Many companies in Spain already have a whistleblowing mailbox or platform. What is not always clear is who stands behind it. Law 2/2023 is not satisfied with a form: it requires a specific person or body to answer for every report. That role is the whistleblowing system manager (in Spanish, Responsable del Sistema interno de información), and choosing it badly is one of the most common mistakes when setting up the channel.
This article explains who can hold the role, what the law requires, which deadlines apply and how an external specialist fits in without the company losing control.
In this article we will discuss...
What the whistleblowing system manager does
The whistleblowing system manager runs the internal reporting channel and answers for the diligent handling of every report. That is what Article 9 of Law 2/2023 establishes.
It is not a decorative title. The manager receives reports, decides whether they are admitted, coordinates the investigation and protects the rights of both the whistleblower and the person concerned. That is why the law requires independence, resources and a specific profile.
Who appoints the whistleblowing system manager
The governing body of the company appoints and dismisses the whistleblowing system manager (Article 8.1). In a company, that means the board of directors or the sole director.
The appointment must also be notified. Under Article 8.3, it has to be reported to the Independent Authority for Whistleblower Protection (A.A.I.) or the competent regional authority within ten working days. Dismissals are reported too, stating the reasons.
This step is easy to forget, especially when the original manager leaves the company and the replacement is handled informally.
Requirements for the whistleblowing system manager in a private company
A senior manager
In the private sector, Article 8.5 requires the role to be held by a senior manager (directivo) of the entity, acting independently from the governing body. This often surprises small companies, which tend to think of someone in HR or of their trusted adviser.
Independence and resources
Article 8.4 adds that the manager cannot receive instructions of any kind and must have the necessary personal and material resources. In practice, independence is tested when a report concerns a partner, a relative of the CEO or the manager’s own superior.
Combining the role with other duties
In smaller entities, the role can be combined with the person’s usual job, provided there is no conflict of interest. An existing compliance officer can also be appointed if they meet the requirements (Article 8.6).
An individual or a committee?
The law allows two options: appointing an individual or appointing a collegiate body, such as a committee. If a committee is chosen, Article 8.2 requires it to delegate the powers to manage the system and handle investigations to one of its members.
The committee option spreads the weight of sensitive decisions. It also makes it easier to remove a member from a case if a report concerns them. Its composition can combine the senior profile the law requires with the experience of a specialist in handling reports.
The real problem: a senior manager is not a specialist
The law requires a senior manager, but gives them no training and no time. That person has to acknowledge receipt within seven days, organise an investigation, protect personal data, respect the presumption of innocence and reply on time. Any mistake leaves a trace, and a leaked whistleblower identity can end in a fine or an employment dispute.
External management: what the law allows
Article 6 of Law 2/2023 allows the system to be managed by an external third party, and states that receiving reports is part of that management. The third party must offer guarantees of independence, confidentiality, data protection and secrecy of communications, and acts as a data processor under the GDPR.
In short, the company keeps control of the system while the specialist handles the day-to-day work. It is the way to comply with the law without loading a senior manager with a task they are not trained for.
How we organise it at Auratech
The company sets up an Ethics and Compliance Committee as the whistleblowing system manager. It includes a senior manager of the company, who meets the legal requirement, and an Auratech professional who acts as report manager within the committee: receiving and handling every report with legal judgement. You can see the details on our whistleblower channel service page.
Deadlines the manager must control
- Acknowledgement of receipt: seven calendar days, unless it would put confidentiality at risk.
- Response: three months at most, extendable by three more in complex cases.
- Notifying an appointment or dismissal: ten working days (Article 8.3).
- Referral to the Public Prosecutor: immediately if the facts may be a crime, or to the European Public Prosecutor if EU financial interests are affected.
Common mistakes when appointing the whistleblowing system manager
- Appointing, on their own, someone who is not a senior manager, such as an HR technician.
- Not notifying the appointment, or not notifying a change of manager.
- Choosing someone who reports to a person who may be the subject of a report.
- Buying a reporting platform with nobody able to handle reports with legal judgement.
- Not signing a data processing agreement with the external manager.
What happens if the system does not work
Law 2/2023 has its own penalty regime. Failing to have an internal reporting system is a very serious infringement, and fines for legal entities in this category can reach one million euros. If you want to review who is obliged and since when, read our article on the obligatory whistleblower channel for companies.
Frequently asked questions
Can the Data Protection Officer be the whistleblowing system manager?
The law does not forbid it, but in the private sector the role must be held by a senior manager, which an external DPO is not. Usually the DPO supports the data protection side. See our Data Protection Officer service.
Can an external specialist be part of the system?
Yes. The law allows an external third party to manage the system and receive reports (Article 6). The committee option lets that specialist sit as report manager alongside a senior manager of the company.
What if the manager is the person reported?
The procedure must explain how to remove them from the case. With a committee this is simpler, because the other members can take over.
Need to review who answers for your channel?
If your company already has a channel but is not sure the manager meets the requirements, we can help. We review the appointment, the procedure and the notification to the authority, and propose the option that best fits your structure. Ask about our whistleblower channel service.
This article provides general information and does not replace legal advice on a specific case.
Auratech Legal Solutions legal team
Lawyers specialised in data protection, compliance and technology law. External Data Protection Officers for companies and schools, whistleblowing channel managers (University Expert in Internal Reporting Systems, UNED) and ISO 27001 / ISO 27701 implementation. Contact us.
