Spain's Whistleblower Law on the Shop Floor: Reporting Channel & Non-Retaliation.

Law 2/2023 of 20 February, which regulates the protection of persons reporting on regulatory infringements, implements EU Whistleblower Directive (EU) 2019/1937 in Spain. It requires all private companies with 50 or more employees to have an Internal Information System (reporting channel). Companies with 50 to 249 employees can share resources and a channel with other group or sector companies, while companies with 250 or more employees must have their own channel and a system manager with functional independence.

The law transposes EU Directive 2019/1937 and covers infringements of EU law (public procurement, financial services, product safety, environmental protection, food safety and public health, among others), plus serious or very serious criminal or administrative infringements under Spanish law. In an industrial context, this particularly includes: occupational health and safety violations, environmental breaches (discharges, emissions, hazardous waste management), quality fraud (falsified certifications, tampered test results) and corruption in the supply chain.

The law explicitly prohibits any form of retaliation against the reporting person, including suspension, dismissal, demotion, denial of promotion, unconsented change of duties or workplace, and coercion or discrimination. It also establishes a reversal of the burden of proof: if a reporting person suffers a work-related detriment after making a report, it is presumed to be retaliation unless the company proves the measure was based on justified grounds unrelated to the report.

Not just employees: the law extends standing to current and former workers (with a recently ended employment relationship), job candidates in the selection process, self-employed contractors, shareholders, members of governing bodies, volunteers, interns, and workers employed by contractors, subcontractors and suppliers. This is especially relevant in industrial supply chains with multiple contractors working at the same plant.

Companies are not required to accept anonymous reports, but they are required to guarantee the confidentiality of the reporting person's identity against unauthorised third parties throughout the process. Many companies choose to also allow anonymous reports as a best practice, since it lowers barriers to reporting, especially in industrial environments with strong plant-floor hierarchies.

The system manager must acknowledge receipt of the report within a maximum of 7 business days, and must respond to the reporting person within a maximum of 3 months from acknowledgement (extendable by a further 3 months in cases of special complexity). This deadline covers the internal investigation and the communication of measures taken or planned, or the reasons for not taking any.

Very serious infringements (including retaliating against the reporting person or breaching confidentiality) can be fined up to €1,000,000 for legal entities, plus possible ancillary penalties such as being barred from public-sector contracting or losing subsidies. Serious infringements (for example, not having a mandatory reporting channel) carry fines of up to €300,000. The Independent Whistleblower Protection Authority (A.A.I.) is the body responsible for national-level oversight.

IgeraIndustria indexes the full text of Law 2/2023 alongside your company's internal reporting-management protocol, letting the system manager or compliance department ask in plain language which infringement category applies to a specific case, what response deadline applies, and what confidentiality guarantees must be followed — always citing the exact article of the law.