What this system protects in occupational safety
Spain’s Law 2/2023 protects people reporting matters within its scope when its conditions are met. It covers specified breaches of European Union law and acts or omissions potentially constituting criminal offences or serious or very serious administrative infringements. A preventive concern can qualify, but not every disagreement with a manager automatically attracts this particular protection.
For occupational safety, examine the facts and applicable legal classification without expecting the reporting person to deliver a court judgment before speaking up. The law preserves safeguards under occupational-safety legislation. The European directive provides the framework; the Spanish conditions described here must not be transferred without review to workplaces in other countries or treated as a universal corporate reporting standard.
Who is covered and the professional context
Personal coverage extends beyond permanent employees. Article 3 includes public and private employees, self-employed people, members of management bodies and people working under the direction of contractors, subcontractors or suppliers. It also addresses former or prospective relationships, training and recruitment in the circumstances specified by the law.
Where applicable, measures can extend to representatives providing advice, people assisting the reporter and related individuals who may face retaliation. In a contracting chain, make access understandable to external workers and establish which entity received and manages the information. Accessibility does not imply sharing the reporting person’s identity with every participating company or publishing the report in the general contractor-coordination file accessible across the site.
Sources: [1]
Conditions for protection and its limits
Article 35 requires reasonable grounds to believe the information was true when reported and fell within the law’s scope, together with compliance with the requirements for the chosen reporting route. Conclusive proof is not required. An investigation that ultimately does not substantiate the allegation does not, by itself, make the reporting person a malicious complainant.
The law contains exclusions, including certain exclusively interpersonal disputes, mere rumours and information outside its scope. Proper intake distinguishes those situations from potentially relevant breaches and routes matters to other mechanisms where appropriate. A complaint falling outside Law 2/2023 does not authorise retaliation or remove other applicable duties concerning prevention, equality, harassment response or access to judicial remedies.
Sources: [1]
Internal systems, responsibility and covered entities
Article 10 requires internal reporting systems for private entities with fifty or more workers, among other categories. Certain sectors and entities are subject to specific obligations regardless of that threshold; public-sector requirements appear in article 13. A small organisation should not decide its legal position merely by looking at a workforce counter.
Management must approve the system and procedure, conduct the legally required prior consultation with worker representatives and appoint a responsible person with independence and resources. AIPI Recommendation 1/2026 helps with system organisation but is not binding legislation. Purchasing an application or outsourcing services does not replace governance responsibilities, safeguards or oversight of how reports are handled in practice.
Internal and external channels are not mandatory stages
Internal reporting is preferred where it can deal effectively with the breach and the person considers there is no risk of retaliation. Article 16 allows direct reporting to the competent external channel or reporting there after using the internal one. A blanket requirement to notify the allegedly implicated supervisor first or exhaust every company level would be inappropriate.
External competence depends on the public or private sector, territorial effects and autonomous-community rules. AIPI explains the allocation of responsibilities and agreements that may affect practical arrangements. Check the current authority and channel before filing. The organisation must explain that alternative clearly, without framing external reporting as disloyalty or guaranteeing the outcome of investigations conducted by another authority.
Anonymous reporting and protection of identity
Internal channels must allow anonymous reports to be submitted and processed. This differs from an identified report whose source remains confidential. Provide a secure way to supply further information and receive responses, avoiding unnecessary exposure through shared accounts, visible notifications or document metadata that may identify the reporting person.
Confidentiality must not be promised as absolute secrecy against every authority. Article 33 allows identity to be communicated to judicial bodies, prosecutors or the competent administrative authority in specified proceedings and subject to safeguards. The person concerned by the allegations does not receive the reporter’s identity. Technical access also needs controls: administering a tool should not automatically provide unrestricted access to the contents of every case.
Sources: [1]
Receipt, investigation and feedback in the internal system
The internal procedure must provide acknowledgement within seven calendar days unless confidentiality would be jeopardised. Article 9 regulates the maximum period for feedback on investigation activity, normally three months, the applicable starting point and an extension of up to another three months for particularly complex cases. These periods do not permit postponing action to correct a dangerous condition.
Case management distinguishes acceptance, information gathering, assessment, measures and the appropriate response. Respect the presumption of innocence, reputation and the affected person’s opportunity to be heard at a time compatible with the investigation. Where facts indicate a possible criminal offence, apply the legally required referral. An automated severity label must not be turned into a finding of guilt against a named individual.
Sources: [1]
Separate investigation from urgent risk control
A report that a machine guard has been removed may require immediate assessment and control even before its eligibility for the reporting system is resolved. Duties concerning serious and imminent danger under Spain’s Occupational Risk Prevention Act have their own operational requirements. The information channel does not replace emergency alerts, preventive responsibilities or legally established worker rights.
The system manager can coordinate an intervention by sharing only what is needed to control the hazard while protecting identities. The Labour Inspectorate also offers routes for complaints and communications about employment irregularities. Each route has its own purpose and requirements. Record what was referred, to whom and why, without multiplying sensitive copies or assuming that opening an internal case suspends other procedural deadlines.
Preventing and monitoring retaliation
The prohibition covers retaliation, threats and attempted retaliation. It may involve employment decisions, financial disadvantages, intimidation or other forms addressed by the law. Protection does not create immunity from every lawful management decision unrelated to the report: facts, the connection with reporting and applicable safeguards must be examined without automatic findings of wrongdoing.
In proceedings before courts or other authorities, article 38.4 presumes retaliation once the reporting person reasonably demonstrates having made a protected report and having suffered detriment. The person who took the detrimental measure must then prove that it was based on duly justified grounds unrelated to the report.
As an organisational practice, offer a confidential route for reporting possible retaliation and review relevant changes through authorised people without conflicts of interest. Do not automatically transfer the reporting person as the sole remedy without assessing the consequences. Seek applicable support and protection measures from the competent authority. It would be incorrect to promise that an internal policy alone guarantees immunity from judicial proceedings.
Sources: [1]
Personal data, records and retention
Articles 26 and 29–33 require restricted and proportionate processing. The system is not a general repository for medical histories, personal opinions or complete workforce records. Separate data needed to decide whether to investigate, investigation material and operational records, with their respective purposes and retention rules rather than treating everything as one permanent archive.
The article 32 three-month rule for reports without an investigation initiated has conditions and exceptions; the ten-year maximum for the reporting register does not require everything to be kept for ten years. Specific deletion rules also address unnecessary data and special categories. The organisation must resolve these processing questions with data-protection advice and secure access, without automatically transferring health information into an EHS management dashboard.
Hypothetical example involving a contractor
A contractor’s technician reports repeated alteration of installation-check records. She gives dates and describes what she observed without extracting complete databases or accessing systems for which she has no authorisation. The channel manager examines legal scope, verifies a safe contact method and prevents an implicated person from conducting the investigation into their own alleged conduct.
Meanwhile, the prevention team assesses the equipment’s current condition and implements necessary controls using limited information. The case file preserves decisions and lawfully obtained evidence; the report alone proves neither falsification nor individual responsibility. If checks do not substantiate the concern, record that outcome while maintaining applicable safeguards. This is an organisational illustration, not an actual case or a predetermined legal decision.
Indicators and the relationship with EHS management
Indicators may examine channel accessibility, documented compliance with deadlines, resolved conflicts of interest, verified corrective actions and follow-up of possible retaliation. These are management proposals; a low reporting volume does not prove that breaches are absent and may reflect lack of awareness or fear. Aggregate reports must prevent individuals being identified through small groups or distinctive case details.
An EHS connection can transfer a corrective task, its owner and verification without copying identities or sensitive narratives. Check permissions, auditability, retention and responsibilities before integrating tools. An ordinary incident register does not automatically become a system compliant with Law 2/2023. Its preventive value comes from correcting conditions and maintaining safeguards, rather than accumulating files or publicising unverified suspicions.
Frequently asked questions
Does this law protect every occupational-safety complaint?
Not automatically. The scope and conditions of Law 2/2023 must be checked. Other employment and preventive safeguards may still apply outside that law.
Must the internal channel be used first?
Not as a general rule. The law permits direct reporting to the competent external channel; internal reporting is preferred where effective handling is possible and retaliation is not feared.
Can someone report anonymously?
Yes. Internal channels must allow anonymous reports. Confidentiality for an identified report is a separate safeguard.
Must risk correction wait until the investigation closes?
No. Urgent preventive assessment and control have their own requirements and must be coordinated while protecting necessary information and confidentiality.
