Dejan Jasnic · Co-founder & Compliance Lead, Trusty · 20+ years anti-fraud & compliance · ACFE Swiss Chapter Board
Not every company must run a whistleblowing channel. Under Directive (EU) 2019/1937, private companies with fewer than 50 workers are usually exempt. A voluntary whistleblowing channel can still be worth it. This guide explains who is not obliged, which rules still apply and which minimum standards a voluntary channel should meet.
Which companies are not obliged to have a channel?
The obligation applies to private-sector legal entities with 50 or more workers (Article 8(3) of the EU Whistleblowing Directive). Smaller companies are not obliged, with two exceptions. Entities covered by the EU acts in Parts I.B and II of the Annex, such as rules on financial services or money laundering, need a channel regardless of size (Article 8(4)). Member States may also oblige smaller companies after a risk assessment, for example in sectors with risks to the environment or public health (Article 8(7)).
National law can widen the circle. Italy, for example, also covers private entities with an organizational model under Legislative Decree No. 231/2001, whatever their headcount (Article 2 of Legislative Decree No. 24/2023). Our guide on who must comply with the EU Whistleblowing Directive covers the obligation in detail.
Are employees of small companies still protected?
Yes. The protection of reporting persons does not depend on the size of their employer (Article 4). An employee of a small company can report a breach to a competent national authority (Article 10). Retaliation against them is prohibited (Article 19).
This is the main reason to consider a voluntary channel. Without one, concerns are more likely to go straight to an authority. With a trusted internal channel, your company has the chance to hear about problems first and fix them.
Why set up a voluntary whistleblowing channel?
A voluntary channel offers several advantages:
- Early warning: your company learns about risks before they become fines or headlines.
- Trust: employees, customers and business partners see that concerns are taken seriously.
- Business requirements: larger customers and partners may expect suppliers to offer a reporting channel.
- Growth readiness: once your headcount reaches 50, the channel is already in place.
What rules apply to a voluntary channel?
Some national laws regulate voluntary channels too. In Spain, private entities that are not obliged may set up their own internal information system, which must then meet all requirements of the law (Article 10(2) of Law 2/2023). Elsewhere, a voluntary channel is not strictly regulated, but the GDPR always applies when personal data is processed.
The safest approach is to follow the standards for mandatory channels from the start.
Minimum requirements for a voluntary whistleblowing channel
We recommend that a voluntary channel meets the requirements of Article 9 of the directive:
- Confidentiality: protect the identity of the reporting person and of third parties named in the report.
- Accessible reporting: allow written and oral reports, ideally also anonymous ones.
- Acknowledgment: confirm receipt within seven days.
- Impartial handling: designate a person or department, or an external provider, to follow up.
- Feedback: inform the reporting person within three months.
- Records and data protection: document reports securely and delete data once it is no longer needed.
- No retaliation: state clearly in your policy that reporting persons are protected.
How to set up a voluntary channel with little effort
A small company does not need a large compliance team. A digital channel from a specialized provider handles confidential intake, anonymous communication, deadlines and documentation. Write a short policy, name one or two responsible persons and inform your employees. The whistleblowing channel guide lists the setup steps.
Voluntary vs mandatory whistleblowing channel: key differences
The core difference is legal pressure, not quality. A mandatory channel must meet the national requirements and is subject to fines. Whether a voluntary whistleblowing channel must meet the same rules depends on national law. In Spain, it must meet the full legal standard (Article 10(2) of Law 2/2023).
For reporting persons, the difference is smaller than it seems. Their protection under the directive applies in both cases. If a voluntary channel is slow or insecure, they may simply go to an authority.
What happens when your company passes 50 workers?
Once your company reaches the national threshold, the voluntary channel becomes mandatory. National counting rules differ: Germany counts employers with, as a rule, at least 50 employees (Section 12 HinSchG). Italy looks at the average headcount in the last year (Article 2 of Legislative Decree No. 24/2023). If your voluntary channel already follows the directive, the switch requires no new project.
What your voluntary policy should state
Keep the policy short and practical. State who can report, what can be reported and through which channel. Name the person or provider who handles reports and give the deadlines for acknowledgment and feedback. Confirm that retaliation is not tolerated and that identities stay confidential. Add the external reporting options, so employees know their rights.
A voluntary whistleblowing channel does not have to be expensive. What matters is that it is secure, easy to reach and handled by someone people trust. Start small, measure how it is used and adjust the process as your company grows.
Conclusion
Companies with fewer than 50 workers are usually not obliged to run a channel, but their employees are still protected and can report to the authorities. A voluntary whistleblowing channel that follows the directive’s standards keeps concerns inside the company. With whistleblowing software from Trusty, your organization runs a secure, confidential channel without an IT project, from 49 EUR per month.
Related reading: Advantages of a corporate whistleblowing channel and Who must comply with the EU Whistleblowing Directive.
Frequently asked questions
Usually not. Exceptions are entities covered by the EU acts listed in the Annex of the directive, such as financial services, and companies that national law brings into scope.
Yes. Protection does not depend on employer size. They can report to a competent national authority and are protected against retaliation (Articles 4, 10 and 19).
We recommend the standards of Article 9: confidentiality, written and oral reporting, acknowledgment within seven days, impartial follow-up and feedback within three months.
It depends on the country. In Spain, a voluntary internal information system must meet all requirements of Law 2/2023 (Article 10(2)). The GDPR applies in every case.
FROM 49 EUR PER MONTH
Trusty Whistleblowing: a reporting channel compliant with the EU Whistleblower Directive, live in minutes with no IT project. From 49 EUR per month, 7-day free trial.