Definition
An EU directive (2019/1937) establishing minimum standards for the protection of persons who report breaches of EU law, requiring organisations with 50 or more employees to establish internal reporting channels and prohibiting retaliation against whistleblowers.
UK Context
Best Practices
- Establish an internal reporting channel that allows both written and oral reporting and ensures confidentiality of the reporter's identity
- Designate an impartial person or department to receive and follow up on reports, with appropriate training and independence
- Acknowledge receipt of reports within seven days and provide substantive feedback within three months
- Implement clear anti-retaliation policies and train all managers on the prohibition of retaliation
- Keep records of all reports received and the follow-up actions taken, in compliance with data protection requirements
Frequently Asked Questions
Which organisations must have internal whistleblowing channels?
All legal entities in the private sector with 50 or more employees must establish internal reporting channels. Public sector entities must also comply, though member states may exempt municipalities with fewer than 10,000 inhabitants or fewer than 50 employees. Entities with 50 to 249 employees may share resources for receiving and investigating reports.
What protection does a whistleblower receive?
Whistleblowers are protected against all forms of direct and indirect retaliation, including dismissal, demotion, withholding of promotion, reduction of wages, negative performance assessment, harassment, intimidation, and blacklisting. If a detrimental measure is taken after a report, the burden shifts to the employer to prove it was unrelated to the report. Whistleblowers may also receive interim relief and compensation.
Can employees report directly to external authorities instead of using internal channels?
Yes. While member states may encourage internal reporting first, whistleblowers can report directly to competent external authorities and still receive full protection. They can also make public disclosures if they have first reported externally and no appropriate action was taken, or if there is an imminent or manifest danger to the public interest, or a risk of retaliation or evidence destruction.