Search for:

In brief

Spanish Official State Gazette published Law 2/2023 on 20 February 2023 (Ley Reguladora de la Protección de las Personas que Informen sobre Infracciones Normativas y de Lucha contra la Corrupción), which transposes the EU Whistleblower Directive (Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of European Union law) into Spanish law (Ley Reguladora de la Protección de las Personas que Informen Sobre Infracciones Normativas y de Lucha Contra la Corrupción) (“Law“). The full text of the Law is available here.

The main compliance obligations imposed by the Law on entities with more than 50 employees are the following:

  • Have a reporting System that complies with legal requirements (e.g., that accepts anonymous reports and acknowledges receipt within seven calendar days) and is approved by the entity’s management or governing body
  • Making the whistleblowing channel available not only to employees, but also to shareholders, board members, suppliers, intermediaries, etc.
  • The channel should be able to report, in addition to the possible infringements of European Union law provided for in the Directive, any “serious” or “very serious” administrative offenses and infringements as those terms are understood under Spanish law.
  • Appoint a first-level manager as the person in charge of the reporting system, who must perform his or her functions independently and autonomously from the rest of the organization’s bodies
  • Process the information received and respond to it within three months, which may be extended for a further three months in particularly complex matters
  • Guarantee confidentiality, apply the presumption of innocence, minimize risk of defamation, and prohibit retaliation
  • Forward the information to the Public Prosecutor’s Office “immediately” when the facts could be indicative of a crime. In the event that the facts affect the financial interests of the European Union, the referral must be made to the European Public Prosecutor’s Office
  • Comply with a number of specific data protection obligations

Click here to access the full alert.

For further information and to discuss what this development might mean for you, please get in touch with your usual Baker McKenzie contact.


Cecilia Pastor is highly knowledgeable in the areas of mergers, acquisitions and pharmaceutical law. She is a lecturer at ICADE on international agreements for the university’s Masters in Law degree program. Ms. Pastor is a regular contributor to the Spanish chapters of Promoting Medical Products in Europe & North America, Pharmaceutical Advertising, and other publications. She is a member of the Madrid Bar Association.


Montserrat Llopart is a Partner in the International Commercial & Trade department and leads the Compliance and Healthcare Law practices in the Barcelona office. Her practice focuses on advising clients on regulatory, compliance, commercial contracts, consumer and acquisitions issues. She is a regular speaker and contributor to specialist conferences and publications and she is recognized by the leading legal directories as Chamber, Legal 500 and Best Lawyers and as InspiraLaw Top 50 Women List for Spain and Portugal. Montserrat headed the Barcelona office and the Firm's pharmaceutical law group in the EMEA region.

Write A Comment