- Companies with fifty or more employees must put an internal reporting system in place.
- Anyone reporting in good faith is protected against retaliation, including when reporting anonymously.
- The most serious breaches carry fines of up to one million euros for the company.
The Official State Gazette published Law 2/2023 of 20 February on 21 February 2023, regulating the protection of persons who report breaches of the law and combating corruption. The law transposes Directive (EU) 2019/1937 and comes into force on 13 March 2023. It requires private entities with fifty or more employees, and those in the public sector, to have an internal information system, and it prohibits retaliation against anyone who reports an irregularity.
Until now, whether companies had reporting channels depended mainly on voluntary choice or on sector rules, such as those on preventing money laundering. The law turns what was good compliance practice into a general obligation, with deadlines, a designated officer and a penalty regime, and creates an independent authority that will receive reports and oversee compliance.
Who is obliged and when
The system is required of private entities with fifty or more employees, public administrations and, regardless of headcount, political parties, trade unions and employers’ organisations that receive public funds. Companies with between 50 and 249 employees may share the system and its resources. The general deadline is three months from entry into force, until 13 June; private entities with 249 employees or fewer and municipalities of under 10,000 inhabitants have until 1 December 2023.
Protection extends to anyone with a work or professional link to the entity: employees, self-employed people, shareholders, members of the governing body, people working for contractors and suppliers, and also volunteers, trainees, former employees and candidates in a recruitment process.
How the channel must work
The governing body is responsible for putting the system in place, after consulting employee representatives, and must appoint a system officer who acts independently. Reports may be made in writing or verbally and also anonymously. The reporter must be sent an acknowledgement within seven calendar days, and the response to the investigation may not exceed three months, extendable in cases of particular complexity.
Besides the internal channel there is an external channel to the Independent Whistleblower Protection Authority or regional bodies. The reporter’s identity may only be disclosed to a court, the Public Prosecutor or the competent administration in an investigation. Personal data that are not needed must be deleted, and data from reports that lead to no investigation are erased after three months.
Retaliation and penalties
The law expressly prohibits retaliation, understood as any act or omission that amounts to unfavourable treatment for having reported, such as dismissal, demotion or discrimination. Protection lasts, in principle, for two years from the report, and the competent authority may extend it exceptionally and with justification.
Fines on legal persons reach 100,000 euros for minor breaches, from 100,001 to 600,000 for serious ones and from 600,001 to 1,000,000 for very serious ones. Given those figures, implementation should be treated as a compliance project and not an IT formality: what is at stake is staff trust and the company’s reputational and legal risk.
What to do
A reasonable starting point is to determine whether the company or group exceeds the headcount threshold and what deadline applies, appoint the system officer and decide whether it will be run in-house or by a third party, which cannot reduce the safeguards the law requires. A policy and a procedure must also be approved, employees and third parties informed, and those receiving reports trained.
Data protection must not be forgotten: records of processing, risk analysis and retention periods. This note is general information; the specific adaptation depends on each company’s size, structure and sector, and your adviser can help you design it.
A reporting channel treated as a formality is expensive; well designed, it protects the company and its people.
This article is general information. It is not legal, tax or investment advice, and it does not take anyone’s particular circumstances into account.
