For the first time the Spanish Data Protection Act (Spanish DPA) provides provisions for permitting anonymous reporting.

This is a seismic shift for the Country where the stance has been firmly against anonymity for whistleblowers in the decades since World War II. The change to allow an employee, or other stakeholder, to voice their concern without having to reveal their identity can only be seen as a positive step forward into the space most European countries have been in for some time.

"As we have seen with changes across many countries over recent years, this change will give employees more confidence to report matters of concern. We will no doubt, over time, see an increase in employees voicing concerns from this country" says Graham Long, CEO at Safecall

To ensure they remain compliant organisations with Spanish operations should look to include changes such as this as part of their Code of Conduct, Whistleblowing Policy, and internal and external processes.

As with many European countries, the data retention period differs and organisations with Spanish based operations need to keep in step with these rules. Unless the purpose for preservation is to leave evidence for the prevention of the commission of crimes by a legal entity, the retention period for all personal data is three months.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.