Dejan Jasnic · Co-founder & Compliance Lead, Trusty · 20+ years anti-fraud & compliance · ACFE Swiss Chapter Board
Whistleblower protection in the EU is based on Directive (EU) 2019/1937 and the national laws that implement it. It shields people who report breaches from dismissal, other retaliation and legal liability. This article explains when protection applies, what it covers and what companies risk if they break the rules.
Who is entitled to whistleblower protection?
The EU Whistleblowing Directive protects people who obtained information on breaches in a work-related context (Article 4). This includes employees, civil servants, self-employed contractors, shareholders, board members, volunteers and trainees. Staff of contractors, subcontractors and suppliers are covered as well. So are former employees and job applicants.
Protection also applies to facilitators, to colleagues or relatives who could suffer retaliation and to legal entities connected to the reporting person (Article 4(4)). Our guide on what a whistleblower is explains the definition in detail.
What are the conditions for protection?
Two conditions apply (Article 6(1)). First, the reporting person must have had reasonable grounds to believe that the information was true and within the scope of the directive at the time of reporting. Second, they must have reported internally, externally or by a public disclosure that meets the legal conditions.
Anonymous reporting persons who are later identified and suffer retaliation also qualify for protection (Article 6(3)). Whether anonymous reports must be accepted at all is decided by national law (Article 6(2)).
What does whistleblower protection cover?
The protection is broad. Its main elements are:
- Prohibition of retaliation: any form of retaliation is prohibited, including threats and attempts (Article 19). Examples are dismissal, demotion, changes to duties or pay, negative assessments, intimidation, discrimination and blacklisting.
- Reversed burden of proof: if a reporting person suffers a detriment after a report, retaliation is presumed. The person who took the measure must prove it was duly justified (Article 21(5)).
- No liability for the report: a lawful report does not breach restrictions on disclosure and creates no liability (Article 21(2)). This also applies in proceedings for defamation, breach of secrecy or disclosure of trade secrets (Article 21(7)).
- Confidentiality: the identity of the reporting person stays with the authorized staff unless they give explicit consent (Article 16).
- Support: free and independent information and advice, and assistance from competent authorities (Article 20).
- No waiver: these rights cannot be waived or limited by any agreement, policy or employment contract (Article 24).
When is a public disclosure protected?
Going public is protected only under strict conditions (Article 15). One case is a prior internal or external report that led to no appropriate action within the deadlines. The other is reasonable grounds to believe that the breach poses an imminent or manifest danger to the public interest. Protection also applies when external reporting carries a risk of retaliation or a low prospect of the breach being addressed, for example because evidence may be destroyed.
What about false reports?
Protection does not cover people who knowingly report false information. Member States must set effective, proportionate and dissuasive penalties for such cases. They must also provide for compensation of the resulting damage in accordance with national law (Article 23(2)).
What rights do the persons concerned have?
The person named in a report also has rights. They enjoy the right to an effective remedy and a fair trial, the presumption of innocence and the rights of defence, including the right to be heard and to access their file (Article 22(1)). Their identity must be protected while investigations are ongoing (Article 22(2)).
What are the consequences for companies?
Member States must penalize hindering or attempting to hinder reports, retaliation, vexatious proceedings and breaches of confidentiality (Article 23(1)). The amounts are set nationally, for example:
- Germany: In Germany, failing to set up an internal reporting office can be fined up to EUR 20,000. Obstructing reports, retaliation and breaches of confidentiality can be fined up to EUR 50,000. For companies, Section 40(6) HinSchG refers to Section 30 of the Administrative Offences Act (OWiG), which raises this maximum tenfold to EUR 500,000.
- Italy: the National Anti-Corruption Authority (ANAC) can impose fines of EUR 10,000 to 50,000 for retaliation, obstruction or breaches of confidentiality (Article 21 of Legislative Decree No. 24/2023).
- Spain: very serious infringements by legal persons carry fines of up to EUR 1,000,000 (Article 65 of Law 2/2023).
Beyond fines, retaliation can lead to compensation claims and reputational damage. A well-run whistleblowing channel with clear procedures is the best protection for your company.
How can companies ensure whistleblower protection in practice?
Whistleblower protection works only if managers apply it every day. Four measures help your company:
- A clear policy: state that retaliation is prohibited and explain how reports are handled.
- Trained managers: make sure that decisions about a reporting person, such as promotions or contract renewals, are based on documented, objective reasons.
- Strict confidentiality: limit access to reports to the authorized case handlers.
- A secure channel: offer written, oral and anonymous reporting with two-way communication.
Because the burden of proof is reversed, good documentation is the best defense against unfounded retaliation claims.
Conclusion
Whistleblower protection under EU law covers a wide circle of people and a wide range of retaliation. The reversed burden of proof makes it essential for companies to document every decision about a reporting person. With whistleblowing software from Trusty, your organization runs a secure, confidential channel without an IT project, from 49 EUR per month.
Related reading: Whistleblowing procedure step by step and Types of whistleblowing.
Frequently asked questions
It is the legal protection of people who report breaches they learned about at work. It prohibits retaliation, reverses the burden of proof and excludes liability for lawful reports (Articles 19 and 21 of Directive (EU) 2019/1937).
The reporting person must have had reasonable grounds to believe the information was true and within scope, and must have used an internal or external channel or met the conditions for a public disclosure (Article 6).
Dismissal in retaliation for a report is prohibited (Article 19). If a detriment follows a report, retaliation is presumed, and the employer must prove that the measure was duly justified (Article 21(5)).
Fines are set nationally. In Germany, retaliation can be fined up to EUR 50,000, or up to EUR 500,000 for companies. In Italy, ANAC can impose EUR 10,000 to 50,000.
FROM 49 EUR PER MONTH
Trusty Whistleblowing: a reporting channel compliant with the EU Whistleblower Directive, live in minutes with no IT project. From 49 EUR per month, 7-day free trial.