Start of main content

The Whistleblowing Channel: Enhanced whistleblower protection begins

| Publications | Corporate Compliance / Employment Law and Social Security / Privacy, IT & Digital Business

The deadline for Spain, as an EU Member State, to transpose Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons reporting breaches of Union law has expired

Last Friday 17th December 2021 was the deadline for Spain, as an EU Member State, to transpose Directive (EU) 2019/1937 of the European Parliament and of the Council of 23rd October 2019 on the protection of persons who report breaches of Union law.

However, although our Ministry of Justice opened a public consultation process months ago to gather the opinion of those potentially affected by the future regulation, as of today, the Directive has still not been transposed into our legislation.

What is the aim of the Directive?

Its purpose is to establish a harmonised legal framework for all EU Member States to protect the figure of the whistle-blower, defined as "a natural person who publicly communicates or discloses information about infringements obtained in the context of his or her work activities".

This protection is intended to prevent whistle-blowers from refraining from reporting their suspicions of wrongdoing for fear of retaliation.

Does the Directive apply even though the Spanish government has not transposed it?

In principle, unlike a Regulation which is directly applicable after its entry into force, EU Directives must first be transposed into national law before they become applicable. However, the Court of Justice of the EU considers that, based on the principle of the supremacy of Community law, a Directive which has not been transposed has certain direct effects, as in the present case:

  • transposition into national law has not taken place or has taken place incorrectly,
  • the terms of the Directive are unconditional and sufficiently clear and precise, and
  • attribute rights to individuals (such as whistle-blower protection).

In the same sense, there is case law from our Supreme Court that determines that if the State delays in transposing a Directive, the Directive would be directly applicable in order to protect the rights of individuals during the time that elapses from the end of the deadline for transposition until the Directive is effectively transposed.

Are the obligations to have a complaints channel and whistle-blower protection new?

No, although until now in Spain there has been no homogeneous general rule guaranteeing effective protection, whistle-blower protection had already been included in some areas, bearing in mind that it does not form part of a specific area of law.

Therefore, the whistle-blowing channel is a tool that was already regulated in the Criminal Code, in the version given by Organic Law 1/2015, of 30th March, which introduces the prevention plans for the criminal liability of the legal person, also in the Organic Law for the effective equality of women and men to channel complaints of sexual harassment and harassment on grounds of sex in the workplace, etc.

Which companies are obliged to implement/adapt the whistle-blowing channel? 

  • Private companies with 50 or more employees, regardless of the nature of their activities.
  • Public companies.

The implementation of these channels and the protection and support measures for whistle-blowers and related third parties must be carried out after consultation with the social partners.

What is the deadline for implementing or, where appropriate, adapting the whistleblowing channel?

The deadline started on 17th December 2021 for public and private companies with more than 50 employees.

However, if they have less than 250 employees, they have until 17th December 2023 to comply with the obligation.

What should the Whistleblowing Channels include?

  • They must be designed and managed in a way that ensures the confidentiality of the whistle-blower and any third party named in the complaint.
  • Designate a competent impartial person or department to handle complaints promptly and maintain communication with the complainant.
  • Provide mechanisms to enable verbal or written reporting.
  • Publicise to employees the existence of the whistleblowing channel and the procedure and conditions for accessing it.
  • Acknowledge receipt of the complaint to the whistle-blower within a certain time period of receipt.
  • Respond to complaints within a reasonable time period, which shall not exceed three months from the date of acknowledgement of receipt.
  • Keep a register of complaints, which should be retained for the necessary period.
  • Comply with personal data protection obligations, which will imply the need to have a procedure for the management of personal data in accordance with the principles of proportionality and purpose.

What are the advantages of having a whistleblowing channel?

It allows companies to:

  • Know first-hand about the ineffectiveness or non-compliance with the procedures in place.
  • To document the possible subsequent application of disciplinary measures against those reported.
  • Prevent the imposition of sanctions against the company and, in serious cases, determine exemption from criminal liability.
  • Attract and retain company personnel with ethical and compliance values.
  • Provide competitive value by demonstrating sound governance practices.

For the public interest it strengthens security in important areas protected by the Directive such as public procurement, environmental protection, food safety, financial market, transport, etc.

You can download the full document here

For further information please contact:


María Suárez | Partner in the area of Privacy, IT & Digital Business

Clara Marín | Director in the area of Labor Law.

End of main content