Dejan Jasnic · Co-founder & Compliance Lead, Trusty · 20+ years anti-fraud & compliance · ACFE Swiss Chapter Board
A whistleblowing policy that meets EU law must cover ten elements: who can report, what can be reported, how to report, who handles reports, confidentiality, the deadlines, protection from retaliation, external reporting, data protection and record keeping. The template below gives you wording for each one.
Copy it, replace the text in square brackets and adapt it to each country where you employ 50 or more workers.
A whistleblowing policy is a written document that tells people how to report wrongdoing at work and how the organisation will handle the report and protect the person who made it. It is also called a whistleblower policy, a speak-up policy or an internal reporting procedure.
In practice, yes. Directive (EU) 2019/1937 requires employers with 50 or more workers to have procedures for internal reporting and follow-up, and to give clear, easily accessible information about them. A written policy is how you meet both duties and prove that you did.
Some national laws are more explicit. Spain’s Ley 2/2023, for example, requires a published policy and a procedure for managing reports. For an overview of the rules, see our guide to whistleblowing law in the EU.
What must a whistleblowing policy include?
A whistleblowing policy must include ten elements, each tied to an article of the EU Whistleblowing Directive. Use this table as a checklist against your current policy.
works in practice
Every promise in your policy, built into the channel. Trusty gives you written and voice reporting, a two-way anonymous inbox, role-based access and deadline tracking, plus ready-made compliance policies to start from. Your first channel is ready in less than five minutes.
Element | What the policy must say | Directive |
|---|---|---|
1. Who can report | Employees and everyone else with a work-related link, including contractors, applicants and former workers | Article 4 |
2. What can be reported | The breaches covered, with examples, and what belongs in HR channels instead | Article 2 |
3. How to report | The channels available, in writing, orally or both, and the right to ask for a meeting | Article 9(2) |
4. Who handles reports | The impartial person or team that receives and follows up on reports | Article 9(1)(c) |
5. Confidentiality | That the reporter's identity is protected and who may access a report | Article 16 |
6. Deadlines | Acknowledgement within 7 days and feedback within 3 months | Article 9(1)(b) and (f) |
7. Protection from retaliation | That retaliation is prohibited and what to do if it happens | Articles 19 and 21 |
8. External reporting | How to report to the competent national authority | Article 9(1)(g) |
9. Data protection | How personal data is processed under GDPR | Article 17 |
10. Record keeping | How reports are documented and how long they are kept | Article 18 |
Companies with 50 or more employees can set up whistleblower software from Trusty in minutes, from €49 a month.
Whistleblowing policy template
This template covers all ten elements. Replace the text in square brackets, then have it reviewed against the national law of each country where you use it.
1. Purpose
[Company name] wants to hear about wrongdoing early so that it can act. This policy explains how to report a concern, how we handle it and how we protect you.
2. Who can report
This policy applies to employees, managers, board members, shareholders, trainees, volunteers, job applicants, former workers, contractors, suppliers and their staff.
3. What you can report
You can report an actual or suspected breach of law that you learned about through your work with [Company name]. Examples include fraud, corruption, money laundering, competition law breaches, health and safety risks, environmental harm, data protection breaches, product safety issues and breaches of the EU AI Act.
Personal employment grievances should go to [HR contact], unless they also involve a breach of law.
4. How to report
You can report in writing or by voice message at [reporting channel URL]. You can also ask for a meeting in person with [role or team], which we will arrange within [number] days.
You may report anonymously. If you do, keep the access code you receive so that we can ask questions and give you feedback.
5. Who handles your report
Reports are received and followed up by [role or team], who act independently and are trained to handle them. If your report concerns that person or team, it goes to [alternative role].
6. Confidentiality
Your identity, and any information that could reveal it, is shared only with the people authorised to handle your report. We will not disclose it to anyone else without your explicit consent, unless the law requires it.
7. What happens after you report
We confirm receipt within 7 days. We assess the report, investigate where needed and tell you what action we have taken or plan to take within 3 months of that confirmation.
8. Protection from retaliation
[Company name] prohibits any retaliation, threat or attempt at retaliation against a person who reports under this policy, or against anyone who helps them. Retaliation is a disciplinary offence. Report it through the same channel.
You are protected if you had reasonable grounds to believe the information was true when you reported it. Knowingly making a false report is not protected.
9. Reporting outside the company
We encourage you to report internally first, but you may report directly to the competent authority: [name and contact details of the national authority]. You may also report to the relevant EU body where applicable.
10. Data protection and records
We process personal data in line with the GDPR and [national data protection law]. We record every report and keep it for [retention period], or longer where the law or ongoing proceedings require it. Data that is clearly not relevant is deleted without delay.
11. Policy owner and review
This policy is owned by [role]. It was approved on [date] and is reviewed at least once a year.
every entity
One platform, a separate reporting channel for each legal entity. Trusty keeps each subsidiary’s reports, case handlers and access rights apart, offers the reporting form in several languages and hosts all data in ISO/IEC 27001 certified data centres in Germany.
How do you adapt a whistleblowing policy for each EU country?
You adapt a whistleblowing policy by changing four things per country: the scope, the anonymity rule, the external authority and the retention period. National law may also require you to consult employee representatives before the policy takes effect.
Country | What to change in the template |
|---|---|
Germany (HinSchG) | Widen the scope to criminal offences and certain administrative offences. Name the Federal Office of Justice as the external reporting office. Delete records three years after the case closes. Involve the works council. |
Spain (Ley 2/2023) | State that anonymous reports are accepted. Name the person responsible for the system and the Independent Whistleblower Protection Authority (AIPI). Publish the policy. Keep records for no more than ten years. |
France (Sapin II and Decree 2022-1284) | Widen the scope to crimes, offences and threats to the general interest. Consult the social and economic committee (CSE). Acknowledge receipt within seven working days. Name the Défenseur des droits. |
Italy (Legislative Decree 24/2023) | Name ANAC as the external channel. Consult trade union representatives. Keep records for no more than five years after the outcome is communicated. Align with your Model 231 if you have one. |
A group can keep one core policy and add a short country annex for each of these points. Translate the policy into the language of each workforce. Our guide to whistleblowing for multi-country employers covers group set-ups in more detail.
What are the most common mistakes in a whistleblowing policy?
The most common mistake is a policy that describes a process the organisation cannot actually deliver. Six errors come up again and again:
• Covering only employees. The law also protects contractors, suppliers, applicants and former workers.
• Requiring internal reporting first. A whistleblower may go straight to the authority, and the policy must say how.
• Demanding “good faith”. The legal test is reasonable grounds to believe the information is true, not the reporter’s motive.
• Leaving out the deadlines. The seven-day acknowledgement and three-month feedback belong in the policy.
• Naming an email address as the channel. A shared mailbox is hard to keep confidential and leaves no clean case record. See whistleblowing software vs. email vs. hotline.
• Publishing and forgetting. A policy nobody has read protects nobody, so train staff and review it yearly.
A policy is only half of compliance. The channel behind it has to keep the promises the policy makes.
How do you put a whistleblowing policy into practice?
You put a whistleblowing policy into practice by pairing it with a reporting channel that enforces what the policy promises. Trusty is whistleblowing software built around the EU Whistleblowing Directive, and an internal channel is ready in less than five minutes.
What your policy promises | How Trusty delivers it |
|---|---|
Reports in writing or by voice | Online form plus in-browser voice messages with voice disguising |
Anonymous reporting with feedback | Two-way anonymous inbox opened with an access code |
Access only for authorised handlers | Role-based access, separate for each legal entity |
7-day and 3-month deadlines | Case dashboard that shows each report and its status |
A reliable record | Qualified eIDAS timestamp on each report and a tamper-proof audit log |
GDPR-compliant processing | Hosting in ISO/IEC 27001 certified data centres in Germany |
Trusty also includes ready-made compliance policies and employee training, so you do not have to start from a blank page.
Frequently asked questions about whistleblowing policies
A whistleblowing policy is a written document that explains how to report wrongdoing at work, how the organisation handles reports and how it protects the person who reports.
Private companies with 50 or more workers and public sector bodies in the EU need internal reporting procedures and must give clear information about them. A written whistleblowing policy is the standard way to do both.
It should include who can report, what can be reported, how to report, who handles reports, confidentiality, the 7-day and 3-month deadlines, protection from retaliation, external reporting, data protection and record keeping.
Two to four pages is enough. A reader should be able to find out how to report, and what happens next, in under a minute.
It depends on the country. EU law leaves the decision to member states, and Spain requires employers to accept anonymous reports. Allowing them everywhere is the simplest approach for a group.
Yes. A group can use one core policy with a short annex for each country that sets out the local scope, authority, anonymity rule and retention period.
Review it at least once a year, and whenever the law changes. The 2026 extension to EU AI Act reports is one such change.
Sources
• Directive (EU) 2019/1937, EUR-Lex
• Article 87: Reporting of Infringements and Protection of Reporting Persons, EU Artificial Intelligence Act
• Trusty, product information
This template and article are general information, not legal advice. Have your final policy reviewed by local counsel.
with EU Directive & GDPR
Whistleblowing software made simple, built by compliance experts.