The internal reporting channel duty in Spain

2023-03-13 (twenty days after publication in the BOE of 21 February 2023, per the final provision)

Art. 10(1) sets three categories: (a) private-sector natural or legal persons that have FIFTY OR MORE employees under contract; (b) REGARDLESS OF HEADCOUNT, legal persons falling within the scope of the EU acts on financial services, products and markets, prevention of money laundering or terrorist financing, transport safety and environmental protection referred to in Parts I.B and II of the Annex to Directive (EU) 2019/1937, expressly including entities not domiciled in Spain that operate there through branches, agents or by providing services without a permanent establishment; (c) REGARDLESS OF HEADCOUNT, political parties, trade unions, employers' organisations and foundations created by them, whenever they receive or manage public funds. Non-obliged entities may set up a compliant system voluntarily (Art. 10(2)).

2023-12-01. Disposición transitoria segunda, paragraph 2: as an exception, private-sector legal entities with TWO HUNDRED AND FORTY-NINE EMPLOYEES OR FEWER, and municipalities under 10,000 inhabitants, had until 1 December 2023. All other obliged entities had three months from entry into force under paragraph 1, i.e. until 13 June 2023.

Required. Art. 7(3): "Los canales internos de información permitirán incluso la presentación y posterior tramitación de comunicaciones anónimas", internal channels must allow anonymous reports to be submitted AND subsequently processed. Spain is one of two member states, with Portugal, that mandate this outright. Correspondingly, any act or omission tending to reveal the identity of a reporter who chose anonymity is a very serious infringement under Art. 63(1)(c), even if the identity is not actually revealed.

Autoridad Independiente de Protección del Informante, A.A.I. (AAI, Independent Whistleblower Protection Authority), created under Title VIII; it runs the state external channel and holds the sanctioning power. Its Statute was approved by Real Decreto 1101/2024 of 29 October, its president was appointed by Real Decreto 328/2025 of 15 April, and it became operational on 1 September 2025 (Orden PJC/908/2025 of 8 August). Autonomous communities may create equivalent regional authorities with parallel competence over regional public-sector bodies and over private-sector breaches producing effects only in that region.

The letters and the amounts are exact, but the chapeau is missing. Art. 63(1) reads "Tendrán la consideración de infracciones muy graves las siguientes acciones u omisiones DOLOSAS". The €600,001-€1,000,000 band therefore attaches only to a wilful failure to have the system. A non-wilful failure falls to Art. 63(3)(c) (leve, up to €100,000 for legal persons) or, where it fits, Art. 63(2).

Yes. Art. 6(1): management of the internal information system may be carried out inside the entity or by turning to an external third party, and for these purposes "management of the System" is defined as THE RECEIPT of reports. Art. 6(2) requires the third party to offer adequate guarantees of independence, confidentiality, data protection and secrecy of communications; Art. 6(4) makes it a data processor governed by an Art. 28(3) GDPR contract. Note the public-sector restriction: Art. 15 permits outsourcing by state, regional and local administrations only where insufficiency of own resources is evidenced, limited to the receipt procedure and on a purely instrumental basis.