inspección de Trabajo y Seguridad Social (ITSS) may verify compliance during labour inspections, and the A.A.I. may investigate complaints about inadequate or non-existent internal channels.

A Whistleblowing Channel Protocol Spain is required under Ley 2/2023, de 20 de febrero, for any private sector organisation employing 50 or more workers. The obligation applies from the date the 50-employee threshold is crossed — organisations that reach this threshold during a calendar year must implement their internal channel without delay. Companies in the financial services sector, including credit institutions, investment firms, and insurance undertakings regulated by the Banco de España and the Comisión Nacional del Mercado de Valores (CNMV), must implement a compliant channel regardless of headcount under Article 10 of Ley 2/2023.

The protocol is mandatory for all public sector entities in Spain regardless of size — municipalities (ayuntamientos), provincial councils (diputaciones), autonomous community administrations (comunidades autónomas), state agencies (organismos públicos estatales), public universities, and state-owned enterprises must all implement compliant internal reporting channels under Article 10.1 of Ley 2/2023.

A Whistleblowing Channel Protocol is needed when an organisation undertakes an internal audit or compliance review and identifies the absence of a formal reporting mechanism. Legal and compliance teams should advise boards of directors and senior management that the failure to implement a compliant channel exposes the organisation to administrative sanctions of up to €1,000,000 for serious infractions under Article 63 of Ley 2/2023.

The protocol is also necessary when an organisation has an existing anonymous suggestion or complaint mechanism but needs to upgrade it to meet the procedural requirements of Ley 2/2023 — specifically the seven-day acknowledgement obligation, the three-month feedback requirement, the anonymous report handling procedure, and the appointment of a designated responsable del sistema.

Small private sector companies with between 50 and 249 employees may share a common whistleblowing channel with other organisations in the same group under Article 5.2 of Ley 2/2023, provided the shared channel meets all procedural requirements — the protocol documents this arrangement and defines the responsibilities of each participating entity.

The protocol is required whenever a multinational group establishes Spanish operations — the Spanish subsidiary with 50 or more employees needs its own compliant channel in Spanish, even where the parent group operates a group-wide channel, unless the group channel meets all requirements of Ley 2/2023 and is accessible to Spanish employees.

A valid Whistleblowing Channel Protocol Spain under Ley 2/2023, de 20 de febrero, must contain the following essential elements to meet the statutory requirements and protect the organisation from sanctions by the Autoridad Independiente de Protección del Informante (A.A.I.).

Scope of Reportable Conduct: A clear definition of the types of breaches that may be reported through the channel — EU law violations in the areas covered by Directive 2019/1937 Annex, Spanish criminal law violations, serious and very serious administrative infractions, and internal policy breaches as defined by the organisation. The protocol should specify that reports of minor internal policy breaches not rising to the level covered by Ley 2/2023 will be handled through normal HR disciplinary channels rather than through the protected whistleblowing procedure.

Channel Formats and Access: Description of the specific technical formats through which reports may be submitted — web-based platform, dedicated email address, telephone hotline, physical mailbox, or in-person meeting with the channel manager. Article 6 of Ley 2/2023 requires that the channel allow written and oral submissions and that oral reports be transcribed or recorded with the reporter's consent. The channel must be accessible to employees, former employees, job applicants, contractors, suppliers, shareholders, and directors.

Designated Channel Manager (Responsable del Sistema): Identification of the person or body designated as responsible for managing the internal reporting system — an internal compliance officer, an external law firm, a board audit committee, or a third-party service provider. The channel manager must be independent and have the authority to conduct investigations. Article 8 of Ley 2/2023 permits the designation of a third-party provider, whose details must be disclosed in the protocol.

Acknowledgement and Investigation Timeline: The protocol must state the statutory deadlines — acknowledgement of receipt within 7 calendar days of submission (Article 9.1 of Ley 2/2023) and feedback on actions taken within 3 months of acknowledgement (Article 9.2). The investigation procedure must be described — how reports are triaged, what preliminary review is conducted, when formal investigation commences, how the subject of the report is notified (without compromising confidentiality), and how conclusions are reached and recorded.

Confidentiality and Anonymity: A statement that the identity of the reporting person will not be disclosed without their express consent except where disclosure is legally required by a competent authority — Article 32 of Ley 2/2023. The procedure for handling anonymous reports must be described — Article 24 obliges the organisation to process anonymous reports diligently. The protocol should specify the access controls limiting knowledge of the reporter's identity to the channel manager and investigation team.

Retaliation Prohibition: An explicit statement that no reporting person, facilitator, or associated third party will suffer retaliation for good-faith reports, consistent with Articles 36 through 40 of Ley 2/2023. The protocol must identify the remedies available to reporting persons who suffer retaliation — the right to file a complaint with the A.A.I., access to the Juzgados de lo Social for employment-related retaliation claims, and civil damages claims before ordinary courts.

Data Protection: A GDPR-compliant information clause addressing the processing of personal data through the channel — the legal basis (compliance with a legal obligation under Article 6.1(c) RGPD in conjunction with Ley 2/2023), data retention periods under Article 33 of Ley 2/2023 (not longer than 10 years after the investigation closes), the categories of data processed, and the rights of data subjects under the LOPDGDD and RGPD, exercisable through the Agencia Española de Protección de Datos (AEPD).

Relationship with External Channels: The protocol should explain that reporting persons may use external channels — directly to the A.A.I. at state level, or to autonomous community equivalents, or to EU institutions — at any time, without being required to first use the internal channel. Article 7 of Ley 2/2023 preserves this right and the organisation may not require internal escalation before external reporting.

Record-Keeping and Auditing: A description of how reports, investigation records, conclusions, and actions taken are documented and stored securely, and how the system is audited periodically to verify compliance. The Inspección de Trabajo y Seguridad Social (ITSS) and the A.A.I. may request access to these records during inspections.

Forms-legal.com provides this Whistleblowing Channel Protocol Spain template as a practical foundation. Every protocol should be reviewed by a qualified abogado especialista en compliance or data protection officer (DPO) to confirm that the channel implementation — technical, procedural, and organisational — satisfies all requirements of Ley 2/2023 and the RGPD for the organisation's specific sector and size.

Key Spanish statutory authorities: Autoridad Independiente de Protección del Informante (A.A.I.) — supervises internal channels and protects reporters. Agencia Española de Protección de Datos (AEPD) — oversees data processing through channels. Inspección de Trabajo y Seguridad Social (ITSS) — verifies compliance during labour inspections. Comisión Nacional del Mercado de Valores (CNMV) and Banco de España — supervise financial sector channel requirements.

Under the Estatuto de los Trabajadores (ET) RDL 2/2015, Spanish employment law governs contracts, dismissals, and working conditions. The Tesorería General de la Seguridad Social (TGSS) administers social security contributions. The Servicio Público de Empleo Estatal (SEPE) manages unemployment benefits. The Inspección de Trabajo y Seguridad Social enforces labour compliance. The Juzgados de lo Social hear employment disputes under the Ley Reguladora de la Jurisdicción Social (Ley 36/2011).