Law 2/2023 of 20 February (Ley 2/2023), on the protection of persons who report regulatory breaches, is not a law for companies alone: its Article 13 requires every entity that forms part of local government, including the smallest local councils, to have an internal reporting system. A municipality of 800 inhabitants with three employees can hardly set up a channel with a system manager, deadlines, a register of reports (libro-registro) and confidentiality safeguards, and the law recognises this: Article 14 allows municipalities with fewer than 10,000 inhabitants to share the system with each other or with other public authorities in their autonomous community (region), which in practice makes the provincial councils (Diputaciones) the natural place to provide it. This guide explains, as at 16 September 2026, what the system requires, how a shared one is organised, how it relates to the external channel of the Independent Whistleblower Protection Authority (Autoridad Independiente de Protección del Informante, AIPI) and what the software behind it must provide. We cover the general approach for a private company in the mandatory whistleblowing channel: how to comply with Law 2/2023; here we focus on local government.

Who is bound in the public sector

Article 13 of Law 2/2023 extends the obligation to central government (Administración General del Estado), the autonomous communities, local authorities, the public bodies and entities attached to or dependent on them, independent administrative authorities, public universities, public-law corporations, public sector foundations and companies that are majority publicly owned. There is no threshold for headcount or population: every local council is required to have an internal reporting system that its employees and the people who deal with it can turn to.

The deadlines have already passed: public authorities had to have the system in place three months after the law came into force, in June 2023, and municipalities with fewer than 10,000 inhabitants had until 1 December 2023. In many cases what remains to be done is not to meet a deadline but to replace a makeshift solution (an email address, a form with no safeguards) with a system that complies with the law.

The shared system under Article 14

Article 14 opens up two ways of sharing for the public sector:

Municipalities with fewer than 10,000 inhabitants may share the internal reporting system and the resources for handling reports with each other or with any other public authority in their autonomous community.
Entities attached to or dependent on territorial authorities (central, regional or local government) may, if they have fewer than 50 employees, share the system with the authority they depend on.

Sharing has a clear limit: the systems must be guaranteed to be independent of one another and to appear distinct from the other systems of the entity that provides them, so that a report addressed to council A is not seen by anyone at council B, or by anyone in the provincial council’s service other than the designated system manager. Sharing the platform and the expertise, yes; mixing up the case files, no.

The provincial council, which under Law 7/1985 on the basic rules of local government (Ley 7/1985 de Bases del Régimen Local) already provides e-government services to municipalities with fewer than 20,000 inhabitants, is usually the one that offers the system: a single platform with a separate space for each council, one system manager per entity (or a common one formally appointed by each of them) and a technical team that keeps the tool running.

What the system requires, shared or not

The requirements are the same as for any entity bound by the law, adapted to the public sector:

System manager (Article 8): appointed by the entity’s competent body, this may be an individual or a collegiate body, acting independently and autonomously and taking no instructions in the performance of its duties; the appointment is notified to the AIPI or to the regional authority.
Internal channel (Article 7) that allows reports to be made in writing, orally or both, including at a face-to-face meeting if the whistleblower asks for one, and that accepts anonymous reports.
Public information: on the entity’s website, in a separate and easily identifiable section, about how to use the internal channel and about the principles of the external channel.
Acknowledgement of receipt within seven calendar days and a response within a maximum of three months, extendable by a further three in particularly complex cases.
Register of the reports received and of the internal investigations, with confidentiality safeguards, not public and accessible only to the competent judicial authority; the data is kept only for as long as is strictly necessary and never for more than ten years.
Approved handling procedure, with the stages of receipt, admission, investigation, conclusion and communication of the outcome.
Confidentiality of the identity of the whistleblower and of any third parties mentioned, and a ban on retaliation for two years.
Data protection (Articles 29 to 33): processing limited to the purpose, access restricted to the system manager and to whoever handles the investigations, deletion after three months if the report is not admitted, and an impact assessment where required.
Integration of channels: if the entity already had reporting channels (for harassment or procurement, for example), the internal system brings them together under the same management.

How to organise a shared system from the provincial council

An agreement, or a formal cooperation agreement (convenio), between the provincial council and each participating local council, setting out who does what: the provincial council provides the platform and the support; each local council appoints its system manager and approves its procedure (or adopts a model one).
Formal appointment of the system manager by the full council (Pleno) or the mayor’s office (Alcaldía) of each municipality, notified to the competent authority. The same manager may serve several municipalities if each one expressly appoints them.
A platform with independent spaces: one channel per entity, with its own URL or access from its e-office (sede electrónica), its own users and its own register, with no cross-visibility.
A model procedure adapted to local government: receipt, a check that the matter falls within the entity’s remit, admission, investigation with the right to be heard, referral to the Public Prosecutor’s Office (Ministerio Fiscal) where the facts may amount to a criminal offence, conclusion and communication.
Information on each municipal website: a dedicated section on the internal channel and on the AIPI’s external channel.
Training for the system managers and for the secretary-comptrollers (secretarios-interventores, the officials who act as both clerk and financial controller in small councils), who are the ones who will receive the first reports.
Monitoring: the provincial council maintains the tool and keeps track of the deadlines; each local council answers for its own case files.

The AIPI’s external channel

The external channel of the Independent Whistleblower Protection Authority has been operational since 1 September 2025, and anyone may turn to it directly or after using the internal channel. Some autonomous communities have their own external authority for the public authorities within their remit. The internal channel does not replace the external one, or vice versa: the law prefers information to be reported internally first, but the choice is the whistleblower’s. For a local council, having an internal channel that works is the way to find out about problems and resolve them before they reach the external authority, which does have the power to require anyone without a system to put one in place.

What the software must provide

Multi-entity design with genuine isolation: each council is an independent space, with its own system manager, users, register and configuration, on a shared platform.
Written and oral channel: a form with attachments, voicemail or recording with consent, and booking of a face-to-face meeting, with a transcript or minutes.
Technical anonymity: reporting with no identifying data, with a tracking code so that the whistleblower can check the status and add information without revealing who they are.
Automatic deadlines: acknowledgement within seven days, and the three-month deadline with alerts and a reasoned extension.
A register that complies with the law, with access control, traceability of every access and retention limited to ten years.
Case management: stages, tasks, communications with the whistleblower and with the person concerned, referral to the Public Prosecutor’s Office, closure and aggregate statistics.
Data protection: encryption, data minimisation, automatic deletion after three months of anything not admitted, a record of processing activities and evidence for the impact assessment.
Integration with the e-office and with the case management system, with the separation the law requires.
ENS conformity: the system processes particularly sensitive data and must fall within the entity’s or the supplier’s scope under the National Security Framework (Esquema Nacional de Seguridad, ENS), as we explain in what to require of a council’s software supplier as regards the ENS.

How CEDESA does it

CEDESA develops custom software for the public sector, with case management systems and e-offices for provincial councils such as the Diputaciones de Badajoz, Toledo and Ourense, which provide services to the local councils in their provinces. A shared internal reporting system fits that model: a common platform with isolated spaces for each entity, each with its own system manager and procedure, automatic deadlines and register, integration with the e-office and the case management system, and all of it within our medium-category ENS certification and ISO 27001, which is what processing of this kind requires. We set out how a case management system fits with Law 39/2015 (Ley 39/2015) and the National Interoperability Framework (ENI) in what a custom case management system must comply with.

Frequently asked questions about the internal channel in small councils

Is a council with fewer than 10,000 inhabitants required to have a whistleblowing channel?

Yes. Article 13 of Law 2/2023 binds every entity that forms part of local government, with no threshold for population or headcount. What Article 14 allows is for municipalities with fewer than 10,000 inhabitants to share the internal reporting system with each other or with other public authorities in their autonomous community.

Can the provincial council manage its municipalities’ whistleblowing channel?

It can provide the platform and the handling resources as a shared system, provided that each local council appoints its own system manager, that the systems are independent of one another and that they appear distinct from the provincial council’s other systems. Each municipality’s case files must not be visible to the others.

What deadlines does a council’s internal channel have to meet?

Acknowledgement of receipt to the whistleblower within seven calendar days and a response within a maximum of three months, extendable by a further three in particularly complex cases. Reports that are not admitted are deleted after three months, and the register is kept only for as long as is strictly necessary, never for more than ten years.

Must a council’s channel accept anonymous reports?

Yes. Article 7 of Law 2/2023 requires the internal channel to allow anonymous reports as well as identified ones, in writing or orally, and to let the whistleblower follow up and add information without revealing their identity.

How does the municipal internal channel relate to the AIPI’s external channel?

They are complementary. The external channel of the Independent Whistleblower Protection Authority has been operational since 1 September 2025 and anyone may turn to it directly or after using the internal channel; the law prefers internal reporting but does not impose it. An internal channel that works lets the council find out about the facts and resolve them sooner.

Conclusion

Every local council is required to have an internal reporting system, and those with fewer than 10,000 inhabitants can comply by sharing the platform with other municipalities or with their provincial council, always with their own system manager, independent spaces and the same safeguards on anonymity, deadlines, the register and data protection. The difference between a channel that complies and a form that does not lies in the software and in the organisation behind it. If your provincial or local council wants to sort this out in one go for all its municipalities, tell us how many there are and what they have today.