https://ethicsportal.eu/authorities/EthicsPortal is a secure, anonymous whistleblower reporting platform that helps organizations comply with EU Directive 2019/1937.enTue, 22 Sep 2026 22:30:51 +0000https://ethicsportal.eu/images/logo.svghttps://ethicsportal.eu/https://ethicsportal.eu/authorities/france-defenseur-des-droits/Mon, 21 Sep 2026 00:00:00 +0000https://ethicsportal.eu/authorities/france-defenseur-des-droits/Reference on the Défenseur des droits under Loi Waserman: why France designated no single whistleblowing authority, what the institution can and cannot do, the schedule of competent external authorities, the statutory deadlines, and how a report reaches it.<h1 id="frances-whistleblower-authority--défenseur-des-droits"> France’s whistleblower authority — Défenseur des droits <a href="#frances-whistleblower-authority--d%c3%a9fenseur-des-droits" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h1> <p>The <strong>Défenseur des droits</strong> is the independent constitutional authority that orients whistleblowers, certifies their status and defends them against retaliation under the framework created by <strong>Loi Waserman</strong>.</p> <p>It is not France’s external reporting channel. France is the outlier among the large member states: it designated <strong>no single whistleblowing authority</strong>. Understanding that distinction is the practical point of this page — for the duty to operate an internal channel, the thresholds and the penalties, see <a href="/whistleblower-laws/france/">whistleblower law in France</a> .</p> <h2 id="why-france-has-no-single-authority"> Why France has no single authority <a href="#why-france-has-no-single-authority" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h2> <p>Spain built one body, the AIPI, to run a national external channel. Italy gave the job to ANAC. France did neither.</p> <p>Instead, <strong>Décret n° 2022-1284 du 3 octobre 2022</strong> publishes a schedule of <strong>competent external authorities</strong>, each receiving reports within its own sector — around twenty-three headings covering financial services, competition, the environment, health, and more. The Défenseur des droits sits alongside that schedule with a different job: it <strong>orients</strong> a whistleblower to the right authority, <strong>certifies</strong> their status, and <strong>protects</strong> them. It does not act as a general-purpose external channel for every subject matter.</p> <p>The consequence for an employer is concrete. There is no single regulator to name in an internal procedure. The procedure has to point a reporting person at the schedule, and at the Défenseur des droits as the route for anyone who does not know which authority applies.</p> <h2 id="what-the-défenseur-des-droits-is"> What the Défenseur des droits is <a href="#what-the-d%c3%a9fenseur-des-droits-is" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h2> <table> <thead> <tr> <th></th> <th></th> </tr> </thead> <tbody> <tr> <td>Legal nature</td> <td>Independent constitutional authority (<strong>art. 71-1 of the Constitution</strong>), created in 2011</td> </tr> <tr> <td>Governing statute</td> <td><strong>Loi organique n° 2011-333 du 29 mars 2011</strong>, as amended</td> </tr> <tr> <td>Whistleblower mandate from</td> <td><strong>Loi organique n° 2022-400 du 21 mars 2022</strong>, the organic law passed alongside Loi Waserman</td> </tr> <tr> <td>Current officeholder</td> <td><strong>François-Noël Buffet</strong>, since <strong>23 July 2026</strong> (décret du 22 juillet 2026), succeeding Claire Hédon</td> </tr> <tr> <td>Term</td> <td><strong>Six years, neither renewable nor revocable</strong>; the office may not be held alongside any other</td> </tr> <tr> <td>Deputy for whistleblowers</td> <td><em>Adjoint chargé de l’accompagnement des lanceurs d’alerte</em> — the post created by art. 2 of the organic law; <strong>listed as awaiting appointment</strong> following the July 2026 change of officeholder</td> </tr> </tbody> </table> <p>A whistleblower framework depending on a deputy who is not currently in post is worth knowing before an internal procedure promises a reporting person that support exists.</p> <h2 id="what-the-organic-law-actually-changed"> What the organic law actually changed <a href="#what-the-organic-law-actually-changed" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h2> <p>Loi organique n° 2022-400 amended the 2011 statute in four places:</p> <ol> <li><strong>Article 1</strong> — the mission moves from <em>watching over</em> the rights of whistleblowers to <strong>informing, advising and defending</strong> them, and those protected within an alert procedure (amending art. 4(5)).</li> <li><strong>Article 2</strong> — creates the <strong>adjoint chargé de l’accompagnement des lanceurs d’alerte</strong> (art. 11).</li> <li><strong>Article 3</strong> — inserts <strong>art. 35-1</strong>: any whistleblower within the meaning of Loi n° 2016-1691 may address a report to the Défenseur des droits, which handles it under an <strong>independent and autonomous procedure</strong>, refers it onward where it is not competent, and may issue an <strong>opinion on whistleblower status within six months</strong> of the request.</li> <li><strong>Article 4</strong> — requires a <strong>biennial report</strong> on the overall functioning of whistleblower protection, presented to the President of the Republic and the presidents of both chambers, built from data supplied by all the competent authorities (art. 36 II).</li> </ol> <h2 id="the-three-missions"> The three missions <a href="#the-three-missions" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h2> <p><strong>Information and orientation.</strong> It answers questions on the rules and directs a reporting person to the authority competent for the subject matter — the function that carries most of the load, given the schedule of authorities.</p> <p><strong>An opinion on whistleblower status.</strong> Anyone may ask the Défenseur des droits to confirm that they meet the statutory definition. The opinion is issued <strong>within six months</strong>. It matters because the protections attach to the status, and a person who is unsure whether they qualify is otherwise deciding alone whether to rely on them.</p> <p><strong>Protection against retaliation.</strong> The protection covers not only the whistleblower but <strong>facilitators</strong> — the people or bodies who helped them — and third parties connected to the report.</p> <h2 id="what-it-cannot-do"> What it cannot do <a href="#what-it-cannot-do" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h2> <p>This is where French practice most often goes wrong.</p> <ul> <li><strong>It does not investigate most alerts.</strong> As an investigating body it retains only its four historic domains: <strong>children’s rights, the rights of users of public services, the professional ethics of security personnel, and discrimination.</strong> An alert about, say, accounting fraud or an environmental breach is oriented to the competent authority, not investigated here.</li> <li><strong>It does not resolve the employment dispute or award compensation.</strong> Retaliation claims go to the <strong>Conseil de prud’hommes</strong>. The institution’s role is protection and status, not remedy.</li> <li><strong>It does not replace the employer’s internal procedure</strong>, and using it is not conditional on having exhausted one — a reporting person may go external from the outset.</li> </ul> <h2 id="deadlines-for-external-reporting"> Deadlines for external reporting <a href="#deadlines-for-external-reporting" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h2> <p>The decree’s external deadlines are not the same as the internal ones, which is the most common confusion.</p> <table> <thead> <tr> <th></th> <th>External authority</th> <th>Employer’s internal procedure</th> </tr> </thead> <tbody> <tr> <td>Acknowledgment of receipt</td> <td><strong>7 working days</strong> from receipt</td> <td><strong>7 working days</strong> from receipt</td> </tr> <tr> <td>Feedback to the reporting person</td> <td><strong>3 months</strong> from the acknowledgment — or from the expiry of the seven working days where no acknowledgment was sent</td> <td><strong>3 months</strong> from the acknowledgment</td> </tr> <tr> <td>Extension</td> <td>To <strong>6 months</strong> where the circumstances require further investigation, justified before the three months expire</td> <td>—</td> </tr> </tbody> </table> <p>The acknowledgment may be omitted where the reporting person expressly waived it, or where the authority has reasonable grounds to believe that acknowledging receipt would compromise the confidentiality of their identity.</p> <p>Where an authority finds a report falls outside its competence, or only partly within it, <strong>art. 10(II) of the decree requires it to forward the report promptly</strong> to the competent external authority or to the Défenseur des droits, preserving confidentiality.</p> <h2 id="how-a-report-reaches-it"> How a report reaches it <a href="#how-a-report-reaches-it" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h2> <table> <thead> <tr> <th></th> <th></th> </tr> </thead> <tbody> <tr> <td>Telephone</td> <td><strong>09 69 39 00 00</strong>, Monday to Friday, 8.30–19.30</td> </tr> <tr> <td>Online</td> <td><a href="https://formulaire.defenseurdesdroits.fr" rel="nofollow">formulaire.defenseurdesdroits.fr</a> </td> </tr> <tr> <td>Post (free, no stamp)</td> <td>Défenseur des droits, <strong>Libre réponse 71120, 75342 Paris Cedex 07</strong></td> </tr> </tbody> </table> <p>For postal reports the institution asks for a <strong>double envelope</strong>, the inner one marked <strong>« SIGNALEMENT D’UNE ALERTE »</strong> — the handling route that keeps the report away from ordinary correspondence.</p> <p>Disclosing elements that identify a whistleblower is punishable by <strong>two years’ imprisonment and a €30,000 fine</strong>.</p> <h2 id="what-the-2026-biennial-report-found"> What the 2026 biennial report found <a href="#what-the-2026-biennial-report-found" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h2> <p>The second biennial report, <em>La protection des lanceurs d’alerte en France : un dispositif à l’épreuve de son appropriation</em>, was published on <strong>28 May 2026</strong> by Claire Hédon and her deputy Cécile Barrois de Sarigny, covering 2024–2025. Three findings bear on how an employer should run an internal procedure:</p> <ul> <li><strong>External reporting has grown roughly fivefold.</strong> More than <strong>10,000 reports to external authorities in 2025</strong>, against about <strong>2,000 in 2023</strong>. Requests to the Défenseur des droits itself have multiplied by ten since 2017.</li> <li><strong>Retaliation, not intake, is the recurring failure</strong> — most often in the employment relationship.</li> <li>The report presses for <strong>effective financial and psychological support</strong> for whistleblowers, which the framework promises more readily than it delivers.</li> </ul> <p>The first of these is the one to act on. External reporting grows when internal channels are not trusted or not known, and a report that goes straight to a sectoral authority is one the employer learns about from the regulator.</p> <h2 id="official-sources"> Official sources <a href="#official-sources" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h2> <ul> <li><a href="https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000045388740" rel="nofollow">Loi organique n° 2022-400 du 21 mars 2022 — role of the Défenseur des droits</a> </li> <li><a href="https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000045388745" rel="nofollow">Loi n° 2022-401 du 21 mars 2022 (Loi Waserman)</a> </li> <li><a href="https://www.legifrance.gouv.fr/loda/id/JORFTEXT000046357368" rel="nofollow">Décret n° 2022-1284 du 3 octobre 2022 — procedures and the list of external authorities</a> </li> <li><a href="https://www.defenseurdesdroits.fr/orienter-et-proteger-les-lanceurs-dalerte-180" rel="nofollow">Défenseur des droits — orienting and protecting whistleblowers</a> </li> <li><a href="https://www.defenseurdesdroits.fr/le-defenseur-des-droits-et-ses-adjoints-215" rel="nofollow">Défenseur des droits — the institution and its deputies</a> </li> <li><a href="https://www.defenseurdesdroits.fr/rapport-bisannuel-la-protection-des-lanceurs-dalerte-en-france-un-dispositif-lepreuve-de-son-1150" rel="nofollow">Biennial report, 28 May 2026</a> </li> </ul>support@ethicsportal.eu (EthicsPortal)https://ethicsportal.eu/authorities/italy-anac/Sun, 20 Sep 2026 00:00:00 +0000https://ethicsportal.eu/authorities/italy-anac/Reference on ANAC under D.Lgs. 24/2023: the conditions that make external reporting available at all, the channel and platform, the acknowledgment and feedback deadlines, how a case ends, and the administrative fines the Authority can impose.<h1 id="anac--italys-external-reporting-channel"> ANAC — Italy’s external reporting channel <a href="#anac--italys-external-reporting-channel" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h1> <p>The <strong>Autorità nazionale anticorruzione (ANAC)</strong> operates the external reporting channel established by Legislative Decree no. 24 of 10 March 2023. It receives reports, investigates, gives feedback to the reporting person, and imposes the administrative fines the decree provides for.</p> <p>This page is a reference on the Authority: when a person may turn to it at all, how a report is filed, which deadlines apply, what happens next, and what ANAC can fine. For the internal-channel duty, thresholds and personal scope, see <a href="/whistleblower-laws/italy/">whistleblower law in Italy</a> .</p> <h2 id="what-anac-is-for-the-purposes-of-the-decree"> What ANAC is for the purposes of the decree <a href="#what-anac-is-for-the-purposes-of-the-decree" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h2> <table> <thead> <tr> <th></th> <th></th> </tr> </thead> <tbody> <tr> <td>Authority</td> <td>Autorità nazionale anticorruzione (ANAC)</td> </tr> <tr> <td>Source</td> <td><strong>Legislative Decree no. 24 of 10 March 2023</strong>, arts. 6–9 and 21</td> </tr> <tr> <td>Role</td> <td>Operator of the <strong>external reporting channel</strong> (art. 7(1))</td> </tr> <tr> <td>Effective from</td> <td><strong>15 July 2023</strong>; for private entities with up to 249 workers the internal-channel duty runs from <strong>17 December 2023</strong> (art. 24(1) and (2))</td> </tr> <tr> <td>Sanctioning power</td> <td>Administrative fines from <strong>€500 to €50,000</strong> (art. 21)</td> </tr> </tbody> </table> <h2 id="when-external-reporting-is-available-at-all"> When external reporting is available at all <a href="#when-external-reporting-is-available-at-all" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h2> <p>This is what sets Italy apart from most other member states, and it is also the point most often reported incorrectly.</p> <p><strong>External reporting is not a free alternative to internal reporting.</strong> Article 6(1) allows it only where, <em>at the time it is submitted</em>, <strong>one</strong> of these conditions applies:</p> <ul> <li><strong>(a)</strong> the reporting person’s work context provides <strong>no mandatory internal channel</strong>, or the channel, though mandatory, is <strong>not active</strong>, or, though activated, <strong>does not comply</strong> with art. 4;</li> <li><strong>(b)</strong> the reporting person <strong>already made an internal report</strong> under art. 4 and <strong>it was not followed up</strong>;</li> <li><strong>(c)</strong> the reporting person has <strong>well-founded reasons to believe</strong> that an internal report would not be effectively followed up, or that making one could create <strong>a risk of retaliation</strong>;</li> <li><strong>(d)</strong> the reporting person has well-founded reason to believe the breach may constitute an <strong>imminent or manifest danger to the public interest</strong>.</li> </ul> <p>In Spain and Germany the choice between the internal and external route is free. In Italy it is not: someone who goes to ANAC without one of those four conditions is outside the perimeter of art. 6.</p> <h2 id="the-external-channel"> The external channel <a href="#the-external-channel" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h2> <p>ANAC operates a channel that guarantees, <strong>including through the use of encryption</strong>, the confidentiality of the identity of the reporting person, the person concerned and any person mentioned in the report, as well as of the content of the report and its documentation (art. 7(1)).</p> <p>The same confidentiality applies where a report arrives through other channels or reaches staff not assigned to handling reports, to whom it must in any case be transmitted without delay.</p> <p>External reports are made (art. 7(2)):</p> <ul> <li><strong>in writing</strong> through the <strong>online platform</strong>;</li> <li><strong>orally</strong> by telephone line or voice-messaging system;</li> <li><strong>at an in-person meeting</strong>, at the reporting person’s request, arranged within a reasonable time.</li> </ul> <p>The Authority’s platform is at <a href="https://whistleblowing.anticorruzione.it/" rel="nofollow">whistleblowing.anticorruzione.it</a> .</p> <p>An external report submitted to a body other than ANAC <strong>must be transmitted to ANAC within seven days</strong> of receipt, with simultaneous notice to the reporting person (art. 7(3)).</p> <h3 id="anonymous-reports"> Anonymous reports <a href="#anonymous-reports" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h3> <p>The decree does <strong>not</strong> require the channel to accept anonymous submissions. The operative rule is art. 16(4): the protections apply <strong>also</strong> to anonymous reports, complaints to the judicial or accounting authorities, and public disclosures <strong>where the reporting person was subsequently identified and suffered retaliation</strong>.</p> <p>Protection therefore does not depend on having given a name when reporting; it engages once the identity surfaces and retaliation follows.</p> <h2 id="deadlines"> Deadlines <a href="#deadlines" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h2> <p>The external and internal deadlines are not the same.</p> <table> <thead> <tr> <th></th> <th>External channel — ANAC</th> <th>Entity’s internal channel</th> </tr> </thead> <tbody> <tr> <td>Acknowledgment of receipt</td> <td><strong>Seven days</strong> from receipt, unless the reporting person requests otherwise or the acknowledgment would prejudice the confidentiality of their identity (art. 8(1)(b))</td> <td><strong>Seven days</strong> from receipt (art. 5(1)(a))</td> </tr> <tr> <td>Feedback</td> <td><strong>Three months</strong>, or <strong>six months where justified and reasoned grounds exist</strong>, from the acknowledgment or, failing that, from the expiry of the seven days (art. 8(1)(f))</td> <td><strong>Three months</strong> from the acknowledgment or, failing that, from the expiry of the seven days (art. 5(1)(d))</td> </tr> </tbody> </table> <p>The extension to six months is available <strong>only on the external channel</strong>; the internal deadline cannot be extended. That is the same shape as Germany and the opposite of Spain, where the internal deadline extends and the external one is hard.</p> <h2 id="what-anac-does-after-a-report"> What ANAC does after a report <a href="#what-anac-does-after-a-report" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h2> <p>The Authority designates specifically trained staff and carries out the activities listed in art. 8(1):</p> <ol> <li><strong>Inform</strong> any interested person about the use of the external and internal channels and about the Chapter III protection measures.</li> <li><strong>Acknowledge receipt</strong> within seven days.</li> <li><strong>Maintain contact</strong> with the reporting person and request further material if needed.</li> <li><strong>Diligently follow up</strong> the reports received.</li> <li><strong>Carry out the investigation</strong>, including by <strong>hearings and obtaining documents</strong>.</li> <li><strong>Give feedback</strong> within the deadlines above.</li> <li><strong>Communicate the final outcome</strong>, which may be <strong>archiving</strong>, <strong>transmission to the competent authorities</strong>, a <strong>recommendation</strong>, or an <strong>administrative fine</strong>.</li> </ol> <h3 id="limits-on-what-it-will-do"> Limits on what it will do <a href="#limits-on-what-it-will-do" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h3> <ul> <li><strong>Lack of competence.</strong> Reports outside ANAC’s competence are sent to the competent administrative or judicial authority, including EU institutions and bodies, with simultaneous notice to the reporting person. The receiving authority performs the activities under letters (c), (d), (e), (f) and (g) and guarantees the same confidentiality (art. 8(2)).</li> <li><strong>Prioritisation.</strong> Where there is a significant influx, ANAC <strong>may give priority</strong> to reports concerning breaches involving serious harm to the public interest or harm to principles of constitutional or EU-law rank (art. 8(4)).</li> <li><strong>Minor breaches.</strong> ANAC <strong>may decline to follow up</strong> reports of minor breaches and archive them (art. 8(5)).</li> </ul> <p>ANAC also transmits annually to the European Commission the number of external reports received, the number and types of proceedings opened and their outcome, and, where established, the financial damage caused and the amounts recovered (art. 8(3)).</p> <h2 id="fines"> Fines <a href="#fines" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h2> <p>Unlike several of its counterparts, <strong>ANAC imposes administrative fines directly</strong> (art. 21(1)):</p> <table> <thead> <tr> <th>Amount</th> <th>Conduct established</th> </tr> </thead> <tbody> <tr> <td><strong>€10,000–50,000</strong></td> <td>Retaliation; a report obstructed or an attempt to obstruct it; breach of the confidentiality obligation under art. 12 (lit. a)</td> </tr> <tr> <td><strong>€10,000–50,000</strong></td> <td><strong>Failure to establish reporting channels</strong>; failure to adopt procedures for making and managing reports, or adoption of procedures that do not comply with arts. 4 and 5; <strong>failure to carry out the verification and analysis</strong> of the reports received (lit. b)</td> </tr> <tr> <td><strong>€500–2,500</strong></td> <td>The case under art. 16(3), unless the reporting person has been convicted, including at first instance, of defamation or malicious accusation (lit. c)</td> </tr> </tbody> </table> <p>Two features deserve attention. First, letter (b) does not only penalise the absence of a channel: <strong>non-compliant procedures</strong> and <strong>failure to verify and analyse</strong> the reports received sit in the same band — operating a channel nobody investigates is the same offence as having none. Second, the fines are applied <strong>to the person responsible</strong>, and private-sector entities under art. 2(1)(q)(3) must provide for sanctions in the disciplinary system adopted under art. 6(2)(e) of Legislative Decree 231/2001 (art. 21(2)).</p> <h2 id="protection-against-retaliation"> Protection against retaliation <a href="#protection-against-retaliation" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h2> <p>The protections operate where the person made an internal report, an external report or a public disclosure on the decree’s terms. Retaliation is prohibited (art. 17), and <strong>waivers and settlements</strong>, whole or partial, concerning the rights and protections the decree provides <strong>are invalid</strong> unless made in the forms of art. 2113, fourth paragraph, of the Civil Code (art. 22).</p> <p>The protections are not guaranteed, and a disciplinary sanction is imposed on the reporting person, in the cases of intent or gross negligence established under art. 16(3).</p> <h2 id="the-authoritys-contact-points"> The Authority’s contact points <a href="#the-authoritys-contact-points" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h2> <table> <thead> <tr> <th></th> <th></th> </tr> </thead> <tbody> <tr> <td>Reporting platform</td> <td><a href="https://whistleblowing.anticorruzione.it/" rel="nofollow">whistleblowing.anticorruzione.it</a> </td> </tr> <tr> <td>Offices</td> <td>Palazzo Sciarra, Via Minghetti 10, 00187 Rome</td> </tr> <tr> <td>Institutional site</td> <td><a href="https://www.anticorruzione.it/" rel="nofollow">anticorruzione.it</a> </td> </tr> </tbody> </table> <p>Article 9 requires ANAC to publish, in a dedicated, easily identifiable and accessible section, the protection measures, its own contact details (stating whether telephone conversations are recorded), instructions on using the channels, the confidentiality regime, the feedback deadlines and the types of follow-up it can give, and the list of third-sector bodies it has agreements with.</p> <h2 id="official-sources"> Official sources <a href="#official-sources" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h2> <ul> <li><a href="https://www.gazzettaufficiale.it/eli/id/2023/03/15/23G00032/sg" rel="nofollow">Legislative Decree no. 24 of 10 March 2023 — Gazzetta Ufficiale no. 63 of 15 March 2023</a> </li> <li><a href="https://www.anticorruzione.it/-/whistleblowing" rel="nofollow">ANAC — whistleblowing</a> </li> <li><a href="https://whistleblowing.anticorruzione.it/" rel="nofollow">ANAC — external reporting platform</a> </li> <li><a href="https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32019L1937" rel="nofollow">Directive (EU) 2019/1937 — EUR-Lex</a> </li> </ul>support@ethicsportal.eu (EthicsPortal)https://ethicsportal.eu/authorities/germany-bfj/Sun, 20 Sep 2026 00:00:00 +0000https://ethicsportal.eu/authorities/germany-bfj/Reference on the externe Meldestelle des Bundes under the HinSchG: legal basis, how competence is split with BaFin, the Bundeskartellamt and the Länder offices, the reporting channels, the statutory deadlines, and what happens after a report.<h1 id="germanys-federal-external-reporting-office"> Germany’s federal external reporting office <a href="#germanys-federal-external-reporting-office" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h1> <p>The <strong>externe Meldestelle des Bundes</strong> at the Bundesamt für Justiz is Germany’s federal point of contact for external reports under the Hinweisgeberschutzgesetz. It receives reports, checks whether they are substantiated, and takes follow-up measures.</p> <p>This page is a reference on the office itself: what it is, what it is and is not competent for, how a report reaches it, which deadlines apply, and what happens next. For the duty to operate an internal reporting office, the thresholds and the fines, see <a href="/whistleblower-laws/germany/">whistleblower law in Germany</a> .</p> <h2 id="what-the-office-is"> What the office is <a href="#what-the-office-is" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h2> <table> <thead> <tr> <th></th> <th></th> </tr> </thead> <tbody> <tr> <td>Name</td> <td>Externe Meldestelle des Bundes (§ 19(1) HinSchG)</td> </tr> <tr> <td>Legal basis</td> <td><strong>Hinweisgeberschutzgesetz (HinSchG)</strong>, in force since 2 July 2023</td> </tr> <tr> <td>Host body</td> <td>Established <strong>at the Bundesamt für Justiz</strong>, organisationally separated from the rest of that office (§ 19(1))</td> </tr> <tr> <td>Independence</td> <td>Its tasks are performed independently of the Bundesamt’s other tasks; it is subject to administrative supervision only insofar as its independence is not impaired (§ 19(2))</td> </tr> <tr> <td>Competence</td> <td><strong>Residual</strong> — competent unless an office under §§ 20 to 23 is competent (§ 19(4))</td> </tr> </tbody> </table> <p>One structural point matters more than any other here: Germany did <strong>not</strong> create a standalone independent authority. It created an organisationally separated unit <strong>inside</strong> an existing federal office. The independence comes from how its tasks are performed and from the limits on supervision, not from separate legal personality — a materially different design from, for example, <a href="/authorities/spain-aipi/">Spain’s AIPI</a> , which the law constitutes as an independent authority with its own legal personality.</p> <h2 id="functions"> Functions <a href="#functions" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h2> <p>§ 24 HinSchG gives the external reporting offices three sets of duties:</p> <ol> <li><strong>Establish and operate reporting channels</strong> under § 27, check whether a report is substantiated, and conduct the § 28 procedure (para. 1).</li> <li><strong>Provide comprehensive and independent information and advice</strong> on available remedies and on procedures for protection against retaliation — expressly including information about the option of reporting internally (para. 2).</li> <li><strong>Publish specified information</strong> in a separate, easily identifiable and easily accessible section of their website (para. 3): the conditions for protection, an explanation of the reporting procedure and the possible follow-up measures, the confidentiality regime and personal-data processing, available remedies and the availability of confidential advice, a plain explanation of when a reporting person cannot be held liable for breaching confidentiality obligations, and its contact details.</li> </ol> <h2 id="competence-and-its-limits"> Competence, and its limits <a href="#competence-and-its-limits" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h2> <p>The federal office is <strong>not</strong> competent for everything. The HinSchG divides it:</p> <table> <thead> <tr> <th>Office</th> <th>Competent for</th> </tr> </thead> <tbody> <tr> <td><strong>Externe Meldestelle des Bundes</strong> (§ 19)</td> <td>Everything not assigned to one of the offices below</td> </tr> <tr> <td><strong>Länder external reporting offices</strong> (§ 20)</td> <td>Reports concerning that Land’s administration and its municipal administrations — each Land <strong>may</strong> establish one</td> </tr> <tr> <td><strong>BaFin</strong> (§ 21)</td> <td>Reports covered by § 4d FinDAG, including the WpÜG; money laundering where BaFin is the competent authority under § 50(1) nos. 1 or 2 GwG; breaches under § 2(1) no. 3 lit. r to t</td> </tr> <tr> <td><strong>Bundeskartellamt</strong> (§ 22)</td> <td>Breaches under § 2(1) nos. 8 and 9</td> </tr> <tr> <td><strong>Further external reporting office</strong> (§ 23)</td> <td>Reports concerning the federal office itself; conversely, the federal office is the further office for reports concerning the §§ 20 to 22 offices</td> </tr> </tbody> </table> <p>Because establishing a Land office under § 20 is optional, reports about the administration of a Land that has not set one up fall back to the federal office under § 19(4).</p> <p><strong>Where the office is not competent</strong>, or cannot pursue the reported breach within a reasonable time, it forwards the report without delay to the body responsible for investigating it, preserving the confidentiality of the reporting person’s identity, and informs the reporting person of the transfer without delay (§ 31(2)).</p> <h3 id="what-the-office-is-not"> What the office is not <a href="#what-the-office-is-not" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h3> <p>The external reporting office is <strong>not a prosecuting or supervisory authority</strong>. Its follow-up measures are set out exhaustively in § 29(2): contact the employer concerned, refer the reporting person to other competent bodies, close the procedure for lack of evidence or on other grounds, or hand the case to a competent authority for further investigation.</p> <p>It may request information at its dutiful discretion where this is necessary to check whether a report is substantiated (§ 29(1)). The rights to refuse testimony under §§ 53 and 53a StPO and to refuse information under § 55 StPO apply accordingly, and compensation under the JVEG is granted on application for answering such a request.</p> <h2 id="how-to-report"> How to report <a href="#how-to-report" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h2> <p>External reporting channels must allow reports <strong>orally and in text form</strong> (§ 27(3)). Oral reporting must be possible by telephone or another form of voice transmission. At the reporting person’s request, a <strong>personal meeting</strong> must be made possible within a reasonable time; with their consent it may be held by video and audio transmission.</p> <p>Federal reports go through the <a href="https://formulare.bfj.bund.de/ffw/action/invoke.do?id=externeMeldestelle" rel="nofollow">reporting form of the federal external reporting office</a> .</p> <h3 id="anonymity--the-most-frequently-misstated-point"> Anonymity — the most frequently misstated point <a href="#anonymity--the-most-frequently-misstated-point" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h3> <p>§ 27(1) HinSchG says the external reporting office <strong>should</strong> also process anonymously submitted reports. But, subject to specific statutory rules, there is <strong>no obligation to design the channels so that anonymous reports can be submitted</strong>.</p> <p>§ 16(1) uses the same formulation for internal reporting offices. Germany therefore requires an anonymous route neither internally nor externally: processing anonymous reports that do arrive is a “should” provision, and enabling anonymous submission is not a duty at all.</p> <h2 id="deadlines"> Deadlines <a href="#deadlines" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h2> <p>The external and internal deadlines are not the same.</p> <table> <thead> <tr> <th></th> <th>External reporting office</th> <th>Internal reporting office</th> </tr> </thead> <tbody> <tr> <td>Acknowledgment of receipt</td> <td>Promptly, <strong>at the latest seven days</strong> after receipt (§ 28(1))</td> <td><strong>At the latest after seven days</strong> (§ 17(1) no. 1)</td> </tr> <tr> <td>Feedback</td> <td>Within a reasonable time, <strong>at the latest after three months</strong>; <strong>six months</strong> where processing is extensive, with the reasons for the extension communicated (§ 28(4))</td> <td><strong>Three months</strong> from the acknowledgment, or where receipt was not acknowledged, at the latest <strong>three months and seven days</strong> after receipt (§ 17(2))</td> </tr> </tbody> </table> <p>The extension to six months is available only to the <strong>external</strong> office; the internal deadline has no extension. This is the mirror image of Spain, where the internal deadline extends and the external one is hard.</p> <p>An acknowledgment is not sent where the reporting person has expressly waived it, or where there is sufficient reason to assume it would impair the protection of their identity (§ 28(1)). Reports about breaches of particular gravity may be handled as a priority, which does not affect the deadlines (§ 28(5)).</p> <h2 id="what-happens-after-a-report"> What happens after a report <a href="#what-happens-after-a-report" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h2> <ol> <li><strong>Acknowledgment</strong> within seven days. In cases suitable for an internal reporting procedure, the office points out the option of reporting internally together with the acknowledgment (§ 28(1)).</li> <li><strong>Scope check</strong>: does the reported breach fall within § 2, and does no exception under § 5 apply? If it does fall within scope, the office checks whether the report is substantiated and takes appropriate follow-up measures under § 29 (§ 28(2)).</li> <li><strong>Follow-up measures</strong> under § 29(2), as above.</li> <li><strong>Closure</strong> under § 31(1), once the office has checked whether the report is substantiated and conducted the § 28 procedure.</li> </ol> <p>Access to the file is governed by § 29 VwVfG; existing confidentiality and secrecy obligations must be observed, and the rights of the people who are the subject of a report must not be impaired (§ 28(3)).</p> <h2 id="how-internal-and-external-reporting-interact"> How internal and external reporting interact <a href="#how-internal-and-external-reporting-interact" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h2> <p>§ 7(1) gives reporting people a <strong>choice</strong>: they may turn to an internal reporting office (§ 12) or directly to an external one (§§ 19 to 24). The Act expresses a preference — where the breach can be dealt with effectively internally and no retaliation is to be feared, the person <strong>should</strong> prefer the internal route — but does not make it a precondition. Where an internally reported breach was not remedied, the route to the external office remains expressly open.</p> <p>Employers obliged to establish internal reporting offices under § 12 <strong>should create incentives</strong> for reporting internally first (§ 7(3)). Obstructing a report, or the communication that follows one, is prohibited (§ 7(2)) and carries a fine.</p> <p><strong>Public disclosure</strong> is protected (§ 32(1)) where the person first reported externally and either no appropriate follow-up measures were taken within the § 28(4) feedback deadlines or they received no feedback about such measures; or where they had sufficient reason to believe the breach posed an immediate or manifest danger to the public interest, that retaliation was to be feared, or that evidence might be suppressed or destroyed, that the external office might be colluding with the perpetrator, or that for other reasons the prospects of effective follow-up were slim.</p> <h2 id="protection-against-retaliation"> Protection against retaliation <a href="#protection-against-retaliation" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h2> <p>The protections in §§ 35 to 37 apply where the person reported internally under § 17 or externally under § 28, or disclosed under § 32; had sufficient reason at the time to believe the information was true; and the information concerns breaches within the Act’s scope, or they had sufficient reason to believe it did (§ 33(1)).</p> <p>Retaliation is prohibited, as is threatening or attempting it (§ 36(1)). The operative provision is the <strong>reversal of the burden of proof</strong> in § 36(2): where a reporting person suffers a detriment in connection with their professional activity and asserts that it followed a report, the detriment is presumed to be retaliation, and the person who caused it must prove that it rested on sufficiently justified grounds or was not based on the report.</p> <h2 id="fines"> Fines <a href="#fines" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h2> <p>§ 40(6) HinSchG sets three tiers:</p> <table> <thead> <tr> <th>Amount</th> <th>Conduct</th> </tr> </thead> <tbody> <tr> <td>up to <strong>€50,000</strong></td> <td>Obstructing a report (§ 40(2) no. 1), retaliation (no. 3), intentional or reckless breach of confidentiality (para. 3), attempt (para. 5)</td> </tr> <tr> <td>up to <strong>€20,000</strong></td> <td>Knowingly disclosing false information (para. 1) and <strong>failing to establish or operate an internal reporting office</strong> (para. 2 no. 2)</td> </tr> <tr> <td>up to <strong>€10,000</strong></td> <td>The remaining cases, in particular negligent breach of confidentiality (para. 4)</td> </tr> </tbody> </table> <p>The ceiling for having no internal reporting office is widely reported as €50,000. The Act sets <strong>€20,000</strong>; the €50,000 tier covers obstruction, retaliation and confidentiality breaches. Application of § 30(2) sentence 3 OWiG — which multiplies the ceiling for legal persons — is expressly confined to § 40(2) nos. 1 and 3 and paras. 3 and 4, and so does not reach the missing-internal-office offence.</p> <h2 id="official-sources"> Official sources <a href="#official-sources" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h2> <ul> <li><a href="https://www.gesetze-im-internet.de/hinschg/BJNR08C0B0023.html" rel="nofollow">Hinweisgeberschutzgesetz (HinSchG) — official text</a> </li> <li><a href="https://formulare.bfj.bund.de/ffw/action/invoke.do?id=externeMeldestelle" rel="nofollow">Federal external reporting office — reporting form</a> </li> <li><a href="https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32019L1937" rel="nofollow">Directive (EU) 2019/1937 — EUR-Lex</a> </li> </ul>support@ethicsportal.eu (EthicsPortal)https://ethicsportal.eu/authorities/poland-rpo/Sun, 20 Sep 2026 00:00:00 +0000https://ethicsportal.eu/authorities/poland-rpo/Reference on the Rzecznik Praw Obywatelskich under Poland's 2024 whistleblower act: how the role splits between the Ombudsman and the competent public authority, preliminary verification and referral, the acknowledgment and feedback deadlines, and the criminal penalties.<h1 id="polands-ombudsman--external-reports"> Poland’s Ombudsman — external reports <a href="#polands-ombudsman--external-reports" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h1> <p>The <strong>Rzecznik Praw Obywatelskich (RPO)</strong>, Poland’s Commissioner for Human Rights, receives external reports under the Act of 14 June 2024 on the Protection of Whistleblowers. In most cases it does not investigate them: it carries out a preliminary verification and passes the report to the public authority competent to take follow-up action.</p> <p>This page is a reference on the authority: what the RPO does and does not do, how a report is filed, which deadlines apply, and what happens next. For the internal-procedure duty and the thresholds, see <a href="/whistleblower-laws/poland/">whistleblower law in Poland</a> .</p> <h2 id="what-the-rpo-is-in-this-system"> What the RPO is in this system <a href="#what-the-rpo-is-in-this-system" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h2> <table> <thead> <tr> <th></th> <th></th> </tr> </thead> <tbody> <tr> <td>Authority</td> <td>Rzecznik Praw Obywatelskich (Commissioner for Human Rights)</td> </tr> <tr> <td>Legal basis</td> <td><strong>Act of 14 June 2024 on the Protection of Whistleblowers</strong> (Dz.U. 2024 item 928), Chapter 4</td> </tr> <tr> <td>Role</td> <td>Receiving external reports, <strong>preliminary verification</strong>, and referral to the competent public authority (art. 31(1))</td> </tr> <tr> <td>External reporting since</td> <td><strong>25 December 2024</strong> — Chapter 4 entered into force six months after publication, the rest of the Act after three (art. 64)</td> </tr> <tr> <td>Sanctions</td> <td>The RPO <strong>imposes no penalties</strong> — the Chapter 6 offences are tried by the courts</td> </tr> </tbody> </table> <h2 id="choosing-between-internal-and-external-reporting"> Choosing between internal and external reporting <a href="#choosing-between-internal-and-external-reporting" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h2> <p>The Act leaves the choice open. Under art. 30(1), <strong>a whistleblower may make an external report without first making an internal one</strong>.</p> <p>That differs from Italy, where the external channel only opens once one of four statutory conditions is met, and matches the Spanish and German position.</p> <p>An external report is received by <strong>the Ombudsman or by a public authority</strong> (art. 30(2)). Each is a separate controller for the personal data in the reports it receives (art. 30(3)).</p> <h2 id="what-the-rpo-does--and-does-not-do"> What the RPO does — and does not do <a href="#what-the-rpo-does--and-does-not-do" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h2> <p>Article 31(1) lists the Ombudsman’s tasks:</p> <ol> <li><strong>Establishes the procedure</strong> for receiving external reports, specifying in particular how <strong>anonymous</strong> reports are handled.</li> <li><strong>Receives reports</strong> about breaches in the fields listed in art. 3(1)(1)–(16), carries out a <strong>preliminary verification</strong>, and <strong>passes them to the public authority</strong> competent for follow-up.</li> <li><strong>Receives and examines</strong> reports itself <strong>only</strong> where the report concerns the field in art. 3(1)(17) and <strong>no other public authority is competent</strong>.</li> <li>Ensures general access to information on whistleblowers’ rights and remedies, in particular through its Public Information Bulletin.</li> <li>Advises whistleblowers, people assisting them, and people the report concerns.</li> <li>Informs about bodies able to protect against retaliation and, where appropriate, supports contact with them.</li> </ol> <p><strong>This is the core of the Polish model.</strong> The RPO is primarily an entry point and routing hub, not an investigating body. It handles a case itself only in the narrow residual field under point 17.</p> <h3 id="preliminary-verification-and-referral"> Preliminary verification and referral <a href="#preliminary-verification-and-referral" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h3> <p>Preliminary verification means establishing whether the report concerns information about a breach of law, and identifying the competent public authority (art. 32(1)).</p> <ul> <li>If it <strong>does</strong> — the RPO refers the report without delay and <strong>no later than 14 days</strong> from the date it was made, telling the whistleblower which authority received it and when (art. 32(2)–(3)).</li> <li>If it <strong>does not</strong> — the RPO declines to refer it and informs the whistleblower of the verification findings (art. 32(4)–(5)). It may point to another route: a civil claim, a notification of suspected crime, a complaint to an administrative court, or a complaint, request or petition. That information does not affect the admissibility of any later remedy or the running of time limits (art. 32(6)).</li> </ul> <p>A public authority that receives a report outside its own field refers it to the competent authority <strong>within 14 days, or 30 days in justified cases</strong>, and informs the whistleblower (art. 34(1)(4)).</p> <h2 id="how-to-file-an-external-report"> How to file an external report <a href="#how-to-file-an-external-report" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h2> <p>A report may be made <strong>orally or in writing</strong> (art. 36(1)). In documentary form:</p> <ul> <li><strong>on paper</strong> — to the correspondence address indicated by the RPO or the public authority;</li> <li><strong>electronically</strong> — to the email address, electronic inbox or e-delivery address indicated, or through a dedicated web form or an application designated by the public authority.</li> </ul> <p>The RPO’s information for whistleblowers is published in its <a href="https://bip.brpo.gov.pl/pl/sygnalisci" rel="nofollow">Public Information Bulletin</a> .</p> <p><strong>A contact address is required.</strong> So that follow-up and feedback are possible, the whistleblower gives a contact address. Where none is given and none can be established, the RPO and the public authority do not perform several of their information duties (art. 35).</p> <p>Communication channels used for external reports must be <strong>independent of the authority’s ordinary channels</strong>, ensure the completeness, confidentiality and integrity of the data, and allow information to be stored durably (art. 42(1)).</p> <h2 id="deadlines"> Deadlines <a href="#deadlines" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h2> <table> <thead> <tr> <th></th> <th>External report</th> <th>Internal report</th> </tr> </thead> <tbody> <tr> <td>Acknowledgment</td> <td><strong>7 days</strong> from receipt, unless the whistleblower expressly asked otherwise or the acknowledgment would threaten the confidentiality of their identity (art. 37)</td> <td>7 days (Chapter 3)</td> </tr> <tr> <td>Referral to the competent authority</td> <td><strong>14 days</strong> from the date of the report (RPO, art. 32(2)); a public authority — <strong>14 days, or 30 in justified cases</strong> (art. 34(1)(4))</td> <td>—</td> </tr> <tr> <td>Feedback</td> <td><strong>3 months</strong> from receipt of the external report; <strong>6 months</strong> in justified cases, after telling the whistleblower before the three months expire (art. 41)</td> <td>3 months</td> </tr> </tbody> </table> <p>The public authority also informs the whistleblower of the <strong>final outcome</strong> of any explanatory proceedings opened as a result of the report (art. 41(3)).</p> <h2 id="the-protection-certificate"> The protection certificate <a href="#the-protection-certificate" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h2> <p>A feature distinctive to the Polish act: <strong>at the whistleblower’s request</strong>, the public authority competent for follow-up issues, <strong>within one month</strong> of receiving the request, a <strong>certificate confirming that the whistleblower is protected</strong> under Chapter 2 (art. 38).</p> <p>It is a document the whistleblower can put in front of an employer or use in proceedings. Spanish, German and Italian law contain no equivalent instrument.</p> <h2 id="when-a-report-can-be-left-unexamined"> When a report can be left unexamined <a href="#when-a-report-can-be-left-unexamined" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h2> <p>The RPO may leave a report unexamined where it previously declined to refer an earlier report, or where the report concerns a matter already covered by an earlier report and <strong>contains no significant new information</strong>. It tells the whistleblower, with reasons; on any further such report it does not (art. 40(1)). A public authority has the same power (art. 40(2)). The fact is recorded in the register (art. 40(3)).</p> <h2 id="criminal-liability"> Criminal liability <a href="#criminal-liability" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h2> <p>Poland does not use administrative fines here. Chapter 6 creates <strong>criminal offences</strong>:</p> <table> <thead> <tr> <th>Conduct</th> <th>Penalty</th> </tr> </thead> <tbody> <tr> <td>Preventing or substantially hindering a report (art. 54(1))</td> <td>fine, restriction of liberty, or <strong>up to 1 year’s imprisonment</strong></td> </tr> <tr> <td>— using violence, unlawful threat or deception (art. 54(2))</td> <td><strong>up to 3 years’ imprisonment</strong></td> </tr> <tr> <td>Retaliation against a whistleblower, a person assisting, or a related person (art. 55(1))</td> <td>fine, restriction of liberty, or <strong>up to 2 years</strong>; if persistent — <strong>up to 3 years</strong></td> </tr> <tr> <td>Disclosing the identity of a whistleblower, assisting or related person (art. 56)</td> <td>fine, restriction of liberty, or <strong>up to 1 year</strong></td> </tr> <tr> <td>Reporting or publicly disclosing while knowing no breach occurred (art. 57)</td> <td>fine, restriction of liberty, or <strong>up to 2 years</strong></td> </tr> <tr> <td><strong>Failing to establish the internal reporting procedure</strong>, or establishing it in significant breach of the Act’s requirements (art. 58)</td> <td><strong>a fine</strong> — imposed under the Code of Procedure in Petty Offence Cases (art. 59)</td> </tr> </tbody> </table> <p>Having no internal procedure is therefore a <strong>petty offence tried by a court</strong> in Poland, not an administrative breach penalised by a supervisory body. The Ombudsman does not impose these penalties.</p> <h2 id="free-legal-aid"> Free legal aid <a href="#free-legal-aid" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h2> <p>The Act extended free legal aid and free civic counselling to <strong>a person intending to report</strong> a breach within the meaning of the Act, disapplying the usual eligibility criteria (art. 61).</p> <h2 id="official-sources"> Official sources <a href="#official-sources" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h2> <ul> <li><a href="https://isap.sejm.gov.pl/isap.nsf/DocDetails.xsp?id=WDU20240000928" rel="nofollow">Act of 14 June 2024 on the Protection of Whistleblowers (Dz.U. 2024 item 928)</a> </li> <li><a href="https://api.sejm.gov.pl/eli/acts/DU/2024/928/text.pdf" rel="nofollow">Text of the Act — Sejm API</a> </li> <li><a href="https://bip.brpo.gov.pl/pl/sygnalisci" rel="nofollow">RPO — whistleblowers (BIP)</a> </li> <li><a href="https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32019L1937" rel="nofollow">Directive (EU) 2019/1937 — EUR-Lex</a> </li> </ul>support@ethicsportal.eu (EthicsPortal)https://ethicsportal.eu/authorities/romania-ani/Sun, 20 Sep 2026 00:00:00 +0000https://ethicsportal.eu/authorities/romania-ani/Reference on ANI under Law 361/2022: how competence is shared between the Agency and the other competent authorities, the external reporting procedure, the acknowledgment and feedback deadlines, and the administrative fines the Agency itself imposes.<h1 id="ani--romanias-external-reporting-channel"> ANI — Romania’s external reporting channel <a href="#ani--romanias-external-reporting-channel" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h1> <p>The <strong>Agenția Națională de Integritate (ANI)</strong>, the National Integrity Agency, is one of the authorities competent to receive reports of breaches of the law under Law no. 361/2022. It receives reports, examines them, redirects what falls outside its competence, and establishes and penalises the offences the Law creates.</p> <p>This page is a reference on the authority: what it does and does not do, how a report is filed, which deadlines apply, and what it can fine. For the internal-channel duty and the thresholds, see <a href="/whistleblower-laws/romania/">whistleblower law in Romania</a> .</p> <h2 id="what-ani-is-in-this-system"> What ANI is in this system <a href="#what-ani-is-in-this-system" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h2> <table> <thead> <tr> <th></th> <th></th> </tr> </thead> <tbody> <tr> <td>Authority</td> <td>Agenția Națională de Integritate (the “Agency”)</td> </tr> <tr> <td>Legal basis</td> <td><strong>Law no. 361/2022</strong> on the protection of public-interest whistleblowers, Chapters IV and VII</td> </tr> <tr> <td>Role</td> <td>External reporting channel, alongside the other competent authorities (art. 3(15) and art. 12(1))</td> </tr> <tr> <td>Structure</td> <td>A <strong>distinct specialised structure</strong> within the Agency; integrity inspectors designated as responsible persons (art. 16)</td> </tr> <tr> <td>Sanctions</td> <td><strong>Establishes and penalises</strong> the offences in arts. 28 and 29 (art. 30(1))</td> </tr> </tbody> </table> <h2 id="who-counts-as-a-competent-authority"> Who counts as a “competent authority” <a href="#who-counts-as-a-competent-authority" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h2> <p>The Law does not designate a single authority. Under art. 3(15) the competent authorities are:</p> <ul> <li><strong>(a)</strong> public authorities and institutions that, under special legislation, receive and resolve reports in their own field of competence;</li> <li><strong>(b)</strong> the <strong>National Integrity Agency</strong>;</li> <li><strong>(c)</strong> other public authorities and institutions to which the Agency transmits reports for resolution.</li> </ul> <p>That architecture creates mutual redirection duties (art. 12):</p> <ul> <li>reports the Agency receives that belong to the (a) authorities are <strong>redirected immediately</strong> to them, preserving confidentiality and integrity guarantees;</li> <li>the (a) authorities must <strong>immediately redirect</strong> to the Agency any report within its competence;</li> <li>the Agency immediately redirects to the (c) authorities where it lacks competence to examine and take follow-up action;</li> <li>the (c) authorities immediately redirect misdirected reports back to the Agency.</li> </ul> <p><strong>The whistleblower must be notified of a redirection within 3 working days</strong> of it happening (art. 12(5)).</p> <h2 id="the-agencys-tasks"> The Agency’s tasks <a href="#the-agencys-tasks" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h2> <p>Article 14 lists them:</p> <ul> <li><strong>resolves</strong> the reports within its competence;</li> <li><strong>forwards</strong> a report to the competent authority according to its subject matter;</li> <li>transmits information in good time to the competent EU institutions, bodies, offices or agencies;</li> <li>organises periodic <strong>public information activities</strong> on the reporting procedure and the protection measures;</li> <li>provides <strong>advice to employers</strong>, on request, in drafting and revising internal procedures;</li> <li>provides <strong>training for the persons designated</strong> to resolve reports;</li> <li>provides <strong>confidential advice, on request</strong>, to people intending to make a report;</li> <li>proposes legislative amendments and cooperates with similar institutions.</li> </ul> <p>Two are worth drawing out: ANI <strong>advises employers</strong> on request when they write their internal procedures, and offers <strong>confidential pre-reporting advice</strong> to people considering coming forward.</p> <h2 id="powers-and-duties-when-resolving-a-report"> Powers and duties when resolving a report <a href="#powers-and-duties-when-resolving-a-report" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h2> <p>In resolving a report, the Agency and the art. 3(15)(c) authorities <strong>may</strong> (art. 13(1)) request documents held by any public authority, public institution, or public- or private-law legal person and receive copies, and request information from the whistleblower, the person concerned and anyone else who can help — including by inviting them to their premises.</p> <p>They <strong>must</strong> (art. 13(2)) receive, examine and answer reports through designated persons; take follow-up action; ensure confidentiality; <strong>retain reports for 5 years</strong> from registration; maintain contact with the whistleblower; and inform them how the report was resolved.</p> <h2 id="the-external-procedure-and-its-deadlines"> The external procedure and its deadlines <a href="#the-external-procedure-and-its-deadlines" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h2> <table> <thead> <tr> <th>Stage</th> <th>Deadline</th> </tr> </thead> <tbody> <tr> <td>Acknowledgment of receipt</td> <td><strong>Immediately, and no later than 7 calendar days</strong> from receipt — unless the whistleblower expressly asked otherwise or the Agency reasonably considers the acknowledgment would endanger the protection of their identity (art. 17(1))</td> </tr> <tr> <td>Notice of redirection</td> <td><strong>3 working days</strong> from the redirection (art. 12(5))</td> </tr> <tr> <td>Responses to the Agency’s requests</td> <td>Those asked must reply within <strong>no more than 15 working days</strong> of receiving the request (art. 17(5))</td> </tr> <tr> <td>Informing the whistleblower</td> <td>A reasonable time <strong>not exceeding 3 months or, in justified cases, 6 months</strong> from receipt of the report, and whenever there are developments (art. 17(6))</td> </tr> </tbody> </table> <p>After registration, the designated person carries out a first examination of whether the conditions in art. 2, art. 5(3) and art. 6 are met. Where there are indications that a breach exists, the substantive examination follows (art. 17(2) and (4)). At the end, a <strong>report</strong> is drawn up setting out the situation, the information brought to the Agency’s attention and the outcome of the examination (art. 17(7)).</p> <h2 id="offences--ani-both-establishes-and-penalises-them"> Offences — ANI both establishes and penalises them <a href="#offences--ani-both-establishes-and-penalises-them" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h2> <p>Unlike Poland, where liability is criminal, Romania uses an administrative-offence regime, and <strong>the Agency’s own specialised structure establishes and penalises</strong> the offences (art. 30(1)).</p> <table> <thead> <tr> <th>Conduct</th> <th>Fine</th> </tr> </thead> <tbody> <tr> <td>Preventing a report by any means, by the person designated to receive and register reports (art. 28(2)(a))</td> <td><strong>RON 2,000–20,000</strong></td> </tr> <tr> <td>Unjustified refusal to answer the Agency’s requests under art. 17(5) (lit. b)</td> <td><strong>RON 3,000–30,000</strong></td> </tr> <tr> <td><strong>Failure to establish the internal reporting channels</strong> required by art. 9(1) (lit. c)</td> <td><strong>RON 3,000–30,000</strong></td> </tr> <tr> <td>Failure to comply with the obligations in art. 10(1)(a) (lit. d)</td> <td><strong>RON 4,000–40,000</strong></td> </tr> <tr> <td>Breach by a natural person of the duty to keep confidential the identity of the whistleblower, the person concerned or third parties (arts. 8 and 25) (lit. e)</td> <td><strong>RON 4,000–40,000</strong></td> </tr> <tr> <td><strong>False reporting</strong> — reporting information while knowing it is untrue (art. 29)</td> <td><strong>RON 2,500–30,000</strong></td> </tr> </tbody> </table> <p>These are offences only where the conduct was not committed in circumstances making it a crime under criminal law (art. 28(2)).</p> <p>Breach of the Law attracts, as the case may be, <strong>civil, disciplinary, administrative-offence or criminal liability</strong> (art. 28(1)).</p> <h2 id="rights-cannot-be-waived"> Rights cannot be waived <a href="#rights-cannot-be-waived" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h2> <p>The rights and measures the Law provides <strong>cannot be waived or limited</strong> by contract, by the form or conditions of employment, or by an arbitration agreement concluded before a dispute. Any settlement seeking to limit or waive them is <strong>void by operation of law</strong> (art. 27).</p> <h2 id="the-agencys-information-duty"> The Agency’s information duty <a href="#the-agencys-information-duty" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h2> <p>Article 15 requires the Agency to publish on its website, in a separate, easily identifiable and accessible section, at least the conditions for qualifying for protection and the other information the Law specifies.</p> <h2 id="official-sources"> Official sources <a href="#official-sources" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h2> <ul> <li><a href="https://legislatie.just.ro/public/DetaliiDocument/262872" rel="nofollow">Law no. 361/2022 on the protection of public-interest whistleblowers — Portal Legislativ</a> </li> <li><a href="https://integritate.eu/competente/avertizori-in-interes-public/" rel="nofollow">ANI — public-interest whistleblowers</a> </li> <li><a href="https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32019L1937" rel="nofollow">Directive (EU) 2019/1937 — EUR-Lex</a> </li> </ul>support@ethicsportal.eu (EthicsPortal)https://ethicsportal.eu/authorities/spain-aipi/Sun, 20 Sep 2026 00:00:00 +0000https://ethicsportal.eu/authorities/spain-aipi/Reference on the Autoridad Independiente de Protección del Informante, A.A.I.: legal basis, how competence is split with the regional authorities, how to file a report through the external channel, the statutory deadlines, and what happens afterwards.<h1 id="spains-whistleblower-authority--aipi"> Spain’s whistleblower authority — AIPI <a href="#spains-whistleblower-authority--aipi" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h1> <p>The <strong>Autoridad Independiente de Protección del Informante, A.A.I.</strong> (AIPI) is the Spanish state body that operates the national <strong>external reporting channel</strong>, grants protection against retaliation, and exercises the power to sanction under Ley 2/2023.</p> <p>This page is a reference on the authority itself: what it is, what it can and cannot do, how a report is filed, which deadlines apply, and what happens next. For the duty to operate an internal reporting system, the thresholds and the penalties, see <a href="/whistleblower-laws/spain/">whistleblower law in Spain</a> .</p> <h2 id="what-the-aipi-is"> What the AIPI is <a href="#what-the-aipi-is" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h2> <table> <thead> <tr> <th></th> <th></th> </tr> </thead> <tbody> <tr> <td>Official name</td> <td>Autoridad Independiente de Protección del Informante, A.A.I. (art. 42.1)</td> </tr> <tr> <td>Legal nature</td> <td>Independent administrative authority; a state public-law entity with its own legal personality</td> </tr> <tr> <td>Created by</td> <td><strong>Ley 2/2023, de 20 de febrero</strong>, Title VIII (arts. 42 onwards)</td> </tr> <tr> <td>Statute</td> <td><strong>Real Decreto 1101/2024, de 29 de octubre</strong></td> </tr> <tr> <td>Attached to</td> <td>Relates to the Government <strong>through the Ministry of Justice</strong> (art. 42.2), today the Ministerio de la Presidencia, Justicia y Relaciones con las Cortes</td> </tr> <tr> <td>Operating since</td> <td><strong>1 September 2025</strong> (Orden PJC/908/2025, de 8 de agosto)</td> </tr> <tr> <td>President</td> <td>Manuel Villoria Mendieta, appointed by Real Decreto 328/2025, de 15 de abril</td> </tr> </tbody> </table> <p>The law gives it <strong>full autonomy and organic and functional independence</strong> from the Government, the public sector and other public powers (art. 42.1). The president holds the rank of <em>subsecretario</em>, is appointed by royal decree on the proposal of the Ministry of Justice for a <strong>five-year, non-renewable term that cannot be extended</strong>, and the appointment must be ratified by an absolute majority of the relevant committee of the Congreso de los Diputados within one month (art. 53.2). The president is advised by a <strong>Comisión Consultiva</strong> that includes representatives of the Tribunal de Cuentas and the Consejo de Transparencia y Buen Gobierno, among others (art. 54).</p> <p>One feature of its funding is worth knowing: its resources include <strong>a percentage — set in the State Budget Act — of the fines it itself imposes</strong> (art. 47.2.c).</p> <h2 id="functions"> Functions <a href="#functions" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h2> <p>Article 43 gives it five functions:</p> <ol> <li><strong>Operating the external channel</strong> governed by Title III.</li> <li><strong>Adopting protection measures</strong> for reporting persons within its competence (art. 41).</li> <li>Issuing a <strong>mandatory opinion</strong> on draft general provisions affecting its remit.</li> <li><strong>Conducting sanctioning procedures</strong> and imposing penalties for the infringements in Title IX.</li> <li><strong>Promoting a culture of reporting.</strong></li> </ol> <p>The president may also issue <strong>circulars and recommendations</strong>; circulars are binding once published in the BOE (art. 51).</p> <h2 id="what-it-can-and-cannot-do"> What it can and cannot do <a href="#what-it-can-and-cannot-do" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h2> <h3 id="material-scope"> Material scope <a href="#material-scope" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h3> <p>Ley 2/2023 protects people who report (art. 2):</p> <ul> <li>Acts or omissions that may constitute <strong>breaches of EU law</strong> within the annex to Directive (EU) 2019/1937, that affect the EU’s financial interests (art. 325 TFEU), or that concern the internal market (art. 26(2) TFEU), including competition, State aid and corporate-tax avoidance practices.</li> <li>Acts or omissions that may constitute a <strong>criminal offence or a serious or very serious administrative infringement</strong>.</li> </ul> <p>The second limb is broader than the Directive’s minimum: in Spain the external channel covers any criminal offence or serious/very serious administrative infringement, not only the annex subject matters.</p> <h3 id="how-competence-is-split-with-the-regional-authorities"> How competence is split with the regional authorities <a href="#how-competence-is-split-with-the-regional-authorities" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h3> <p>The AIPI is <strong>not</strong> competent for everything. Article 24 divides it:</p> <table> <thead> <tr> <th>AIPI (art. 24.1)</th> <th>Regional authority (art. 24.2)</th> </tr> </thead> <tbody> <tr> <td>General State Administration and the state public sector</td> <td>The regional and local public sector of its own territory</td> </tr> <tr> <td>Other public-sector entities, constitutional bodies and bodies of constitutional relevance (art. 13)</td> <td>The regional institutions referred to in art. 13.2</td> </tr> <tr> <td>Private sector <strong>where the breach affects or has effects in more than one autonomous community</strong></td> <td>Private sector <strong>where the breach is confined to that community’s territory</strong></td> </tr> <tr> <td>Regional or local administrations <strong>where an agreement (convenio) has been signed</strong></td> <td></td> </tr> </tbody> </table> <p>In practice: a breach at a company operating in a single autonomous community that has its own authority belongs to that authority, not the AIPI. Ten autonomous communities have their own legislation — among them Andalusia, Asturias, Catalonia, Castilla-La Mancha, Castilla y León, Galicia, Madrid, Navarre, the Basque Country and the Valencian Community — with bodies such as the Oficina Antifrau de Catalunya and the Oficina Andaluza contra el Fraude y la Corrupción.</p> <p>Any authority that receives a report it is not competent for <strong>must forward it to the AIPI within ten days</strong> and tell the reporting person within that same period (art. 23).</p> <h3 id="limits"> Limits <a href="#limits" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h3> <ul> <li><strong>Its decisions on a report cannot be appealed</strong>, either administratively or before the contentious-administrative courts (art. 20.4). Only the decision closing any sanctioning procedure that follows can be challenged.</li> <li><strong>Filing a report does not by itself make someone an interested party</strong> in the procedure (art. 20.5).</li> <li>The AIPI <strong>does not resolve the employment dispute or award compensation</strong>: it adopts protection measures and, where appropriate, sanctions. Individual claims go to the competent courts.</li> </ul> <h2 id="how-to-report-through-the-external-channel"> How to report through the external channel <a href="#how-to-report-through-the-external-channel" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h2> <p>Any natural person may report to the AIPI <strong>directly, or after using the internal channel</strong> (art. 16.1). There is no obligation to exhaust the internal channel first.</p> <p>A report may be filed (art. 17.2):</p> <ul> <li><strong>In writing</strong>, by post or by any electronic means provided for the purpose.</li> <li><strong>Orally</strong>, by telephone or through a voice-messaging system.</li> <li><strong>At an in-person meeting</strong>, at the reporting person’s request, <strong>within a maximum of seven days</strong>.</li> </ul> <p>For oral reports the reporting person is warned that the communication will be recorded and informed about the processing of their data.</p> <p><strong>Reports may be anonymous</strong> (art. 17.1). Where they are not, the reporting person’s identity is withheld and is not disclosed to third parties or to the person concerned (arts. 21 and 33).</p> <p>Article 21 also gives the reporting person the right to designate an address, email or safe place for notifications, to waive receiving communications, to appear assisted by a lawyer, and to ask that any appearance be held by videoconference or other secure electronic means.</p> <p>The AIPI states that the <strong>secure external channel reachable from its electronic office is the recommended route</strong>; ordinary email and post do not carry the same confidentiality guarantees.</p> <h2 id="deadlines"> Deadlines <a href="#deadlines" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h2> <p>The external-channel deadlines are not the same as the internal ones. This is the most common confusion.</p> <table> <thead> <tr> <th></th> <th>External channel — AIPI</th> <th>Entity’s internal channel</th> </tr> </thead> <tbody> <tr> <td>Acknowledgment of receipt</td> <td><strong>5 working days</strong> from receipt (art. 17.4)</td> <td><strong>7 calendar days</strong> from receipt (art. 9.2.c)</td> </tr> <tr> <td>Admissibility decision</td> <td><strong>Maximum 10 working days</strong> from entry in the register (art. 18.2)</td> <td>—</td> </tr> <tr> <td>Notice of admission or inadmission</td> <td>Within the <strong>5 working days</strong> following the decision (art. 18.2)</td> <td>—</td> </tr> <tr> <td>Maximum time to conclude and respond</td> <td><strong>3 months</strong> from entry in the register (art. 20.3)</td> <td><strong>3 months</strong>, extendable by up to <strong>3 further months</strong> in especially complex cases (art. 9.2.d)</td> </tr> </tbody> </table> <p>The external channel’s three-month deadline <strong>cannot be extended</strong>. The internal one can, up to six months in total.</p> <p>The acknowledgment may be omitted where the reporting person has expressly waived communications, or where the AIPI reasonably considers that acknowledging receipt would compromise protection of their identity (art. 17.4).</p> <h2 id="what-happens-after-a-report"> What happens after a report <a href="#what-happens-after-a-report" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h2> <h3 id="1-registration-and-admissibility"> 1. Registration and admissibility <a href="#1-registration-and-admissibility" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h3> <p>Once registered, the AIPI checks whether the facts fall within the scope of article 2 and decides, within no more than <strong>ten working days</strong>, whether to reject the report, admit it, refer it to the public prosecutor, or transfer it to the competent authority (art. 18.2).</p> <p>Grounds for <strong>inadmission</strong> (art. 18.2.a):</p> <ol> <li>The facts reported are <strong>wholly implausible</strong>.</li> <li>The facts <strong>do not constitute an infringement</strong> within the scope of the law.</li> <li>The report is <strong>manifestly unfounded</strong>, or there are reasonable indications it was obtained through a criminal offence — in which case a reasoned account is also sent to the public prosecutor.</li> <li>It contains <strong>no new and significant information</strong> compared with an earlier report whose procedures have concluded, absent new circumstances of fact or law.</li> </ol> <p>Inadmission is notified with reasons, unless the report was anonymous or the reporting person waived communications.</p> <h3 id="2-investigation"> 2. Investigation <a href="#2-investigation" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h3> <p>The investigation covers the steps needed to verify the plausibility of the facts (art. 19). The person concerned is told of the facts in summary form and of their right to submit written submissions, although that notice may be deferred to the hearing stage where giving it earlier could help conceal, destroy or alter evidence.</p> <p><strong>The reporting person’s identity is never disclosed to the person concerned, who is also given no access to the report itself.</strong></p> <h3 id="3-closure"> 3. Closure <a href="#3-closure" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h3> <p>Once the steps are complete, the AIPI issues a report and takes one of the following decisions (art. 20.2):</p> <ul> <li><strong>Closing the file.</strong> The reporting person keeps the law’s protection, unless the investigation shows the report should have been rejected on one of the art. 18.2.a) grounds.</li> <li><strong>Referral to the public prosecutor</strong>, or to the <strong>European Public Prosecutor’s Office</strong> where the EU’s financial interests are affected.</li> <li><strong>Transfer to the competent authority.</strong></li> <li><strong>Opening a sanctioning procedure</strong> under Title IX.</li> </ul> <p>The decision is communicated to the reporting person, unless they waived it or the report was anonymous.</p> <h2 id="how-internal-and-external-reporting-interact"> How internal and external reporting interact <a href="#how-internal-and-external-reporting-interact" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h2> <ul> <li>The reporting person <strong>may choose</strong> the external channel from the outset (art. 16.1).</li> <li>Obliged entities must give clear, accessible information about their internal channel <strong>and about the external channels</strong> before the competent authorities. Where they have a website, that information must appear on the home page in a separate, easily identifiable section (art. 25).</li> <li><strong>Public disclosure</strong> is protected (art. 28) where the matter was first reported internally and externally, or directly externally, without appropriate action being taken in time; or where there are reasonable grounds to believe the breach is an imminent or manifest danger to the public interest, that there is a risk of irreversible harm, a risk of retaliation, or little prospect of the report being handled effectively.</li> </ul> <h2 id="protection-against-retaliation"> Protection against retaliation <a href="#protection-against-retaliation" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h2> <p>The AIPI provides the Title VII support measures for breaches committed in the <strong>private sector and the state public sector</strong>; the regional bodies do so within their own scope (art. 41).</p> <p>A person who reports or discloses information in accordance with the law <strong>incurs no liability</strong> for that report, provided they had reasonable grounds to believe it was necessary to reveal the act or omission, without prejudice to criminal liability (art. 38). The protection extends to the acquisition of, or access to, the information reported.</p> <p>The person concerned retains the presumption of innocence, the right of defence, access to the file, and the same confidentiality protection as the reporting person (art. 39).</p> <p>Someone who took part in the infringement and reports it before being notified that proceedings have been opened may be <strong>exempted from, or have their administrative penalty reduced</strong>, provided they ceased the conduct, cooperated fully and diligently, and supplied truthful and relevant information (art. 40).</p> <h2 id="sanctioning-powers"> Sanctioning powers <a href="#sanctioning-powers" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h2> <p>The AIPI exercises the power to sanction the infringements in Title IX (art. 52). The fines in article 65 reach <strong>€1,000,000 for legal persons</strong> for very serious infringements — a category that includes failing to have an internal reporting system (art. 63.1.g) — with the possible addition of a public reprimand, a ban on obtaining subsidies or tax benefits for up to 4 years, and a ban on contracting with the public sector for up to 3 years (art. 65.2).</p> <p>Very serious infringements <strong>become time-barred after three years</strong>, serious ones after two, and minor ones after six months (art. 64).</p> <p>Thresholds, implementation deadlines and the real state of enforcement are covered on <a href="/whistleblower-laws/spain/">the Ley 2/2023 page</a> .</p> <h2 id="official-contact-details"> Official contact details <a href="#official-contact-details" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h2> <table> <thead> <tr> <th></th> <th></th> </tr> </thead> <tbody> <tr> <td>Address</td> <td>C/ Luis Cabrera 9, 28002 Madrid</td> </tr> <tr> <td>External channel</td> <td>Reachable from <a href="https://www.proteccioninformante.gob.es/nuestro-trabajo/investigacion/como-informar" rel="nofollow">AIPI — cómo informar</a> </td> </tr> <tr> <td>General enquiries</td> <td><a href="mailto:info@aipi.gob.es">info@aipi.gob.es</a> </td> </tr> <tr> <td>Communications</td> <td><a href="mailto:comunicacion@aipi.gob.es">comunicacion@aipi.gob.es</a> </td> </tr> </tbody> </table> <p>To file a report or request protection, the AIPI directs people to the <strong>secure external channel</strong> on its website, not to the general email address.</p> <h2 id="official-sources"> Official sources <a href="#official-sources" class="ml-1 text-base-content/30 hover:text-base-content/60 no-underline" aria-label="Link to this section">#</a> </h2> <ul> <li><a href="https://www.boe.es/buscar/act.php?id=BOE-A-2023-4513" rel="nofollow">Ley 2/2023, de 20 de febrero — consolidated BOE text</a> </li> <li><a href="https://www.boe.es/eli/es/rd/2024/10/29/1101/con" rel="nofollow">Real Decreto 1101/2024, de 29 de octubre — AIPI Statute</a> </li> <li><a href="https://www.boe.es/eli/es/o/2025/08/08/pjc908" rel="nofollow">Orden PJC/908/2025, de 8 de agosto — date the AIPI began operating</a> </li> <li><a href="https://www.boe.es/diario_boe/txt.php?id=BOE-A-2025-7673" rel="nofollow">Real Decreto 328/2025, de 15 de abril — appointment of the president</a> </li> <li><a href="https://www.proteccioninformante.gob.es/AIPI/que-es" rel="nofollow">AIPI — what it is</a> </li> <li><a href="https://www.proteccioninformante.gob.es/AIPI/funciones" rel="nofollow">AIPI — functions</a> </li> <li><a href="https://www.proteccioninformante.gob.es/nuestro-trabajo/competencias" rel="nofollow">AIPI — competence</a> </li> <li><a href="https://www.proteccioninformante.gob.es/nuestro-trabajo/investigacion/como-informar" rel="nofollow">AIPI — how to report</a> </li> <li><a href="https://www.proteccioninformante.gob.es/nuestro-trabajo/investigacion/procedimiento" rel="nofollow">AIPI — report-handling procedure</a> </li> <li><a href="https://www.proteccioninformante.gob.es/nuestro-trabajo/potestad-sancionadora/procedimiento" rel="nofollow">AIPI — sanctioning procedure</a> </li> <li><a href="https://www.proteccioninformante.gob.es/AIPI/equipo/presidencia" rel="nofollow">AIPI — president</a> </li> <li><a href="https://www.proteccioninformante.gob.es/contacto" rel="nofollow">AIPI — contact</a> </li> </ul>support@ethicsportal.eu (EthicsPortal)