Dejan Jasnic · Co-founder & Compliance Lead, Trusty · 20+ years anti-fraud & compliance · ACFE Swiss Chapter Board
Whistleblowing in professional bodies, such as chambers, bar associations and professional associations, raises specific questions. Is the body public or private? How does professional secrecy fit in? This guide explains the obligations under Directive (EU) 2019/1937, national examples and how to set up a channel.
Do professional bodies need a whistleblowing channel?
It depends on the legal form. Under the EU Whistleblowing Directive, the obligation covers all legal entities in the public sector, including entities they own or control (Article 8(9)). Member States may exempt public entities with fewer than 50 workers. Professional bodies organized under private law follow the private-sector rule: 50 or more workers (Article 8(3)).
Some professional bodies are organized under public law, others under private law. Check how national law classifies yours.
National examples
- Spain: the public sector includes corporations under public law, which must have an internal information system (Article 13 of Law 2/2023).
- Portugal: public associations are among the competent authorities that can receive external reports (Article 12 of Law No. 93/2021). A professional body may therefore receive reports from outside as well as run its own channel.
- Germany: the obligation applies to employers with, as a rule, at least 50 employees, and the law also addresses public employers (Section 12 HinSchG).
Who can report in a professional body?
Protection covers people who learn of breaches in a work-related context (Article 4). This includes the body’s employees, board members, volunteers and trainees, and staff of its suppliers. Self-employed professionals are protected too when they report breaches they learned of through their work (Article 4(1)(b)).
How does professional secrecy fit in?
The directive does not affect the protection of legal and medical professional privilege (Article 3(3)(b)). Information covered by such privilege, for example a lawyer’s communication with a client, keeps its protection. Your policy should explain this limit clearly, so members know what they can report and what remains confidential.
What can be reported in a professional body?
The directive covers breaches of EU law in listed areas (Article 2), such as public procurement, consumer protection, data protection and the EU’s financial interests. For professional bodies, typical cases involve the use of public funds, procurement, the handling of members’ personal data and money laundering rules. National laws may add further areas (Article 2(2)).
How to set up a channel in a professional body
- Clarify whether national law treats your body as public or private, and check the headcount.
- Designate an impartial person or department, or appoint an external provider (Articles 8(5) and 9(1)(c)).
- Set up a secure channel for written and oral reports.
- Adopt a whistleblowing procedure with the 7-day and 3-month deadlines.
- Explain professional secrecy and external reporting options in your policy.
- Inform staff, board members and, where relevant, members.
Whistleblowing in professional bodies: why it matters
Professional bodies set and enforce standards for their professions, such as lawyers, doctors, engineers or accountants. Whistleblowing in professional bodies helps detect misuse of funds, conflicts of interest and breaches of the rules that the body itself must follow. It also protects the trust that members and the public place in the profession.
Data protection and confidentiality in the channel
Professional bodies hold personal data about their members, including disciplinary information. Any processing of personal data in the whistleblowing channel must comply with the GDPR (Article 17 of the directive). The identity of the reporting person may only be known to the authorized case handlers unless they consent (Article 16). Persons concerned keep their right to be heard and to the presumption of innocence (Article 22).
Internal channel and external reporting
Reporting persons may report to the professional body’s internal channel or go directly to a competent national authority (Article 10). Member States must encourage internal reporting where the breach can be handled effectively inside the organization and there is no risk of retaliation (Article 7(2)). Your policy must explain the external options clearly (Article 9(1)(g)). Our guide to external whistleblowing lists the authorities in several countries.
Who should handle reports in a professional body?
The case handler must be impartial (Article 9(1)(c)). In a professional body, reports may concern board members or the disciplinary function itself. An external ombudsperson or provider can therefore increase trust. The directive allows a third party to operate the channel, with the same safeguards (Article 8(5)).
Benefits of a whistleblowing channel for professional bodies
A channel brings concrete benefits. The board hears about problems early, before they reach an authority or the media. Members and staff see that the body applies to itself the standards it expects from the profession. Clear procedures also protect the persons concerned against unfounded accusations, because every step is documented. Finally, a digital channel with anonymous two-way communication lowers the barrier to report concerns about senior office holders.
Review the channel regularly with the board and the case handler. Check whether reports were acknowledged within seven days and answered within three months. Update the policy when national law or the body’s legal form changes.
Conclusion
Professional bodies fall under the EU Whistleblowing Directive either as public-law bodies or as private employers with 50 or more workers. Professional secrecy stays protected, so a clear policy is essential. With whistleblowing software from Trusty, your organization runs a secure, confidential channel without an IT project, from 49 EUR per month.
Related reading: Whistleblowing procedure step by step and Whistleblowing policy template.
Frequently asked questions
Public-law bodies fall under the public-sector rule of Article 8(9), with possible exemptions below 50 workers. Private professional associations need a channel from 50 workers (Article 8(3)).
No. The directive does not affect legal and medical professional privilege (Article 3(3)(b)).
Yes, self-employed persons who learn of breaches through their work are protected (Article 4(1)(b)).
In some countries, yes. In Portugal, public associations are among the competent authorities for external reports (Article 12 of Law No. 93/2021).
FROM 49 EUR PER MONTH
Trusty Whistleblowing: a reporting channel compliant with the EU Whistleblower Directive, live in minutes with no IT project. From 49 EUR per month, 7-day free trial.