The whistleblowing channel, also known in Spain as an internal information system, is mandatory for many companies under Law 2/2023. Its purpose is to allow employees, collaborators and other connected people to report legal infringements or irregular conduct with confidentiality safeguards and protection against retaliation.
In this article we will discuss...
Which companies are required to have one
As a general rule, private companies with 50 or more employees must have an internal information system. Entities in certain sectors or activities may also be required to have one even with a smaller workforce, especially where sector-specific rules apply.
The internal channel should allow written or verbal reports, guarantee confidentiality, allow anonymity where appropriate and have a person or body responsible for the system.
What a whistleblowing channel should include
- A clear procedure for receiving, managing and investigating reports.
- Confidentiality of the identity of the whistleblower and affected persons.
- Protection against retaliation.
- Anonymous reporting where the system allows it.
- Deadlines for acknowledgement, analysis and response.
- Information about the external reporting channel before the competent authority.
- Data protection safeguards and limited retention of information.
Whistleblowing channel and data protection
The channel may process highly sensitive information: reported facts, identities, evidence, employment conflicts or possible infringements. It should therefore be configured with restricted access, traceability, user information, retention periods and appropriate security measures.
Common mistakes
- Using a generic email inbox without a procedure or safeguards.
- Not informing staff about how to use the channel.
- Not appointing the person or body responsible for the system.
- Not documenting investigations, deadlines and decisions.
- Keeping reports longer than necessary.
- Not coordinating the channel with data protection, compliance and HR.
Recommended official sources
Conclusion
Implementing a whistleblowing channel is not just opening an email inbox. The company needs a system with safeguards, deadlines, confidentiality, data protection and real capacity to manage the reports received.