New regulations on internal information channels: obligations and deadlines for companies

Our colleagues at Mylegalinbox, members of the Tech Tourism Cluster, share the key updates of Law 2/2023, dated 20 February, which regulates the protection of whistleblowers and strengthens the fight against corruption.

Starting 1 September 2025, all companies with 50 or more employees will be required to notify the Independent Authority for Whistleblower Protection (A.A.I.) of the person responsible for the Internal Information System, also known as the whistleblowing channel. This system must ensure confidentiality, allow anonymous reporting, and be managed securely.

The deadline to submit this notification is 1 November 2025. Failure to comply may lead to serious penalties, including fines of up to €1,000,000, as well as the possible prohibition from contracting with public administrations or receiving subsidies.

This law represents an important step forward in transparency, business ethics, and corporate governance, all highly relevant aspects for companies in the tourism sector. Proper implementation helps to build greater trust among clients, employees, and strategic partners.

Want to learn more? The experts at Mylegalinbox have prepared a detailed report to help understand the new legislation. Download it here.

They also provides specialised legal advice to help tourism companies implement the Internal Information System and appoint the corresponding officer, ensuring safe and efficient legal compliance.

For more information or support, please contact:
 📞 Júlia Forn Sala, Lawyer specialised in Administrative Law and Regulated Sectors
📧 julia@mylegalinbox.com