Dejan Jasnic · Co-founder & Compliance Lead, Trusty · 20+ years anti-fraud & compliance · ACFE Swiss Chapter Board
A whistleblower policy for nonprofits is not only good governance. Under Directive (EU) 2019/1937, foundations, associations and other nonprofits with 50 or more workers must run an internal reporting channel. This guide explains when the obligation applies, who is protected in a nonprofit and what the policy should contain.
Do foundations and nonprofits need a whistleblowing channel?
Yes, if they reach the threshold. The EU Whistleblowing Directive obliges legal entities in the private sector with 50 or more workers (Article 8(3)). Article 8 makes no exception for non-profit status. A private foundation or association with 50 or more workers is therefore covered like any company.
Foundations owned or controlled by public bodies fall under the public-sector rules, which cover all such entities (Article 8(9)). Member States may exempt public entities with fewer than 50 workers.
National examples for foundations
Some national laws name foundations explicitly. In Spain, the public sector includes public-sector foundations (Article 13 of Law 2/2023). Spain also obliges foundations created by political parties, trade unions and employers’ organizations when they receive or manage public funds (Article 10(1)(c)).
Elsewhere, the general employer rules apply. In Germany, every employer with, as a rule, at least 50 employees needs an internal reporting office (Section 12 HinSchG). In Portugal, the rule covers legal entities with 50 or more workers (Article 8 of Law No. 93/2021).
Who is protected in a nonprofit?
The circle of protected persons is wide, which matters for nonprofits (Article 4). It includes employees, board members, volunteers and paid or unpaid trainees. Staff of contractors and suppliers are covered too, as are former employees and applicants. Facilitators and relatives who could suffer retaliation are also protected.
Volunteers are a large part of many nonprofits. Your whistleblower policy should therefore address them directly and tell them how to report.
What risks can be reported in a nonprofit?
The directive covers breaches of EU law in listed areas (Article 2). For nonprofits, these areas are often relevant:
- misuse of EU funds or grants, as breaches affecting the financial interests of the EU;
- public procurement, where the organization awards public contracts;
- protection of personal data of donors, members and beneficiaries;
- money laundering and terrorist financing;
- consumer protection, product safety and public health in the organization’s activities.
National laws may add further areas, such as criminal offences in Germany (Section 2 HinSchG).
What should a whistleblower policy for nonprofits contain?
A clear policy sets out:
- who can report, including volunteers, donors and partners;
- what can be reported and how;
- who receives and handles reports, for example an external ombudsperson;
- the deadlines: acknowledgment within seven days and feedback within three months (Article 9);
- how confidentiality and data protection are ensured;
- the protection against retaliation;
- information on external reporting to competent authorities.
A whistleblowing policy template helps you draft it.
How to set up the channel in a foundation
Start with the board decision and assign responsibility. Choose a secure digital channel that also accepts anonymous reports. Publish the policy on your website and intranet, and train the case handlers. The whistleblowing channel guide lists all legal requirements.
Internal or external case handling for a foundation?
Both are possible. The directive allows the channel to be run by a designated person or department, or by a third party (Article 8(5)). The safeguards of Article 9(1) then also apply to that third party.
In a small team, everyone may know everyone. An external ombudsperson or provider can make it easier for staff and volunteers to report concerns about colleagues or board members. Foundations with 50 to 249 workers may also share resources for receiving reports and investigating them (Article 8(6)).
Data protection in a nonprofit whistleblowing channel
Nonprofits often hold sensitive data about donors, members and beneficiaries. Any processing of personal data in the channel must comply with the GDPR (Article 17). Collect only data that is relevant to the report, limit access to the case handlers and set clear deletion periods. Our article on data protection and compliance explains how the DPO and the compliance function share these tasks.
Why a whistleblower policy protects donor trust
Donors, grant givers and members expect their money and data to be used properly. A whistleblower policy for nonprofits shows that concerns are welcome and handled seriously. It also gives the board early warning of problems, before they reach an authority or the media.
What volunteers and staff need to know
Your policy only works if people know it exists. Tell staff and volunteers where to find the channel and how to use it. Explain that their identity stays confidential and that retaliation is prohibited (Articles 16 and 19). State whether anonymous reports are accepted, and explain the option to report to a competent authority instead (Article 9(1)(g)). Repeat this information in onboarding, on your website and in volunteer briefings.
Review the policy regularly with the board. Check how many reports came in, whether deadlines were met and whether volunteers know the channel. Adjust the policy when national law changes or when your foundation grows past the threshold.
Conclusion
Foundations and nonprofits with 50 or more workers need a reporting channel, and volunteers are among the protected persons. A clear whistleblower policy for nonprofits protects both the people who report and the trust of donors. With whistleblowing software from Trusty, your organization runs a secure, confidential channel without an IT project, from 49 EUR per month.
Related reading: Whistleblower protection under EU law and Whistleblowing investigations: managers’ duties and limits.
Frequently asked questions
Yes, if they have 50 or more workers. Article 8 of Directive (EU) 2019/1937 makes no exception for non-profit status. Public-sector foundations fall under the public-sector rules.
Yes. Volunteers and paid or unpaid trainees are expressly protected (Article 4(1)(c)).
Who can report, what and how, who handles reports, the 7-day and 3-month deadlines, confidentiality, protection against retaliation and information on external reporting.
Yes. A voluntary channel that follows the standards of the directive keeps concerns inside the organization. See our guide to the voluntary whistleblowing channel.
FROM 49 EUR PER MONTH
Trusty Whistleblowing: a reporting channel compliant with the EU Whistleblower Directive, live in minutes with no IT project. From 49 EUR per month, 7-day free trial.