Definition
An EU directive (2019/1937) establishing minimum standards for the protection of persons who report breaches of EU law, requiring organisations with 50 or more employees to establish internal reporting channels and prohibiting retaliation against whistleblowers.
EU Context
Transposition has been uneven across member states, with several facing infringement proceedings for late or incomplete implementation. Germany did not transpose the directive until July 2023, over 18 months late, through the Hinweisgeberschutzgesetz (Whistleblower Protection Act). France already had robust whistleblower protection through the Sapin II Law (2016), which was updated to align with the directive. Sweden, Denmark, and the Netherlands were among the first to transpose. Key implementation variations include whether member states extended the scope beyond EU law breaches (many did), whether anonymous reporting must be accepted (some member states require it), and the level of penalties for retaliation and non-compliance. The directive has prompted significant investment in compliance infrastructure, with many organisations adopting third-party whistleblowing platforms.
Best Practices
- Establish an internal reporting channel that allows both written and oral reporting and ensures confidentiality of the reporter's identity
- Designate an impartial person or department to receive and follow up on reports, with appropriate training and independence
- Acknowledge receipt of reports within seven days and provide substantive feedback within three months
- Implement clear anti-retaliation policies and train all managers on the prohibition of retaliation
- Keep records of all reports received and the follow-up actions taken, in compliance with data protection requirements
Frequently Asked Questions
Which organisations must have internal whistleblowing channels?
All legal entities in the private sector with 50 or more employees must establish internal reporting channels. Public sector entities must also comply, though member states may exempt municipalities with fewer than 10,000 inhabitants or fewer than 50 employees. Entities with 50 to 249 employees may share resources for receiving and investigating reports.
What protection does a whistleblower receive?
Whistleblowers are protected against all forms of direct and indirect retaliation, including dismissal, demotion, withholding of promotion, reduction of wages, negative performance assessment, harassment, intimidation, and blacklisting. If a detrimental measure is taken after a report, the burden shifts to the employer to prove it was unrelated to the report. Whistleblowers may also receive interim relief and compensation.
Can employees report directly to external authorities instead of using internal channels?
Yes. While member states may encourage internal reporting first, whistleblowers can report directly to competent external authorities and still receive full protection. They can also make public disclosures if they have first reported externally and no appropriate action was taken, or if there is an imminent or manifest danger to the public interest, or a risk of retaliation or evidence destruction.