Skip to main content
Information to the interested party on data protection

5.99. Internal information system on regulatory violations and the fight against corruption

Description of the activity

In accordance with the provisions of Law 2/2023, of February 20, regulating the protection of people who report regulatory infractions and the fight against corruption, an internal channel has been created for the communication of possible criminal infractions or serious or very serious administrative violations of the Tax Agency staff. Likewise, this channel is extended to all people who, outside of a work or professional context, report conduct contrary to the legal system.

This activity includes the reception, study, qualification, monitoring and completion of the information received by this system.


Information on conduct of the Tax Agency staff, for the effective application of Directive (EU) 2019/1937 of the European Parliament and of the Council of October 23, 2019 on the protection of persons who report infringements of the Law of the Union, incorporated into Spanish law through Law 2/2023, of February 20, regulating the protection of people who report regulatory infractions and the fight against corruption.


  • Communicators
  • People who may be the subject of investigation
  • Any third party mentioned in the communication


  • Communication presented
  • Information qualification
  • Communication monitoring
  • Name and surname, address, email, DNI/NIE (optional data in communications)


  • Collection 
  • Record
  • Storage
  • Structuring 
  • Modification
  • Update
  • Copy
  • Analysis
  • Enquiry
  • Extraction
  • Promotion
  • Interconnection
  • Limitation
  • Suppression 
  • Destruction
  • Other


  • They are not foreseen, with the exception of communications that must be brought to the attention of the Administration of Justice.

International transfers

are not foreseen

Planned deadlines for deletion

Communications will be kept only for the period deemed necessary and as long as it is proportionate in order to comply with the requirements imposed by the regulations.

In no case may the data be kept for a period of more than ten years.



Does not apply.

Technical/organizational measures

All data processed has been evaluated through a risk analysis, having obtained a list of technical and organizational measures to apply.

These measures have been applied in accordance with the approved adaptation plan.

Special emphasis is placed on the application of measures that will guarantee anonymity, unless the informant himself expressly does not wish for his identity to be anonymous, considering that it can only be revealed when a rule provides for it or if it is requested within the framework. of a criminal process.

More information