Dejan Jasnic · Co-founder & Compliance Lead, Trusty · 20+ years anti-fraud & compliance · ACFE Swiss Chapter Board
A whistleblowing procedure, often called a whistleblowing protocol, defines how your company receives, assesses, investigates and closes reports. Directive (EU) 2019/1937 sets the minimum steps and deadlines in Article 9. This guide walks through each step and shows what your procedure document should contain.
What must a whistleblowing procedure include?
Article 9 of the EU Whistleblowing Directive lists the minimum content of internal procedures:
- secure channels that protect the identity of the reporting person and of third parties;
- acknowledgment of receipt within seven days;
- an impartial person or department that follows up and stays in contact with the reporting person;
- diligent follow-up, including of anonymous reports where national law provides for it;
- feedback within a reasonable timeframe of no more than three months;
- clear information on how to report externally to competent authorities.
Step 1: receive the report
The channel must accept reports in writing, orally or both (Article 9(2)). Oral reporting works by telephone or voice messaging. On request, the reporting person can also meet the case handler in person within a reasonable timeframe. Only authorized staff may access the reports (Article 9(1)(a)).
Step 2: acknowledge receipt within seven days
Confirm receipt to the reporting person within seven days (Article 9(1)(b)). A digital channel can send this confirmation automatically, even to anonymous reporters, through a secure mailbox.
Step 3: assess the report
The case handler checks whether the report is plausible and falls within the scope of the directive or national law. Follow-up means any action to assess the accuracy of the allegations and, where relevant, to address the breach (Article 5(12)). Interpersonal grievances that affect only the reporting person may be channelled to other procedures where national law allows (recital 22).
Step 4: investigate
An impartial person or department follows up diligently (Article 9(1)(c) and (d)). This may be an internal enquiry or an investigation by an external specialist. During the investigation:
- keep the identity of the reporting person confidential (Article 16);
- respect the rights of the person concerned, including the presumption of innocence and the right to be heard (Article 22);
- ask the reporting person for further information where necessary;
- document every step and decision.
Our article on managers’ duties in whistleblowing investigations explains the limits of internal investigations.
Step 5: give feedback within three months
Tell the reporting person what action is planned or has been taken, and why. Feedback is due within no more than three months from the acknowledgment of receipt (Article 9(1)(f)). If no acknowledgment was sent, the three months run from the end of the seven-day period after the report.
Step 6: close the case and keep records
Keep a record of every report in line with the confidentiality rules (Article 18(1)). Reports must be stored no longer than necessary and proportionate. Oral reports on a recorded line may be documented, with the reporting person’s consent, by a recording or a transcript (Article 18(2)). The reporting person can check, correct and sign the transcript.
Retention periods are set nationally, for example:
- Germany: documentation is deleted three years after the procedure ends (Section 11(5) HinSchG).
- Italy: no longer than five years from the final outcome (Article 14 of Legislative Decree No. 24/2023).
- Portugal: records are kept for at least five years (Article 20 of Law No. 93/2021).
- Spain: data must be deleted after three months if no investigation was started, unless kept as evidence of how the system works (Article 32 of Law 2/2023).
What should the procedure document contain?
Write the whistleblowing procedure down as an internal policy. It should cover the scope, the available channels, the responsible persons, the deadlines, confidentiality, data protection, protection against retaliation and the external reporting options. A whistleblowing policy template helps you start. The whistleblowing channel guide explains the legal requirements behind each element.
Common mistakes in a whistleblowing procedure
Many problems arise not from bad intentions but from weak processes. Avoid these mistakes in your whistleblowing procedure:
- Missed deadlines: no acknowledgment within seven days or no feedback within three months.
- Identity leaks: forwarding a report by email to people who do not need to know who sent it.
- Conflicts of interest: a case handler who reports to the person accused.
- No documentation: decisions that cannot be traced later, which weakens your position under the reversed burden of proof (Article 21(5)).
- No contact with anonymous reporters: without a two-way channel, follow-up questions are impossible.
- Ignoring the person concerned: failing to respect their right to be heard (Article 22).
A digital channel with deadline reminders, role-based access and a case log prevents most of these errors.
Who should be involved in the procedure?
Define the roles before the first report arrives. The case handler receives and follows up on reports. Management decides on measures, without access to the reporting person’s identity unless that person consents (Article 16). The DPO advises on data protection, and legal counsel supports complex investigations. An external provider can take over intake and first assessment.
Review your whistleblowing procedure at least once a year. Check whether deadlines were met, whether reporting persons received feedback and whether the channel is still easy to find. Update the procedure when national law changes.
Conclusion
A whistleblowing procedure turns the legal requirements into clear steps: receive, acknowledge within seven days, assess, investigate, give feedback within three months and keep records. With whistleblowing software from Trusty, your organization runs a secure, confidential channel without an IT project, from 49 EUR per month.
Related reading: Whistleblower protection under EU law and Whistleblowing investigations: managers’ duties and limits.
Frequently asked questions
It is the internal process for receiving, assessing, investigating and closing reports. Article 9 of Directive (EU) 2019/1937 sets its minimum content and deadlines.
Acknowledgment of receipt within seven days and feedback within no more than three months from the acknowledgment (Article 9(1)(b) and (f)).
An impartial person or department that is competent to follow up, which may be internal or a third party (Articles 8(5) and 9(1)(c)).
No longer than necessary and proportionate (Article 18). National laws set the details: three years after closure in Germany, up to five years in Italy and at least five years in Portugal.
FROM 49 EUR PER MONTH
Trusty Whistleblowing: a reporting channel compliant with the EU Whistleblower Directive, live in minutes with no IT project. From 49 EUR per month, 7-day free trial.