Ley 2/2023: Implementing Spain's Internal Reporting Channel

Legal framework: Ley 2/2023

Law 2/2023, of 20 February, regulating the protection of persons who report regulatory infringements and the fight against corruption transposes Directive (EU) 2019/1937 into Spanish law. It establishes the obligation to maintain internal information systems, protect whistleblowers against retaliation and cooperate with the Independent Authority for the Protection of Informants (AAI).

Organisations must align internal policies, reporting channels and record-keeping with both Ley 2/2023 and the broader EU procedural standards on acknowledgement and feedback deadlines.

Who must establish an internal channel in Spain?

• Private legal entities with 50 or more employees
• Municipalities with more than 10,000 inhabitants
• Entities in regulated sectors regardless of headcount (financial services, AML, transport safety, etc.)
• Group companies must ensure subsidiaries operating in Spain are covered

Minimum channel requirements

The internal system must allow confidential reporting and, where chosen by the reporter, anonymous reporting. It must guarantee the confidentiality of the identity of the informant and of third parties mentioned, and enable secure follow-up communication.

• Designation of a person or unit responsible for managing reports
• Acknowledgement of receipt within 7 calendar days
• Substantive feedback within 3 months (extendable to 6 months with justification)
• Electronic record register documenting each report and action taken
• Information and training of employees on how to use the channel
• Prohibition of retaliation and reversal of burden of proof in dismissal cases

Common compliance gaps in Spanish organisations

Many entities still rely on generic email addresses or paper forms. These approaches fail to guarantee anonymity, do not produce an auditable electronic register and make deadline tracking dependent on manual calendar management — a significant risk during AAI inspections or labour disputes.

• Email metadata exposing reporter identity
• No structured register exportable at inspection
• Missing proof of 7-day acknowledgement
• Lack of secure two-way communication with anonymous reporters
• Policies not adapted to Ley 2/2023 wording

Implementation roadmap (30-day plan)

• Week 1: Appoint designated officer / compliance unit; approve whistleblowing policy
• Week 2: Deploy secure digital channel; configure anonymity and encryption
• Week 3: Generate QR poster; communicate channel to all staff (Spanish + regional languages if needed)
• Week 4: Test end-to-end report flow; verify register export and deadline alerts

QReportly for Spanish organisations

QReportly provides a Spanish-language reporting interface, automatic electronic register, 7-day / 3-month deadline automation, QR poster generation and Word templates adapted to Ley 2/2023. EU hosting ensures GDPR compliance. Plans from €49/month for mid-zone pricing.