Whistleblowing channel compliant with Law 2/2023 and EU Directive 2019/1937 · live in 24 h
Sign inRequest demoSign up
Compliance guide

Law 2/2023, explained without jargon

What it requires, who it applies to, what deadlines it sets and what penalties non-compliance carries. Everything your Compliance Body needs to know, on one page.

Scope

Is your organization required to comply?

50+
Private companies

With 50 or more employees, whatever their sector.

AAPP
Public sector

The entire public administration, including councils and autonomous bodies.

€50M
Specific sectors

Financial-services entities or those exposed to money laundering, with no headcount threshold.

P·S·F
Parties and foundations

Parties, unions and foundations that manage public funds.

Key dates

The regulation's timeline

Dec 2019
EU Directive 2019/1937

The EU sets minimum standards for whistleblower protection.

Feb 2023
Law 2/2023 in force

Spain transposes the Directive through the whistleblower protection law.

Jun 2023
Companies of 250+ and public sector

Deadline to roll out the channel in large organizations.

Dec 2023 · enforceable
Companies of 50 to 249 employees

Since then, the channel is mandatory and its absence is punishable.

Penalty regime

The cost of not having a channel

Not having an Internal Reporting System, or breaching its safeguards, is a very serious infringement. Fines come with accessory measures.

Minor infringementhasta 30.000 €
Serious infringementhasta 600.000 €
Very serious infringementhasta 1.000.000 €
Maximum fine
1.000.000 €
for very serious infringements
300.000 €
Individuals
Ban
on contracting and subsidies
Requirements

What your Internal Reporting System must meet

eBlowing covers each of these points out of the box.

✓
Anonymous, confidential intake
Written and verbal channel guaranteeing confidentiality of the reporter and third parties.
✓
Acknowledgment within 7 days
Confirmation to the reporter within a maximum of seven calendar days.
✓
Resolution within 3 months
Investigation and response within a maximum of three months from acknowledgment.
✓
System Officer
Appointment of an independent officer and conflict-of-interest management.
✓
Record book and data protection
Register of reports compliant with GDPR, with restricted access.
✓
Prohibition of retaliation
Measures to protect the reporter against any retaliation.
Frequent questions

Questions about the regulation

For companies of 50 to 249 employees, since 1 December 2023. Those of 250 or more and the entire public sector had to have it operational since June 2023.
Is your case unusual? Talk to our legal team.

Comply with the law this very week

We support you through channel rollout and training your Compliance Body. No cost until it is live.

Request demoSee pricing