The school as employer: whistleblowing channel, equality plan and the duties nobody looks at

The school as employer: whistleblowing channel, equality plan and the duties nobody looks at

A leadership team devotes a reasonable amount of attention to the school's duties towards students and families: children's data protection, safeguarding, conduct protocols, accessibility. That is logical, because it is the visible part and the part that gets communicated.

At the same time, a mid-sized school is an organisation with fifty or more employees. That triggers a completely different block of obligations, with its own inspections and penalties, which in many schools lives scattered between the accountant, a filing cabinet and somebody's memory. This article maps that block.

Whistleblowing channel: what Law 2/2023 actually requires

Spain's Law 2/2023 requires an internal reporting system for entities with fifty or more workers. The headcount includes everyone: teachers, administration, services, canteen staff and directly employed activity leaders.

What the law requires is not an inbox, it is a system with specific guarantees:

• Reports in writing and verbally.
• Confidentiality of the reporter and anonymous reports if they prefer.
• A system manager formally appointed by the governing body.
• Acknowledgement of receipt within seven days.
• A response within a maximum of three months, with a record of every step.

That is why a corporate email address does not work as a channel, even though it technically receives messages: it does not allow anonymity, keeps no record of deadlines and does not separate access to the information from the rest of the organisation.

Why it is not the same as the safeguarding protocol

This is the most frequent confusion and worth clearing up, because having one does not cover the other:

• Safeguarding protocol: protects children from violence. Its central figure is the wellbeing coordinator. Its natural subject is a situation affecting a minor, with specific deadlines and reporting duties to the authorities.
• Law 2/2023 channel: protects whoever reports a regulatory breach inside the organisation. Its scope is mainly employment and administrative: irregularities in hiring, grants, safety or data processing.

Some cases may trigger both, but they are distinct systems with distinct people responsible. Keeping them clearly separate avoids the most awkward problem: a report entering through the wrong channel and losing the guarantees or deadlines of the right one.

Equality plan: drafted is not the same as current

The equality plan is mandatory for organisations with fifty or more workers and must be registered in the corresponding public register. Most schools of that size have one. The problem is rarely absence, it is maintenance. An equality plan is not a document you draft once:

• A negotiated prior diagnosis.
• A pay audit.
• Concrete measures with indicators and deadlines.
• Periodic monitoring and a review at the end of its term.

In an inspection, what is requested is not only the document: it is the evidence of monitoring.

The harassment protocol that gets forgotten

There is an associated element frequently forgotten: the protocol against sexual harassment and harassment on grounds of sex, which is mandatory regardless of headcount and which all staff must know about, not merely exist.

How the five pieces fit together

Seen together, the school's duties as employer and as educational institution form five blocks that touch each other:

• The whistleblowing channel, with its system manager.
• The equality plan and harassment protocol, usually with a monitoring committee.
• Working time records, with their four-year retention duty and their relationship to the right to disconnect.
• The safeguarding protocol, with the wellbeing coordinator.
• Data protection, with the appointed officer.

What makes the set manageable is not having five documents, it is being clear on three things for each: who is responsible, what evidence must be available, and how often it is reviewed. In small schools several of these roles fall to the same person, which is legitimate but requires the records to stay separate even when the person does not.

What an inspection asks for

Worth knowing before it happens, because almost everything asked for is documentary and reconstructing it afterwards is what consumes days:

• The current document, with its date and approval.
• Evidence that it was communicated to staff. This is where many schools fail: the protocol exists but there is no way to show the workforce knows it.
• The record of actions taken, without needing to disclose confidential content.
• Evidence of the training delivered.

The first three are document management problems. The second, evidence of communication, is the one most readily solved by a platform that records sends and read receipts, because an email sent from a personal account three years ago is not solid evidence.

Case study (Spain)

An education group with two sites and sixty-eight employees ran a compliance inventory ahead of an internal audit. It had an equality plan, a harassment protocol, a safeguarding protocol, working time records and a data protection policy. On paper, everything in order.

Reviewing the evidence turned up three gaps:

• The equality plan was registered but had no monitoring minutes for two years.
• There was no whistleblowing channel compliant with Law 2/2023: internal reports went to a leadership email address.
• For the harassment protocol there was no way to demonstrate it had been communicated to staff hired in the last two years.

The fix was not expensive but it was methodical. They formally appointed the reporting system manager and set up a channel with deadline tracking. They restarted the equality plan monitoring committee with half-yearly meetings and minutes. And they redistributed all five protocols to the whole workforce with read receipts, adding the send to the onboarding process for any new hire, which was the only way to stop the gap reappearing.

Conclusion

A school is two things at once, and the second — an organisation with employees — gets far less attention than the first. Not because nobody cares, but because its obligations lack the daily visibility of those affecting students. The usual result is not deliberate non-compliance, it is correct documentation with no evidence of follow-through.

The part technology solves well is precisely that: distributing a protocol with read receipts, recording the training delivered, retaining records with role-based permissions and being able to prove what was communicated, to whom and when. Book a demo of Edena and we will show you how the full lifecycle of an internal protocol gets documented, from send to evidence.