Dejan Jasnic · Co-founder & Compliance Lead, Trusty · 20+ years anti-fraud & compliance · ACFE Swiss Chapter Board
Knowing how to report whistleblowing to an authority protects both the reporting person and the case. Directive (EU) 2019/1937 gives everyone with a work-related concern the right to report directly to a competent national authority. This guide explains the process step by step and shows how Member States have set up their authorities since 2021.
Before you report: find the competent authority
Each Member State designates its own competent authorities (Article 11(1) of the EU Whistleblowing Directive). Some countries have a central office, others assign reports to sector authorities such as financial supervisors. If you send a report to the wrong authority, it must forward the report securely to the competent one and tell you (Article 11(6)).
Our overview of external whistleblowing lists the authorities in several countries.
How to report whistleblowing step by step
- Read the authority’s information page. Every authority must publish the conditions for protection, its contact details, the procedure and the confidentiality rules (Article 13).
- Choose the format. You can report in writing or orally, by telephone or voice message, and on request in a physical meeting (Article 12(2)).
- Describe what you know. State the facts, dates and people involved. Reasonable suspicions are enough; you do not need full proof (Article 5(2)).
- Keep the acknowledgment. The authority confirms receipt within seven days, unless you asked otherwise or this would endanger your identity (Article 11(2)(b)).
- Wait for feedback. You receive feedback within three months, or six months in duly justified cases (Article 11(2)(d)).
- Receive the outcome. The authority tells you the final outcome of investigations triggered by your report (Article 11(2)(e)).
What happens to your report?
The authority follows up diligently (Article 11(2)(c)). Member States may let it close a procedure if the breach is clearly minor or if a report repeats an earlier one without new information. In both cases, you are told the decision and the reasons (Article 11(3) and (4)).
Are you protected when you report externally?
Yes. You are protected if you had reasonable grounds to believe that the information was true and within scope when you reported (Article 6(1)). You may report externally directly, without using an internal channel first (Article 10). Your identity stays with the authorized staff unless you give explicit consent (Article 16). Retaliation is prohibited (Article 19). More details are in our article on whistleblower protection.
How Member States set up their authorities since 2021
Member States had to transpose the directive by 17 December 2021 (Article 26). The Commission had to report on its implementation by 17 December 2023 (Article 27). EUR-Lex publishes the national transposition measures communicated by the Member States. Some examples from the national texts:
- Portugal: Law No. 93/2021 of 20 December 2021 entered into force 180 days after publication (Article 31). It assigns external reports to the competent authorities and, as a fallback, to the National Anti-Corruption Mechanism (Article 12).
- France: Law No. 2022-401 of 21 March 2022 amended Loi Sapin II. The new Article 8, in force since 1 September 2022, lets reporting persons contact designated authorities or the Défenseur des droits.
- Ireland: the Protected Disclosures (Amendment) Act 2022 established the Office of the Protected Disclosures Commissioner, held by the Ombudsman (section 10A).
- Spain: Law 2/2023 of 20 February 2023 authorized the creation of the Independent Authority for Whistleblower Protection (Article 42).
- Italy: Legislative Decree No. 24/2023 of 10 March 2023 has applied since 15 July 2023, with ANAC running the external channel (Articles 7 and 24).
- Germany: the HinSchG created the external reporting office at the Federal Office of Justice (Section 19).
What this means for companies
Your company must give employees clear information on how to report externally (Article 9(1)(g)). Add the competent authorities for each country to your policy and intranet. A fast, trusted internal whistleblowing channel remains the best way to resolve problems before they reach an authority.
Practical tips before you report
- Write down the facts early: note dates, places, people and documents while your memory is fresh.
- Collect evidence lawfully: keep copies you are allowed to access, and do not break other laws to obtain information.
- Check professional secrecy: legal and medical professional privilege remain protected (Article 3(3)(b)).
- Ask for advice: Member States must provide free and independent information and advice on procedures and remedies (Article 20(1)(a)).
- Keep your own records: save the acknowledgment and any feedback you receive.
Knowing how to report whistleblowing correctly makes it easier for the authority to act and strengthens your protection.
What information should a report contain?
A useful report answers five questions: what happened, when, where, who was involved and how you know. Add documents or other evidence you are allowed to share. If you are unsure about some facts, say so; reasonable suspicions are protected (Article 5(2)). Say whether the authority may contact you, and how.
If you work in several countries, check which authority covers the place where the breach occurred and the area concerned. When unsure, contact the authority that seems closest to the case. It must forward the report if it is not competent (Article 11(6)).
Conclusion
Reporting whistleblowing to an authority follows common EU rules: published information, written or oral reports, acknowledgment within seven days and feedback within three or six months. Member States have set up their authorities since 2021, each in its own way. With whistleblowing software from Trusty, your organization runs a secure, confidential channel without an IT project, from 49 EUR per month.
Related reading: External whistleblowing: reporting authorities across the EU and Whistleblowing law in the EU.
Frequently asked questions
Find the competent national authority, read its published information, then report in writing or orally. You receive an acknowledgment within seven days and feedback within three or, in justified cases, six months (Articles 11 to 13).
Yes. The directive lets reporting persons report externally directly (Article 10).
The authority must forward your report securely to the competent authority and inform you without delay (Article 11(6)).
The directive had to be transposed by 17 December 2021 (Article 26). National dates differ, from Portugal's law of December 2021 to Italy's decree applying from July 2023.
FROM 49 EUR PER MONTH
Trusty Whistleblowing: a reporting channel compliant with the EU Whistleblower Directive, live in minutes with no IT project. From 49 EUR per month, 7-day free trial.