Whistleblowing channels in Spain: who must have one and which deadlines apply
Spanish Law 2/2023, on the protection of people who report regulatory breaches, requires private-sector companies with 50 or more employees to have an internal reporting system. The general obligation for these companies is set out in art. 10.1.a of Law 2/2023; other entities are also covered.
Who is required to have one
Companies with 50 or more employees. Those with between 50 and 249 can share the system and resources with other companies. The scope and how headcount is calculated require reviewing art. 10 of Law 2/2023 and the company's circumstances.
What the channel must offer
Reference: arts. 5, 7 and 36 of Law 2/2023. Protection conditions must be reviewed case by case.
It must allow written or verbal reports, and it must be usable anonymously if the person chooses. It has to guarantee the confidentiality of the reporter and of the people involved, and the company cannot retaliate against anyone who reports in good faith.
The deadlines to meet
Reference: art. 9.2 of Law 2/2023. Check its exceptions before applying a deadline to a specific case.
Once a report is received, an acknowledgement must be sent within a maximum of 7 calendar days. The response to the investigation cannot exceed three months from the acknowledgement, extendable by another three in especially complex cases.
The most common mistakes
Not appointing a person responsible for the system. Not keeping a register of the reports received. Not telling the workforce that the channel exists and how to use it. And confusing the channel with a mailbox anyone can read: a channel must genuinely guarantee confidentiality.
How peopleOS handles it
The Whistleblowing channel module is coming soon. Today it doesn't keep a register, track deadlines or send alerts when you reach 50 people. You can ask to be notified at launch; it does not replace the system you may need now.
This article is informative and reflects Spanish law as of November 2026. It is not a substitute for professional advice. Check the current rules and your collective agreement with a professional.
Keep reading
Working-time records in Spain in 2026: what the law requires today and what it doesn't yet
What art. 34.9 of the Spanish Workers' Statute says about daily working-time records. Check any regulatory changes with a professional.
Holidays in Spain: how many days employees get and how they're calculated
Art. 38 of the Spanish Workers' Statute sets a minimum of 30 calendar days; 22 working days is not a universal equivalent. What the article says and the cases that raise the most questions.
What HR software really costs (and how to compare without getting confused)
Per person, per module or flat fee: three pricing models that completely change what you'll pay in two years. The questions worth asking before you sign.