Whistleblowing channels under Spain's Law 2/2023: how to prove the date of receipt and the integrity of every report
Equipo Proovik · Sep 16, 2026 · 9 min read
To prove the date of receipt of a report in an internal whistleblowing channel under Spain's Law 2/2023, and that it has not been altered since, compute the SHA-256 hash of the report as received, attachments included, and seal it with an electronic time stamp at the moment of entry; repeat with the acknowledgement and with every register entry. The seal proves date and integrity without revealing the content or the reporting person's identity.
This article is part of Proovik's proof-of-existence cluster and is written for whoever is responsible for the internal reporting system of a company or public body operating in Spain, including subsidiaries of foreign groups. The legal basis of the time stamp is explained in What is a blockchain timestamp?; here we focus on the milestones of the Law 2/2023 procedure that hinge on a date.
Who is obliged and which deadlines run from the date of receipt
Law 2/2023 of 20 February, on the protection of persons who report regulatory breaches and on the fight against corruption, transposes Directive (EU) 2019/1937. It requires an internal reporting system in companies with fifty or more employees, in political parties, trade unions and employers' organisations, and across the public sector, with a designated system manager notified to the competent authority.
The procedure revolves around three dates:
- Receipt of the report. Every subsequent deadline runs from it. Whether the report came in by email, web form, post or orally (with a transcript), you must be able to say exactly when.
- The acknowledgement. The law requires an acknowledgement of receipt to be sent to the reporting person within seven calendar days of receipt, unless doing so could jeopardise confidentiality.
- The response. The maximum period to respond to the investigation is three months from receipt, extendable by up to a further three months in cases of particular complexity.
The law also requires a register of the reports received and of the internal investigations they triggered, with confidentiality safeguards, in which personal data may not be kept for more than ten years. And it establishes protection against retaliation with a reversal of the burden of proof: once the reporting person shows that they reported and suffered a detriment, it is for whoever took the measure to show it was not retaliation. There, the date of the report is decisive.
Where the evidence breaks in a conventional channel
Most internal channels run on a mailbox or an application managed by the organisation itself or by a provider. That raises two problems when the date is disputed:
- The organisation controls the clock. The entry date is written by a system administered by the very organisation under investigation. Against a whistleblower who claims to have reported before being dismissed, or an inspector asking whether the acknowledgement went out on time, the organisation can only offer its own records.
- The content can change. A replaced attachment, a corrected transcript or an edited register entry leaves no trace if nobody sealed the original version.
The solution is not to publish anything: that would be incompatible with the confidentiality the law demands. The solution is to seal fingerprints.
Milestones, evidence and what the seal shows
| Procedural milestone | What is sealed (SHA-256 hash of...) | What the seal shows |
|---|---|---|
| Receipt of the report | The original message and its attachments, packaged in one archive | That this exact report was in the organisation's hands no later than that date |
| Acknowledgement of receipt | The acknowledgement sent (email or document) | That the acknowledgement existed within the seven calendar days |
| Admission or rejection | The system manager's decision | Date and content of the decision |
| Investigation steps | Minutes, interview transcripts, expert reports | That each step existed on the date and has not been retouched |
| Response to the reporting person | The closing communication | That the response was given within three months (or the extension) |
| Register | Each new entry, or a daily digest of all entries | That the register has not been rewritten backwards |
Each seal is a certificate with the transaction and the block header, filed with the case. On chain there are only hashes: no names, no reported facts, no company.
How to set it up on an existing channel
- Define the moment of entry. For email, arrival in the mailbox; for a web form, submission; for an oral report, the reporting person's signature on the transcript. Document that rule in the channel's procedure.
- Package and seal on receipt. Whoever manages the channel (or the system itself, through an API) creates an archive with the report and its attachments and seals its hash before any other step.
- Seal the acknowledgement when sending it. The acknowledgement itself can quote the transaction identifier of the receipt seal, so the reporting person also holds their own evidence.
- Seal the register entries. If volume is high, a daily digest is enough: a file with the hashes of the day's entries, sealed every night.
- Keep files and certificates in the case file, under the same access control as the rest of the channel. Apply the law's retention period to the case file, not to the seals, which contain no personal data.
Automation is straightforward: a channel that is already an application can call an API with the hash at the moment it stores each document. A channel that is a mailbox can do it by hand from a web page in under a minute per report.
What the law says
Law 2/2023, Article 9: the procedure for handling reports must provide for an acknowledgement of receipt to be sent to the reporting person within seven calendar days of receipt, unless this could jeopardise confidentiality; and a maximum period to respond to the investigation that may not exceed three months from receipt, extendable by a maximum of a further three months in cases of particular complexity.
Law 2/2023, Article 26: obliged entities must keep a register of the reports received and of the internal investigations they gave rise to, guaranteeing confidentiality; personal data may not be kept in the register for longer than ten years.
Law 2/2023, Article 7: internal channels must allow written or oral reports, or both, and must accept anonymous submissions.
Directive (EU) 2019/1937, Article 9: internal reporting procedures shall include acknowledgement of receipt to the reporting person within seven days of receipt, and a reasonable timeframe to provide feedback, not exceeding three months from the acknowledgement or, if no acknowledgement was sent, from the expiry of the seven-day period.
Regulation (EU) 910/2014 (eIDAS), Article 41(1): an electronic time stamp cannot be denied legal effect or admissibility as evidence solely for being electronic or non-qualified. The seal described here is non-qualified: without the presumption of accuracy of Article 41(2), but verifiable by anyone, the authority included.
How to do it with Proovik
On the certify page the hash of the archive is computed in the channel manager's browser and only that fingerprint is written on the Kaspa network, which produces about ten blocks per second; the seal is normally confirmed within seconds. The PDF certificate embeds the PVK-PROOF/1 proof package and can be verified without Proovik on the verify page. For a channel that is already an application, the API takes the hash and returns the transaction and the block timestamp; neither the content nor the identity of the reporting person leaves the channel's system. For high volumes or a tailored flow, write to us through contact.
What it proves: that a report, an acknowledgement or a register entry with that content existed no later than the block timestamp and has not changed. What it does not prove: who sent it, that the reporting person actually sent it on that date (only that the organisation held it then), or that the organisation complies with Law 2/2023. Compliance depends on the procedure, confidentiality and deadlines; the seal lets you demonstrate them.
Frequently asked questions
Does sealing the hash of a report breach confidentiality?
No. The hash contains no information: it is a 32-byte fingerprint from which the document cannot be reconstructed and the sender cannot be inferred. The content stays in the channel, under the access control the law requires.
Is it useful for the whistleblower too?
Yes. The reporting person can seal their own report before sending it and keep the certificate. If they later have to prove they reported before suffering a detriment, they hold a date that does not depend on the company.
What about oral reports?
The law allows oral reports, which must be documented with a recording or a complete and accurate transcript. You seal that recording, or the transcript signed by the reporting person, at the moment it is closed.
Is a non-qualified stamp enough before the Spanish whistleblower protection authority?
It is admissible as evidence (Article 41(1) eIDAS) and its verification is arithmetic. It lacks the Article 41(2) presumption of qualified stamps; if the date is disputed, whoever relies on the seal must produce the file and the certificate so that anyone can repeat the verification.
Sources
- Law 2/2023 of 20 February on the protection of persons who report regulatory breaches (BOE, Spanish): boe.es/eli/es/l/2023/02/20/2/con
- Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law: eur-lex.europa.eu/eli/dir/2019/1937/oj
- Regulation (EU) 910/2014 (eIDAS): eur-lex.europa.eu/eli/reg/2014/910/oj
- Spanish Law 6/2020 on electronic trust services (BOE): boe.es/eli/es/l/2020/11/11/6
Proovik team. Published 18 September 2026; last reviewed 6 September 2026. This article is general information, not legal advice.