Whistleblowing channels in a hall of residence or student accommodation in Spain: what the law requires in 2026
Talk about whistleblowing channels in a Spanish hall of residence and two different acts get mixed up. Most centres are reached by only one of them, and not through the route usually taken for granted. Here is what binds whom, with the articles in front of you.
The short answer
They are two rules with different scopes. One arrives through the entity's headcount; the other, through the centre's relationship with its university. Worth knowing which is which before signing anything.
| Rule | Does it reach a hall of residence? | Through which route |
|---|---|---|
| Act 3/2022, on university coexistence | Almost always, in practice | It never mentions halls of residence. It reaches them through their university's Coexistence Rules and through the centre's own house rules. |
| Act 2/2023, on whistleblower protection | Only with 50 or more employees | Directly, through the headcount of the owning entity (Art. 10(1)(a)). Most halls of residence don't reach it; multi-site operators do. |
Source: consolidated texts in the BOE, Spain's official gazette.
Act 3/2022 never mentions halls of residence
It is the first surprise on opening the text: Act 3/2022 does not contain a single mention of colegios mayores or university residences. Its addressee is the university. Art. 2(1) applies it to the public universities of the Spanish university system, and Art. 2(2) adds that private universities and private affiliated centres shall approve their own Coexistence Rules based on the principles and guidelines of the act.
The obligation reaches the centre by inheritance. A hall of residence integrated into a university — or affiliated with it — is subject to the Coexistence Rules that university approves, and its house rules have to be consistent with them. That is why many universities have revised the rules of their halls of residence since 2022.
What the act requires regarding complaints
The article that matters here is 4(2), which requires specific procedures to be put in place to channel complaints or reports of violence, discrimination or harassment. And 4(4) sets the principles they must be handled with.
Among the principles the rule lists are a gender perspective, confidentiality, and the prevention and prohibition of retaliation.
The act also asks for two organisational pieces: alternative dispute resolution based on mediation (Art. 5) and a Coexistence Committee with equal representation of students, teaching and research staff, and administrative and services staff (Art. 6). The deadline to approve the Coexistence Rules was one year from entry into force, on 26 February 2022.
Ojo con esto
That the act doesn't name halls of residence doesn't mean they can ignore it, nor that pointing at the university is enough. Whoever receives the complaint at eleven at night is the centre, not the vice-chancellor's office. If the house rules don't say where that complaint comes in, who sees it and how quickly it gets answered, the procedure exists on paper and not in the building.
Act 2/2023 and the threshold of fifty
Act 2/2023 is the one transposing the European whistleblower protection directive, and it is far more demanding on form. Its Art. 10(1)(a) requires private-sector natural or legal persons with fifty or more employees to have an Internal Information System.
Ojo con esto
The threshold is counted per entity, not per site. A hall of residence with twenty-two people on the payroll is not covered. An operator running six residences with thirty employees in each one is — even though no single site reaches fifty on its own. It is the most frequent confusion in this sector, where ownership and building almost never coincide.
The deadlines, which are the ones that get missed
- Acknowledgement of receipt: seven calendar days from receiving the information (Art. 9(2)(c)).
- Response: three months at most from receipt, extendable by up to three further months in particularly complex cases (Art. 9(2)(d)).
- Ten working days to notify the Independent Whistleblower Protection Authority of the appointment — or the removal — of the System Officer (Art. 8(3)).
The implementation deadlines have already passed: 13 June 2023 for entities with two hundred and fifty employees or more, and 1 December 2023 for those between fifty and two hundred and forty-nine. The act's penalty regime reaches, for very serious infringements, up to one million euros for legal persons.
What the channel has to satisfy
The two rules converge on the essentials, even though only the second spells them out. A channel that serves both has to hold up all of this:
- Confidentiality of the identity of whoever reports, against third parties and against the rest of the centre's team.
- Anonymous communications with follow-up. Art. 7(3) of Act 2/2023 requires allowing the submission and the subsequent handling of anonymous information: you have to be able to ask for a clarification from someone whose name you don't know.
- A register of the information received, with deadline tracking and a trace of what was done with each item.
- A designated officer and a route that does not pass through the direct line manager of the person reporting.
- A prohibition on retaliation, put in writing and known to the centre's community.
- GDPR compliance: a lawful basis for the processing, restricted access for whoever investigates, and defined retention periods.
Where this breaks in practice
A residence's real problem is rarely legal — it is the way in. Nobody uses the physical box in the entrance because you have to walk past reception to reach it. The institutional inbox is opened by the very person you might want to talk about. And the corridor WhatsApp group is not a channel: it is the opposite of a channel.
Which is why anonymity with follow-up is the requirement that costs the most. Collecting an anonymous message is easy; being able to reply to it, ask for a date or tell them the matter has been resolved without ever learning who they are, is not.
Frequently asked questions
Is a hall of residence required to have a whistleblowing channel?
It depends which route the obligation arrives by. Act 2/2023 only binds private entities with fifty or more employees (Art. 10(1)(a)), and most halls of residence don't reach that headcount. What almost always does reach them is Act 3/2022 on university coexistence, which requires the university to have specific procedures for channelling complaints (Art. 4(2)) and which passes to the centre through that university's Coexistence Rules and through the hall's own house rules.
Are the fifty employees counted per site or per company?
Per entity. The threshold in Art. 10(1)(a) of Act 2/2023 refers to the natural or legal person employing the workers, not to each building. An operator with six residences and thirty employees in each is covered, even though no single site reaches fifty.
Does the channel have to accept anonymous reports?
Yes, where Act 2/2023 applies. Art. 7(3) says expressly that internal channels shall allow the submission and subsequent handling of anonymous communications. Collecting them is not enough: you have to be able to process them without knowing who reported, which in practice requires the channel to allow the conversation to continue without identifying the person.
What deadlines are there for answering a report?
Under Act 2/2023: acknowledgement of receipt within seven calendar days of receipt (Art. 9(2)(c)) and a response within a maximum of three months, extendable by up to three further months in particularly complex cases (Art. 9(2)(d)).
Does anything have to be reported to the authority?
Yes, the appointment of the System Officer. Art. 8(3) of Act 2/2023 requires notifying both the appointment and the removal to the Independent Whistleblower Protection Authority within the following ten working days.
Does an email address work as a channel?
As the only channel, hardly. An inbox does not allow the anonymous communication with follow-up that Art. 7(3) requires, it leaves the reporter's identity visible to whoever manages that inbox, and on its own it generates neither the register of information nor the deadline tracking. It can be one more route, not the system.