The EU Whistleblowing Directive: what employers must set up

What the directive does

Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law was adopted on 23 October 2019 and entered into force on 16 December 2019. Member states had until 17 December 2021 to put it into national law, and until 17 December 2023 for the duty of private employers with 50 to 249 workers to set up internal channels.

The directive does two things. It requires organisations to offer safe ways to report wrongdoing, and it protects the people who report against retaliation. It sets minimum standards, so national laws can protect more people or cover more kinds of wrongdoing.

A reporter can use three routes: internally, to their own organisation; externally, to a competent authority; or, under strict conditions, publicly. Member states must encourage internal reporting first where the breach can be dealt with internally and the reporter sees no risk of retaliation.

Which breaches are covered

The directive covers reports about breaches of EU law in these areas:

• public procurement
• financial services, products and markets, and the prevention of money laundering and terrorist financing
• product safety and compliance
• transport safety
• protection of the environment
• radiation protection and nuclear safety
• food and feed safety, animal health and welfare
• public health
• consumer protection
• privacy and personal data, and the security of network and information systems
• the financial interests of the EU, and the internal market, including competition, State aid and corporate tax rules

According to the European Commission's 2024 report on the directive, a large majority of member states extended protection beyond the directive, and roughly half added areas of national law such as corruption or criminal offences. Check what your country's law covers.

Who is protected

Protection covers people who learn about breaches through their work, in the private or the public sector. That includes at least:

• employees, including civil servants
• self-employed people
• shareholders, members of management and supervisory bodies, volunteers and paid or unpaid trainees
• people who work for contractors, subcontractors and suppliers
• former employees, and job applicants who learned of a breach during recruitment

Protection also extends to people who help the reporter, to colleagues and relatives who could suffer retaliation, and to companies the reporter owns or works for. To qualify, a reporter must have had reasonable grounds to believe that the information was true and fell within the directive's scope when they reported it. A person who reported anonymously and is later identified keeps the same protection.

Who must set up an internal channel

• Private sector: every employer with 50 or more workers.
• Some regulated sectors, such as financial services and the prevention of money laundering: every employer covered by the relevant EU rules, whatever its size.
• Public sector: every public body, including the entities it owns or controls. Member states may exempt municipalities with fewer than 10,000 inhabitants or fewer than 50 workers, and other public bodies with fewer than 50 workers.
• Smaller private employers: only where national law requires it after a risk assessment, for example because of risks to the environment or public health.

Private employers with 50 to 249 workers may share resources for receiving reports and investigating them, but each keeps its own duties of confidentiality, feedback and follow-up. The channel can be run by a designated person or department inside the organisation, or by an outside provider that meets the same requirements.

What the internal channel must do

Internal reporting procedures must include:

1. a secure channel that protects the identity of the reporter and of anyone named in the report, with no access for unauthorised staff
2. an acknowledgement of receipt to the reporter within seven days
3. an impartial person or department that follows up the reports, keeps in touch with the reporter and asks for more information when needed
4. diligent follow-up, including of anonymous reports where national law requires it
5. feedback to the reporter within a reasonable time, at the latest three months after the acknowledgement, or three months after the seven days ran out if no acknowledgement was sent
6. clear, easy-to-find information on how to report externally to the competent authorities

The channel must accept reports in writing, orally or both. Where a channel takes oral reports, they must be possible by telephone or another voice messaging system. The directive also provides for a meeting in person, within a reasonable time, when the reporter asks for one, and national laws differ on whether every channel must offer it, so check yours.

The timeline of a report

• Day 0: the report arrives through the channel.
• By day 7: the reporter receives an acknowledgement of receipt.
• Within three months of the acknowledgement: the reporter learns what has been done or is planned, and why.
• Throughout: the report is recorded, access is limited and the reporter's identity stays protected.

Anonymous reports

The directive leaves it to each member state to decide whether organisations must accept and follow up anonymous reports. According to the Commission's 2024 report, around half of the national laws regulate anonymous reports, and most of those require them to be accepted and followed up, by the competent authorities or by every organisation with a channel. Where they must be accepted, they are handled like any other report.

Accepting anonymous reports only helps if the reporter can stay in contact without revealing who they are. Plan how you will acknowledge an anonymous report, ask follow-up questions and give feedback.

Confidentiality, data protection and records

The reporter's identity must not be disclosed beyond the staff authorised to receive or follow up reports without the reporter's explicit consent. The same applies to any information from which their identity could be worked out. Exceptions are allowed only where EU or national law requires it, for example in an investigation or court case, and the reporter must normally be told first.

Personal data is processed under the GDPR, and data that is clearly not relevant to a report must not be collected or must be deleted without delay. Every report must be recorded and kept no longer than necessary and proportionate. Oral reports and meetings can be documented with a recording or accurate minutes, with the reporter's consent and a chance for them to check, correct and sign.

Protection against retaliation

Any form of retaliation is prohibited, including threats and attempts. The directive gives examples:

• dismissal, suspension, demotion or a withheld promotion
• changes to duties, place of work, pay or working hours, and withheld training
• negative performance reviews or references, and disciplinary measures
• coercion, intimidation, harassment, ostracism and discrimination
• not converting or renewing a temporary contract, or ending it early
• harm to reputation, including on social media, financial loss and blacklisting in a sector
• cancelled contracts for goods or services, cancelled licences or permits, and psychiatric or medical referrals

If a reporter suffers a detriment and shows that they reported, the detriment is presumed to be retaliation, and the employer must prove that it had other, duly justified grounds. Agreements and policies cannot take these rights away. Member states set penalties for anyone who hinders reporting, retaliates, brings vexatious proceedings or breaks confidentiality, and for reporters who knowingly report false information.

Where national laws stand

Transposition was slow. By the deadline of 17 December 2021, only three member states had fully transposed the directive; eight followed in 2022 and thirteen in 2023, according to the Commission's 2024 report. The same report found that all member states had transposed the main provisions, but that key areas still needed work, such as the scope, the conditions for protection and the protection against retaliation, including the penalties.

National laws differ in the details: whether anonymous reports must be accepted, which areas of national law are covered, how oral reporting must work and which authority receives external reports. Follow the rules of the country where each of your companies is based.

Outside the EU: North Macedonia and the region

The directive does not apply directly outside the EU, but many countries have whistleblower laws of their own. North Macedonia adopted its Law on Whistleblower Protection in 2015. According to an overview by the law firm CMS, companies with ten or more employees must adopt internal rules for reports and appoint a person to receive them.

A new law to align North Macedonia with the directive has been drafted. The European Commission's 2026 Rule of Law Report says the draft completed consultation within the government in March 2026, with no clear timetable for adoption by Parliament. Other countries in the region have their own rules too, so check them for each company, and remember that subsidiaries in EU countries follow the law of their member state.

A checklist for setting up your channel

1. Count the workers of each company and check the thresholds in its national law.
2. Name an impartial person or department to handle reports, with a deputy, and train them on confidentiality.
3. Decide how people can report, in writing, by phone or in a meeting, and whether you must accept anonymous reports.
4. Publish clear instructions for reporting internally and for reporting to the competent authorities.
5. Set up a routine that acknowledges every report within seven days and gives feedback within three months.
6. Limit access to reports, protect identities and keep a record of every step.
7. Set a retention period for closed reports that fits the directive and your national law.
8. Tell managers that retaliation is prohibited, and review the procedure regularly.

How Office Hero can help

HR Hero, the HR app of Office Hero, includes a whistleblowing channel built around the directive. It gives you a public reporting page on Office Hero Connect that needs no account, an internal form for staff, a case inbox for your designated handlers and a reminder to the handlers assigned to a report when it passes seven days without an acknowledgement. Report contents are encrypted, and each case has a hash-chained log.

Know its limits too: reports are made in writing, with no phone line or voice recording, reporters cannot attach files, nobody is told when a new report arrives, and the three-month feedback deadline is watched through the inbox's age filter rather than a reminder. The whistleblowing channel page explains how it works.