Dejan Jasnic · Co-founder & Compliance Lead, Trusty · 20+ years anti-fraud & compliance · ACFE Swiss Chapter Board
EU law recognizes three types of whistleblowing: internal reporting, external reporting and public disclosure. What can be reported depends on the subject of the breach, not on the route. This guide explains both dimensions under Directive (EU) 2019/1937, what national laws add and what falls outside the scope.
The three types of whistleblowing
The EU Whistleblowing Directive distinguishes three routes:
- Internal reporting: the report goes to the organization’s own channel (Article 7).
- External reporting: the report goes to a competent national authority, after an internal report or directly (Article 10).
- Public disclosure: the information is made public, which is protected only under strict conditions (Article 15).
Member States must encourage internal reporting first. This applies where the breach can be addressed effectively inside the organization and the reporting person sees no risk of retaliation (Article 7(2)).
What types of breaches can be reported?
The directive protects reports of breaches of EU law in the following areas (Article 2):
- public procurement;
- financial services, products and markets, and the prevention of money laundering and terrorist financing;
- product safety and compliance;
- transport safety;
- protection of the environment;
- radiation protection and nuclear safety;
- food and feed safety, animal health and welfare;
- public health;
- consumer protection;
- protection of privacy and personal data, and security of network and information systems.
Breaches affecting the financial interests of the EU are covered too. So are breaches relating to the internal market, including EU competition and state aid rules.
What information counts as a report?
A report does not need full proof. Information on breaches includes reasonable suspicions about actual or potential breaches that occurred or are very likely to occur (Article 5(2)). Attempts to conceal such breaches are included as well.
A breach is an unlawful act or omission in the listed areas. It also includes acts that defeat the object or purpose of the rules (Article 5(1)).
What do national laws add?
Member States may extend protection to areas that the directive does not cover (Article 2(2)). Germany is an example. Its Whistleblower Protection Act (HinSchG) also covers criminal offences and administrative offences where the rule protects life, health or the rights of employees (Section 2). Check the national law in each country where your company operates.
What falls outside the scope?
Some areas are excluded or unaffected (Article 3). The directive does not affect national security. It also leaves untouched the rules on classified information, legal and medical professional privilege, the secrecy of judicial deliberations and criminal procedure.
Member States may also decide that interpersonal grievances that affect only the reporting person, such as a conflict with a colleague, are channelled to other procedures (recital 22). Where national law allows, your company may route pure HR complaints to a separate process.
Can reports be anonymous?
Whether anonymous reports must be accepted and followed up is decided by national law (Article 6(2)). Anonymous reporting persons who are later identified and suffer retaliation are still protected (Article 6(3)). A channel that supports anonymous two-way communication lets your company handle both cases.
How should your company handle different types of reports?
A clear triage helps. Check each report for the area concerned, the seriousness of the breach and whether it falls under the directive, national law or another procedure. Then follow the deadlines: acknowledgment within seven days and feedback within three months (Article 9). Our whistleblowing procedure guide shows each step, and our whistleblowing channel guide covers the legal requirements.
Examples of reportable breaches by type
The following examples show what a report can look like in each area. They are illustrations, not an exhaustive list:
- Public procurement: a tender is tailored to one bidder, or bids are coordinated between competitors.
- Financial services and money laundering: payments are split to avoid checks, or a customer’s identity is not verified.
- Product safety: a product is sold although required tests failed or were skipped.
- Environment: waste or wastewater is disposed of without the required permits.
- Data protection: customer data is shared without a legal basis, or a data breach is hidden.
- EU financial interests: an EU grant is used for purposes other than those approved.
- Competition: competitors agree on prices or divide markets.
In each case, the reporting person should describe the facts as precisely as possible. A reasonable suspicion is enough.
Types of whistleblowing channels inside a company
Within the internal route, the directive allows several formats (Article 9(2)). Reports can be made in writing, for example through a web platform, or orally by telephone or voice message. On request, the reporting person can also meet the case handler in person. A digital channel can combine these types of whistleblowing in one place and keep every report confidential.
Who can report these breaches?
Reports can come from anyone who learned of the breach in a work-related context (Article 4). This includes employees, self-employed contractors, shareholders, board members, volunteers, trainees and staff of suppliers. Former employees and job applicants are protected too.
When in doubt, accept the report and assess it. A report that falls outside the directive may still concern national law, internal rules or an HR matter. Tell the reporting person which procedure applies, so they know what to expect.
Conclusion
The types of whistleblowing differ by route (internal, external, public) and by subject. The directive covers breaches of EU law in listed areas, and national laws can add further offences, as Germany does. With whistleblowing software from Trusty, your organization runs a secure, confidential channel without an IT project, from 49 EUR per month.
Related reading: How to comply with German whistleblower laws and Whistleblower hotline requirements by US state.
Frequently asked questions
Internal reporting through the organization's channel, external reporting to a competent authority and public disclosure under strict conditions (Articles 7, 10 and 15 of Directive (EU) 2019/1937).
Breaches of EU law in areas such as public procurement, financial services, money laundering, product and transport safety, the environment, public health, consumer protection and data protection. National laws may add further areas.
No. Reasonable suspicions about actual or potential breaches are enough (Article 5(2)). The reporting person must have reasonable grounds to believe that the information is true (Article 6(1)).
Member States may decide that interpersonal grievances that affect only the reporting person are handled through other procedures (recital 22). Where national law allows, such cases can go to HR.
FROM 49 EUR PER MONTH
Trusty Whistleblowing: a reporting channel compliant with the EU Whistleblower Directive, live in minutes with no IT project. From 49 EUR per month, 7-day free trial.