Law 2/2023 on the protection of persons who report regulatory violations and the fight against corruption, known as the Whistleblowing Law, has established the obligation for certain companies to implement an Internal Information System or Whistleblowing Channel.
Which companies are required?
The law establishes different deadlines depending on company size:
Companies with more than 250 employees
They should have had the reporting channel implemented since March 13, 2023.
Companies with between 50 and 249 employees
The implementation deadline ended on December 1, 2023.
Other required entities
Regardless of the number of employees, the following are also required:
- Political parties, unions, and business organizations
- Foundations funded with public funds
- Entities that receive or manage European funds
Whistleblowing Channel Requirements
Guaranteed confidentiality
The system must guarantee the confidentiality of:
- The informant's identity
- Persons mentioned in the communication
- Actions taken in managing the information
Multiple communication channels
The company must allow communications to be submitted in writing and/or verbally, which may include:
- Secure web platform
- Specific email address
- Physical mailbox
- Dedicated telephone line
Response times
- 7 calendar days: To confirm receipt of the communication to the informant.
- 3 months: Maximum period to respond on planned or adopted actions.
Informant protection
The law establishes important guarantees for informants:
- Prohibition of retaliation: The informant cannot be dismissed, demoted, or discriminated against.
- Reversal of burden of proof: The company must prove that any measure taken is not retaliation.
- Data protection: The informant's identity is specially protected.
- Exemption from liability: The informant does not incur liability for disclosing protected information.
Important: Retaliation against informants can result in fines of up to €1,000,000.
Penalties for non-compliance
Failure to implement the reporting channel can result in:
| Type of violation | Penalty |
|---|---|
| Minor | Up to €100,000 |
| Serious | €100,001 - €600,000 |
| Very serious | €600,001 - €1,000,000 |
How to implement the Whistleblowing Channel
1. Designate a responsible person
Appoint the person or department in charge of managing the channel. This can be:
- An internal collegial body
- The compliance officer
- A specialized external third party
2. Establish the procedure
Clearly define:
- How reports are received
- Who manages them
- Response times
- Protection measures
3. Train staff
It is essential that all employees know:
- The existence of the channel
- How to use it
- Protection guarantees
4. Communicate the existence of the channel
The company must visibly inform about the existence of the reporting channel to:
- Employees
- Suppliers
- Third parties with a relationship with the company
Benefits of a good Whistleblowing Channel
Beyond the legal obligation, a well-managed reporting channel provides:
- Early detection of irregularities
- Improved work environment by giving employees a voice
- Risk prevention legal and reputational
- Culture of transparency and business ethics
Conclusion
The whistleblowing channel is no longer optional for most companies. If your company has more than 50 employees and you have not yet implemented the system, you are exposed to significant penalties.
At Asesores&Datos we help you implement a reporting channel that meets all legal requirements. Contact us for a free consultation.