The Spanish whistleblower law, Ley 2/2023, and the system every employer has to run
The Spanish whistleblower law, Ley 2/2023 of 20 February, makes every employer with 50 or more workers run an internal reporting system. It carries the EU Whistleblower Directive into Spanish law, with fighting corruption written in as a second purpose. The rules have applied since 13 March 2023. Spain went further than most of its neighbours. Anonymous intake is compulsory there, and a state authority was built for the job. The company fine is the heaviest in the EU.
Which employers must comply with Ley 2/2023?
Employers with 50 or more workers must comply with Ley 2/2023, and so does the entire public sector. Regulated firms are caught at any size, finance among them. The public side is unusually wide. It reaches central government, the regions and every local body. The directive let towns under 10,000 residents opt out, and Spain dropped that exemption. Political parties, trade unions, employer groups and their foundations are also covered whenever they handle public money. Smaller bodies got a longer runway. The general rule allowed 3 months from the day the law took effect. Private firms under 250 workers and towns under 10,000 people had until 1 December 2023. Firms of 50 to 249 workers may share tools and staff to handle reports.
What does the internal reporting system need in Spain?
The internal reporting system in Spain needs to take reports in writing, by voice, or both. A voice report is written down once the reporter agrees. It becomes a recording or a transcript, and they can read it, correct it and sign it. The system has to be open to workers, the self-employed, interns and others linked to the firm. Before it goes live, the governing body has to consult the workers' legal representatives. You confirm a report within 7 calendar days and reply within 3 months, with another 3 months available on a hard case. WeMoral gives the System Officer one place to handle every report on that list. Anonymous reports land in it encrypted. Access stays with the people you name, and nobody else.
| Requirement | What it means in practice |
|---|---|
| Report formats | Writing, voice, or both, with voice documented and signed off by the reporter |
| Anonymous intake | Anonymous reports must be accepted and handled, not merely tolerated |
| Confidentiality | The whistleblower and any named third parties stay confidential |
| The logbook | A confidential register of reports, personal data never held beyond 10 years |
| Early deletion | Three months after receipt where no investigation was opened |
| Data | Handled under the GDPR and the Spanish data protection rules |
Who is the System Officer under Ley 2/2023?
The System Officer under Ley 2/2023 is the person the entity's board appoints to run the reporting system. The role carries real independence. They do the job without taking orders from any other body inside the organisation. Their appointment and their removal both have to be reported to the Independent Whistleblower Protection Authority within 10 working days. That step makes the role hard to fake. An employer who never named an officer leaves a gap on the authority's public record. The officer needs a case panel of their own, with handling rights split by role, so the record of who did what stays clean.
What breaches can be reported under Ley 2/2023?
The breaches that can be reported under Ley 2/2023 cover EU law and serious Spanish offences. On the EU side it takes in breaches of Directive 2019/1937, such as those that damage the single market or the Union's money. On the national side it takes in serious and very serious criminal or administrative breaches of Spanish law. Anything that costs the Treasury or Social Security money sits at the centre of the law's purpose. Some subjects are left out. Classified information is excluded, and so are the professional secrecy of doctors and lawyers and the secrecy of court rulings. Health and safety at work is not an exclusion. Article 2.3 keeps protection for workers who report in that field, alongside whatever the specific rules already give them.
Who can report under Ley 2/2023?
Anyone who learns of a breach through their work can report under Ley 2/2023. The law names the salaried worker, the public employee and the self-employed together, along with partners and members of the board or management. Anyone working for a contractor, a subcontractor or a supplier is covered too. Volunteers, interns and trainees appear by name, and so do job candidates who picked the information up during hiring. A former worker keeps the right to report after the job has ended. Protection then travels outward to workers' representatives and to close contacts who might be punished in the reporter's place, a relative or a colleague among them.
How does Spanish law shield a whistleblower from reprisals?
Spanish law shields a whistleblower from reprisals from the moment the report or public disclosure is made. One condition attaches. At the time of reporting, the person needed solid grounds to think the information was true and covered by the law. Article 36.1 then bans reprisals outright, and its list is open ended. It runs from dismissal and a non renewed contract to demotion and a blocked promotion. It takes in a big change to working terms, coercion, threats, harassment and freeze outs. Blacklists and denied training are named as well. A threat to use one carries the same ban as the act. Article 38.4 turns the burden around, so harm that follows a proper report is presumed to be retaliation. The other side then has to prove a justified reason unrelated to the report. Article 36.5 makes an administrative act of retaliation null and void, and that full nullity is reserved for administrative acts. A private employer is still barred from retaliating. Its acts are simply not declared void, so what follows there is corrective and disciplinary measures plus payment for the harm.
How do the external channel and the A.A.I. work?
The external channel is run by the A.A.I., the Independent Whistleblower Protection Authority, working alongside the regional bodies. A reporter may go straight there under Article 16.1, with no internal report first. Its clocks are tighter than the company's. It confirms a report within 5 working days, decides whether to take the case within 10 working days, and wraps it up within 3 months. Public disclosure is the third route, and Article 28 sets three gates on it. The earlier channels have to have missed their deadline, or a clear and pressing danger has to face the public, or the external channel would not work. Article 28.2 then adds a fourth route with no gate at all, a report made straight to the press under the constitutional right to free speech and truthful information. That is a wider press door than most member states left open.
What fines does Ley 2/2023 set?
Ley 2/2023 sets fines that reach €1,000,000 for a company in the worst cases, the heaviest ceiling in the EU. The tier depends on how serious the breach was and on whether the guilty party is a person or a company. Having no reporting channel is a very serious breach, and so is retaliation or leaking the reporter's identity. Even trying to leak it counts. On top of the money the authority can add a public warning, a ban on grants for up to 4 years and a ban on public contracts for up to 3 years. Knowingly filing a false report is very serious too, and an individual can be fined up to €300,000 for it. The heaviest penalties are published. A fine of €600,001 or more on a company can appear in the Official State Gazette once it is final. Very serious breaches lapse after 3 years, serious ones after 2, and minor ones after 6 months.
| Severity | Natural person | Company |
|---|---|---|
| Minor | €1,001 to €10,000 | Up to €100,000 |
| Serious | €10,001 to €30,000 | €100,001 to €600,000 |
| Very serious | €30,001 to €300,000 | €600,001 to €1,000,000 |
Which whistleblowing software fits Ley 2/2023?
Whistleblowing software fits Ley 2/2023 when it takes anonymous reports and keeps the confidential logbook the law asks for. WeMoral is whistleblowing software on a monthly subscription, and it holds the logbook for the full ten year ceiling the law allows. Every case sits on EU soil, in Frankfurt, Germany. Reports arrive encrypted and stay encrypted, and so does every reply in the thread. Uploads are stripped of hidden data, and the form never records an IP address. The audit log shows who opened which case and when. That is the evidence the A.A.I. would want to see. WeMoral prices PRO at €79 a month, net, and knocks 20% off for annual billing. A branded reporting page is live in under 5 minutes, which is faster than the consultation that has to precede it.
What to fix if your Spanish channel is only a mailbox
If your Spanish channel is only a mailbox, fix the System Officer and the logbook before anything else. Those two are what an inspection looks for, and an email inbox produces neither. Switching to a real system is the common case in Spain now, three years in. WeMoral moves your open cases across without downtime, so nothing in flight is lost. The audit trail then covers every access from the first day on the new tool. One channel covers 25 languages, and a reporter picks theirs at the start of the form. That helps a Spanish group with sites in Portugal or Latin America. PRO holds five panel users. Enterprise removes the limit, and adds single sign on with a reporting page on your own domain. The officer's name still has to reach the A.A.I. within 10 working days of the appointment, whichever tool holds the logbook.