Guide

The EU Whistleblowing Directive, in plain words.

What Directive (EU) 2019/1937 asks of a company with 50 or more staff, and what "having a channel" actually means.

This is a plain-language guide, not legal advice. The Directive is implemented through national law in each member state, and the details differ. Check your country's act, or ask your adviser.

Who it applies toWhat the channel must doThe deadlinesProtecting the reporterNational differencesA short checklist

Who it applies to

The Directive requires internal reporting channels at private-sector legal entities with 50 or more workers, and at public-sector bodies. Member states could give companies with 50 to 249 workers until 17 December 2023 to comply; larger companies had to comply from 17 December 2021. Both dates have passed, so if you have 50 or more staff and no channel, you are late rather than early.

Some sectors, such as financial services, are covered regardless of size under other EU rules. Some member states have lowered the threshold or extended the scope further. The 50-worker count includes part-time and temporary workers in most national implementations, so count heads, not full-time equivalents, unless your national act says otherwise.

What the channel must do

The Directive is specific about the shape of an internal channel. It must:

• Accept reports in writing or orally, or both. Oral reporting means by phone or another voice messaging system, and, if the reporter asks, a meeting in person within a reasonable time.
• Protect the confidentiality of the reporter's identity and of anyone mentioned in the report, and stop anyone who isn't authorised from getting at it.
• Acknowledge receipt within seven days.
• Designate an impartial person or department to follow up on reports, keep in contact with the reporter, ask for more information if needed, and give feedback.
• Follow up diligently, including on anonymous reports where national law requires it.
• Give feedback within a reasonable time, at most three months after the acknowledgement.
• Provide clear information about how to report, both internally and to the national external authority.
• Keep records of every report, for no longer than necessary and proportionate.

Companies with 50 to 249 workers may share resources for receiving reports and carrying out investigations, as long as each company still meets its own obligations.

The deadlines

"Feedback" means telling the reporter what action is envisaged or has been taken, and why. It doesn't have to be the final outcome, but it does have to be substantive.

Protecting the reporter

The Directive prohibits retaliation in any form against people who report in good faith: dismissal, demotion, blacklisting, harassment and so on. The reporter's identity may not be disclosed without their explicit consent, except where required by law in the context of investigations or court proceedings. Anonymous reporting isn't mandatory across the EU, but where anonymous reporters are later identified, they get the same protection.

In practice this is why a shared mailbox or a form that collects email addresses by default is a weak channel. If the only way to follow up with a reporter is to know who they are, most reporters won't follow up, and some won't report.

National differences

Each member state turned the Directive into its own act, and several went further. Germany's Hinweisgeberschutzgesetz, Spain's Ley 2/2023 and France's Sapin II regime as amended in 2022 each add their own detail on scope, record-keeping and sanctions. Some countries fine companies that have no channel at all. Where the Directive says "may", your national act may say "must". When in doubt, the national act wins.

A short checklist

1. Confirm you're in scope: 50 or more workers, counted as your national act counts them.
2. Pick a channel that takes written and voice reports and keeps the reporter's identity confidential.
3. Name the impartial person or team who handles reports, and make sure they're the only ones with access.
4. Write down the procedure and tell staff how to report, internally and externally.
5. Acknowledge within 7 days; give feedback within 3 months; keep a record of each report.
6. Make sure nobody who reports can be retaliated against for it, and that your managers know that.

Voxlibre covers steps 2, 3 and 5. The rest is policy, and is yours.