Whistleblowing channel · Law 2/2023

A whistleblowing channel that protects the people who speak up

The internal reporting system required by Spanish Law 2/2023, inside the same portal your staff already use: restricted receipt, acknowledgement and response deadlines watched for you, and every case traced through to closure.

What it is and who must have one

A whistleblowing channel is the internal reporting system that Spanish Law 2/2023 requires of private companies with fifty or more workers and of the whole public sector: it must accept even anonymous reports, acknowledge receipt within seven calendar days, respond within three months at most and protect the person who reports. Kimobox hosts it in the same portal your staff already use, with restricted receipt and every case traced through to closure.

Content reviewed on 17 October 2026

Legislation: Law 2/2023 of 20 February Transposes Directive (EU) 2019/1937; in force since 13 March 2023
Companies in scope: 50 or more workers Art. 10.1.a); any headcount in the cases of art. 10.1.b) and c), and the whole public sector (art. 13)
Acknowledgement: 7 calendar days Art. 9.2.c) of Law 2/2023
Response: 3 months Extendable by a further three in especially complex cases (art. 9.2.d)
Anonymous reports: Must be accepted Art. 7.3: submission and subsequent handling
Retention: 10 years maximum Art. 26.2; erasure after three months if no investigation has been opened (art. 32.4)
Maximum fine: €1,000,000 Very serious infringement by a legal entity (art. 65.1.b)
State authority: Independent Whistleblower Protection Authority Operating since 1 September 2025 (Order PJC/908/2025)

Restricted receipt

Only the System Officer and the people they authorise can access reports and their contents.

Deadlines watched

An alert before the seven days for acknowledgement and the three months for a response run out.

Traceable case file

Each report with its actions, its conclusion and the follow-up it triggers, all the way to closure.

Report log

Reports received and the investigations they open are recorded for the statutory register.

What it covers

What the law expects of the internal system

A channel hosted in the portal your staff already use
Receipt restricted to the System Officer and their team
Acknowledgement of receipt within seven calendar days
A response within three months, extendable in especially complex cases
Policy and handling procedure kept as controlled documents
A register of reports received and investigations opened

Real examples

From a makeshift inbox to a system you can prove

Manufacturing · 50 to 249 people

An email address as the channel

Before Reports land in a generic inbox read by HR. Nobody tracks when the acknowledgement falls due, and there is no record of what was done with each report.

After A channel in the portal with receipt restricted to the System Officer. Acknowledgement and response have their deadlines calculated, and every action is kept in the case file.

Business group · several companies

A different channel in each subsidiary

Before Each company set up its own channel on different criteria, and nobody has an overall view of what is being reported across the group.

After A general policy approved by the parent company and a single System Officer, as art. 11 allows, with per-company permissions so each case file is seen only by those who should see it.

Distribution · tax compliance

Reports that never reach the compliance system

Before A report about a tax irregularity is investigated by email, and the tax risk map never learns it existed.

After The case file links to the risk concerned in the UNE 19602 system and to the corrective action it triggers, so the management review starts from real cases.

Vocabulary

Whistleblower protection vocabulary

Whistleblower: A person who reports a regulatory breach they have learned of in a work or professional context. Law 2/2023 protects them and requires the confidentiality of their identity to be preserved.
Internal reporting system: The whole formed by the channel, the System Officer, the policy and the handling procedure. It is put in place by the governing body after consulting the workers' legal representatives (art. 5 of Law 2/2023).
System Officer: The person appointed by the governing body to manage the internal reporting system. Their appointment and dismissal are notified to the competent authority within the following ten working days.
Independent Whistleblower Protection Authority: An independent administrative authority created by Law 2/2023 to run the external reporting channel. Its Statute was approved by Royal Decree 1101/2024 and it has been operating since 1 September 2025.
External channel: A route for reporting a breach outside the organisation, to the Independent Whistleblower Protection Authority or to the equivalent regional authority.
Register of reports: The record of reports received and the internal investigations they have led to. Its data may not be kept for more than ten years.

Frequently asked questions

What people ask us before getting started

Which companies must have a whistleblowing channel?

Private-sector employers with fifty or more workers, under art. 10.1.a) of Law 2/2023. Regardless of headcount, so must those subject to EU rules on financial services and markets, anti-money laundering, transport safety or the environment, as well as political parties, trade unions and employers' organisations that manage public funds. The whole public sector is bound by art. 13.

What deadlines does the law set for handling a report?

Acknowledgement of receipt within seven calendar days of receipt, and a response within three months at most, extendable by a further three in especially complex cases, under art. 9.2 of Law 2/2023.

Do anonymous reports have to be accepted?

Yes. Art. 7.3 requires the channel to allow even anonymous reports to be submitted and then handled. It is one of the points checked when the channel is set up.

Who is the System Officer?

The person appointed by the governing body to manage the internal reporting system. Their appointment and dismissal must be notified to the Independent Whistleblower Protection Authority, or to the competent regional authority, within the following ten working days (art. 8.3).

Can management of the channel be outsourced?

Yes. Art. 6 allows it to be entrusted to an external third party that offers guarantees of independence, but responsibility remains with the System Officer the company appoints.

Can several companies share a channel?

Private entities with 50 to 249 workers may share the system and its resources among themselves (art. 12). In a group of companies, the parent approves a general policy and there may be a single System Officer (art. 11).

How long is the data from a report kept?

If no investigation has been started within three months, the data is erased, except to leave evidence that the system works (art. 32.4). Whatever is entered in the register may not be kept for more than ten years (art. 26.2).

What penalties does the law provide for?

For a legal entity, up to 100,000 euros for a minor infringement, from 100,001 to 600,000 for a serious one and from 600,001 to 1,000,000 for a very serious one (art. 65.1.b). Very serious infringements may also bring a public reprimand, a ban on obtaining subsidies for up to four years and a ban on public procurement for up to three.

What is the external channel?

The one run by the Independent Whistleblower Protection Authority, operating since 1 September 2025, alongside those of the equivalent regional authorities. It is a route outside the organisation, separate from the internal channel the company must have.

We will walk you through a report from start to finish

We'll show you the module running with data similar to yours.

Request a demo

Keep exploring

Sources

Where each figure comes from

References to the official text in force. If a standard is revised, this page is updated and the review date says so.

Law 2/2023 on the protection of persons who report regulatory breaches and on the fight against corruption BOE-A-2023-4513 · 21 February 2023
Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law EUR-Lex · 23 October 2019
Royal Decree 1101/2024 approving the Statute of the Independent Whistleblower Protection Authority BOE-A-2024-22298 · 30 October 2024
Order PJC/908/2025 setting the start of operations of the Independent Whistleblower Protection Authority BOE-A-2025-16764 · 12 August 2025
Electronic office of the Independent Whistleblower Protection Authority A.A.I. Protección del Informante · Created by Resolution of 5 November 2025

A whistleblowing channel compliant with Law 2/2023

The Kimobox whistleblowing channel is the internal reporting system that Spanish Law 2/2023 requires of companies with fifty or more workers: restricted receipt, acknowledgement within seven calendar days and a response within three months at most, with every case traced through to closure.

Because it lives on the same platform as the compliance system, each report can be linked to the risk concerned, the nonconformity or the corrective action it gives rise to, which is the evidence ISO 37301, UNE 19602 and SGE 21 ask for.