Dejan Jasnic · Co-founder & Compliance Lead, Trusty · 20+ years anti-fraud & compliance · ACFE Swiss Chapter Board
A whistleblowing channel is a secure way for employees and other people connected to your company to report wrongdoing confidentially. Under the EU Whistleblowing Directive and the national laws based on it, most companies with 50 or more workers in the EU must operate one. This guide explains which companies are covered and what the channel must offer. It also shows how Germany, France, Italy, Spain, Portugal and Ireland apply the rules, and how to set up your whistleblowing channel correctly.
The legal basis: the EU Whistleblowing Directive and national laws
The legal basis is Directive (EU) 2019/1937, often called the EU Whistleblowing Directive. It sets common minimum standards for three things: internal reporting channels in companies, external channels at national authorities and protection against retaliation. Member States had to transpose it by 17 December 2021. For private companies with 50 to 249 workers, the deadline was 17 December 2023 (Article 26).
As a directive, it binds the Member States. Your company’s concrete obligations come from the national law of each country where it employs staff. These laws may protect reporting persons more than the directive does (Article 25). If your company operates in several countries, check each national law. Our overview of whistleblowing law in the EU covers the wider legal landscape.
Which companies need a whistleblowing channel?
Under Article 8 of the directive, every private company with 50 or more workers must set up a whistleblowing channel with procedures for follow-up. Some entities need one regardless of size. These are entities covered by the EU acts in Parts I.B and II of the Annex, such as rules on financial services or on money laundering. After a risk assessment, Member States may also oblige smaller companies, for example where their activities endanger the environment or public health.
In the public sector, the obligation covers all legal entities, including entities they own or control. Member States may exempt municipalities with fewer than 10,000 inhabitants or fewer than 50 workers. Read more about when an internal reporting channel is mandatory.
Who can report and what can be reported?
The directive protects people who obtained information on breaches in a work-related context (Article 4). This includes employees, civil servants and self-employed contractors. Shareholders, board members, volunteers and trainees are covered too, as are staff of contractors, subcontractors and suppliers. Protection also extends to former employees, job applicants, facilitators, and colleagues or relatives who could suffer retaliation. Learn more about what a whistleblower is.
The material scope covers breaches of EU law in listed areas (Article 2). Examples are public procurement, financial services, money laundering, product and transport safety, and environmental protection. Food safety, public health, consumer protection and data protection are included as well. So are breaches affecting the EU budget and the internal market, such as competition and state aid rules. Member States may extend protection to further areas under national law.
Whistleblowing channel requirements under the EU directive
A compliant whistleblowing channel is more than an email inbox. Article 9 of the directive sets these minimum requirements:
- Secure and confidential: the channel protects the identity of the reporting person and of third parties named in the report. Unauthorized staff have no access (Articles 9 and 16).
- Written and oral reports: reports can be made in writing, orally or both. Oral reporting works by telephone or voice messaging and, on request, in a physical meeting within a reasonable timeframe.
- Acknowledgment within 7 days: the reporting person receives confirmation of receipt within seven days.
- Impartial case handler: an impartial person or department follows up diligently and stays in contact with the reporting person.
- Feedback within 3 months: the reporting person receives feedback no later than three months after the acknowledgment.
- Information on external reporting: clear, easily accessible information on how to report to the competent authorities.
- Record keeping: every report is documented confidentially and kept no longer than necessary (Article 18).
Whether anonymous reports must be accepted and followed up is decided by national law (Article 6(2)). A channel that accepts anonymous reports with two-way communication keeps your company covered where national rules differ.
How national laws implement the directive
All Member States have transposed the directive, and the core rules are similar. The details differ, so check the law of each country where your company has employees. Some examples:
- Germany: under the Whistleblower Protection Act (Hinweisgeberschutzgesetz, HinSchG), employers that usually have 50 or more employees need an internal reporting office (Section 12). Certain financial firms are covered regardless of size. The federal external reporting office is part of the Federal Office of Justice (Bundesamt für Justiz, Section 19).
- France: Loi Sapin II (Law No. 2016-1691), as amended by the Waserman Law of 21 March 2022, applies to private-law entities with at least 50 employees (Article 8). They need an internal procedure for collecting and handling reports. Externally, reporting persons can contact the authorities designated by decree or the Défenseur des droits.
- Italy: Legislative Decree No. 24/2023 covers private entities with an average of at least 50 workers in the last year (Article 2). Entities that adopted an organizational model under Legislative Decree No. 231/2001 are covered regardless of headcount. The external channel is run by the National Anti-Corruption Authority (ANAC, Article 7).
- Spain: Law 2/2023 obliges private-sector employers with 50 or more workers to have an internal information system (Article 10). External reports go to the Independent Authority for Whistleblower Protection or to the competent regional authorities (Article 16).
- Portugal: Law No. 93/2021 applies to legal entities with 50 or more workers (Article 8). External reports go to the competent authority, such as the Public Prosecutor’s Office or Banco de Portugal (Article 12).
- Ireland: the Protected Disclosures (Amendment) Act 2022 amended the Protected Disclosures Act 2014. Employers with 50 or more employees must now operate internal reporting channels (section 6(3)). The 2022 Act also provides for an Office of the Protected Disclosures Commissioner.
The United Kingdom is outside the EU and not bound by the directive. Its framework is the Public Interest Disclosure Act 1998. UK entities of an international group need a separate assessment.
Data protection in the whistleblowing channel
A whistleblowing channel processes highly sensitive personal data. Under Article 17 of the directive, all processing must comply with the GDPR (Regulation (EU) 2016/679). Personal data that is manifestly irrelevant to a report must not be collected. If collected by accident, it must be deleted without undue delay. Access is limited to the staff authorized to handle reports.
If your company has a data protection officer (DPO), involve them when you select and configure the channel. Typical topics are the data protection impact assessment, access rights and retention periods. Our guide to the whistleblowing DPIA explains this assessment step by step.
How to set up a whistleblowing channel step by step
- Check which laws apply: identify the national law for each country and entity where your company employs staff.
- Assign responsibility: designate an impartial person or department to receive and follow up on reports, or appoint a third-party provider.
- Provide reporting channels: set up a secure digital channel for written and oral reports, ideally with anonymous two-way communication.
- Write the procedure: define how reports are acknowledged, assessed, investigated and closed, including the 7-day and 3-month deadlines. A whistleblowing policy template helps you start.
- Consult employee representatives: where national law requires it, consult the works council or social partners first (Article 8(1)).
- Inform people: explain the internal channel and the external authorities, for example on your intranet and website.
- Train and review: train the case handlers and review deadlines, access rights and processes regularly.
Run the whistleblowing channel in-house or outsource it?
Both options are allowed. Under Article 8(5) of the directive, a designated person or department may operate the channel. A third party, such as a specialized provider or an ombudsperson, may run it instead. The safeguards of Article 9(1) then also apply to that third party.
Private companies with 50 to 249 workers may also share resources for receiving reports and carrying out investigations (Article 8(6)). Each company remains responsible for maintaining confidentiality, giving feedback and addressing the reported breach. An external solution often brings more distance, expertise and availability. What matters is that the channel meets the legal requirements and that employees know how to use it.
Internal channel and external reporting authorities
Reporting persons may report internally first or go directly to a national competent authority (Article 10). Member States must still encourage internal reporting first (Article 7(2)). This applies where the breach can be handled effectively inside the company and the reporting person sees no risk of retaliation. Each Member State designates its own authorities. Examples are the Federal Office of Justice in Germany and ANAC in Italy. A trusted internal whistleblowing channel is therefore the best way to learn about problems early and resolve them in-house.
Protection against retaliation and penalties
The directive prohibits any form of retaliation, including threats and attempts (Article 19). Examples are dismissal, demotion, withheld promotion, changes to duties or pay, and withheld training. If a reporting person suffers a detriment after a report, retaliation is presumed. The person who took the measure must then prove it was duly justified (Article 21(5)). Protection requires reasonable grounds to believe that the information was true and within scope (Article 6).
Member States must set effective, proportionate and dissuasive penalties (Article 23). They cover hindering reports, retaliation, vexatious proceedings and breaches of confidentiality. Amounts are set nationally. In Germany, failing to set up an internal reporting office can be fined up to EUR 20,000 (Section 40 HinSchG). In Spain, very serious infringements by legal persons carry fines of up to EUR 1,000,000 (Article 65 of Law 2/2023).
The benefits of a whistleblowing channel
A whistleblowing channel is not only a legal obligation but also an advantage. Your company learns about problems early and can investigate before damage occurs. It also strengthens the trust of employees, customers and business partners.
A well-run channel supports other compliance duties as well, such as anti-money laundering controls, anti-bribery programs and supply chain due diligence.
Conclusion
In the EU, companies with 50 or more workers must operate a whistleblowing channel. The directive defines how it works: confidential reporting, clear deadlines, proper records and protection against retaliation. National laws add their own details and penalties. With whistleblowing software from Trusty, your company runs a channel that follows these rules without an IT project, from 49 EUR per month.
Related reading: Whistleblowing Investigations: Managers’ Duties and Limits and Importance of an Encrypted Whistleblowing Channel.
Frequently asked questions
Directive (EU) 2019/1937 requires Member States to oblige private companies with 50 or more workers to set up internal reporting channels. The concrete obligation comes from national law, such as the HinSchG in Germany, Loi Sapin II in France, Legislative Decree No. 24/2023 in Italy or Law No. 93/2021 in Portugal.
The DPO advises on setting up the channel in line with the GDPR, for example on the data protection impact assessment, access rights and retention periods. Under Article 17 of the directive, all processing of personal data in the channel must comply with the GDPR.
Both are allowed. The directive lets companies operate the channel through a designated person or department or entrust it to a third party, to which the same safeguards apply. Companies with 50 to 249 workers may also share resources for receiving and investigating reports.
The channel reveals problems early, strengthens trust and corporate culture, and helps avoid fines and reputational damage. It also supports other compliance duties, such as anti-money laundering controls and supply chain due diligence.
The company acknowledges receipt within seven days and gives the reporting person feedback within no more than three months from the acknowledgment (Article 9 of the directive). National laws may add further details.
Usually not. Exceptions are entities covered by the EU acts listed in the Annex of the directive, such as those on financial services or money laundering, and companies that national law brings into scope. Italy, for example, also covers smaller companies with an organizational model under Legislative Decree No. 231/2001.
FROM 49 EUR PER MONTH
Trusty Whistleblowing: a reporting channel compliant with the EU Whistleblower Directive, live in minutes with no IT project. From 49 EUR per month, 7-day free trial.