Whistleblowing: How to Set Up a Compliant Reporting Platform
EU Directive 2019/1937 on the protection of persons who report breaches of Union law, transposed into national law across EU member states, requires organisations above the employee threshold to set up an internal reporting channel that is secure, confidential, and accessible to employees and authorised external persons. In France, the Sapin II law of 2016 introduced the first national framework; Law 2022-401 of 21 March 2022 transposed the Directive and extended the scope of protected reports. In Germany, the Hinweisgeberschutzgesetz of June 2023 transposed the Directive. Organisations that operate in multiple EU jurisdictions must verify the national transposition in each country, as member states were permitted to extend protections beyond the Directive's minimum. The core obligations are consistent: a dedicated channel, guaranteed confidentiality, a defined response deadline, and protection against retaliation. An anti-bribery programme that requires an internal reporting channel and a whistleblowing obligation under the Directive both require the same underlying infrastructure; a single platform can serve both purposes when it is designed correctly.
Who Is in Scope and What Reports Must Be Covered
Article 8(3) of Directive 2019/1937 requires organisations with at least fifty workers to set up an internal reporting channel. Member states may lower this threshold. The Directive covers reports of breaches of a defined list of EU legal acts in areas including public procurement, financial services, anti-money laundering, product safety, transport safety, environmental protection, food safety, public health, consumer protection, and protection of privacy and personal data. National transpositions may extend the scope to additional areas. A report is protected when the reporting person had reasonable grounds to believe that the information was true at the time of reporting; malicious or knowingly false reports are excluded from protection. Each organisation must communicate clearly which categories of report the channel accepts.
Confidentiality and Reporter Protection: Technical and Organisational Requirements
Article 16 of Directive 2019/1937 requires that the identity of the reporting person be protected and not be disclosed without their explicit consent. The channel must be designed so that the handler of the report is the only person with access to the identity of the reporter. Article 19 prohibits any form of retaliation, including dismissal, demotion, transfer, non-renewal of contract, and disciplinary measures. The burden of proof is reversed: an employer who takes an adverse measure against a person who has reported must demonstrate that the measure is not linked to the report (Article 21(5) of the Directive). Technical requirements therefore include encrypted communications, access controls limiting identity disclosure to named handlers, and an audit trail of all actions taken on the file.
Response Deadlines and Audit Trail: What the Law Requires
Article 9 of Directive 2019/1937 requires the internal reporting channel to provide acknowledgement of receipt within seven days and feedback on the follow-up within a reasonable period, not exceeding three months from acknowledgement. The feedback obligation requires informing the reporter of the action taken or planned. Each step must be logged with a date and a named actor, so that the organisation can demonstrate compliance with the deadlines if challenged. The log constitutes the audit trail that an inspection by a competent authority would require. A reporting channel that processes reports by email without a structured case management system cannot produce this evidence reliably. The processing of the reporter's personal data governed by GDPR must also be documented, as the channel processes sensitive information about identifiable individuals.
How a Reporting Platform Covers Requirements Without Exposing the Reporter's Identity
A compliant reporting platform separates three layers: the submission layer, accessible to reporters without mandatory identification; the case management layer, accessible only to named handlers; and the audit trail layer, which logs every action on the file without exposing the reporter's identity to persons outside the authorised handler group. The platform must also allow anonymous reporting, as Article 6(2) of the Directive requires member states to encourage organisations to accept anonymous reports. Optivalue.ai provides each of these layers, assigns each incoming report to a named handler, tracks the seven-day acknowledgement and three-month feedback deadlines automatically, and produces an exportable case log for supervisory inspections. The platform also supports the communication obligations: reminders to declarants, template responses, and the archiving of closed cases with their full audit trail.
Book a demonstration with Optivalue.ai
FAQ
Which organisations must set up an internal reporting channel under EU Directive 2019/1937?
Article 8(3) of Directive 2019/1937 requires organisations with at least fifty workers to set up an internal reporting channel. Member states may lower this threshold in national transposition. Public sector bodies are generally required to set up channels regardless of size, with limited exceptions for municipalities below a certain population threshold. Organisations with between fifty and two hundred and forty-nine workers may share a reporting channel under Article 8(6). Organisations above two hundred and forty-nine workers must maintain a dedicated channel.
Can a reporting channel be managed by an external provider?
Yes. Article 8(5) of Directive 2019/1937 permits organisations to authorise an external third party to receive reports on their behalf, provided that the third party offers the same guarantees of confidentiality, completeness, integrity and confidentiality as the internal channel. The organisation remains responsible for ensuring that the external provider meets the requirements of the Directive. An external provider who receives reports must transfer them to the authorised internal handler without delay and must not disclose the identity of the reporter.
What categories of reports does Directive 2019/1937 protect?
The Directive covers reports of breaches of EU law in a defined list of areas set out in Part I of the Annex, including public procurement, financial services and markets, anti-money laundering, product safety, transport safety, environmental protection, food safety and animal welfare, public health, consumer protection, and protection of privacy and personal data. Member states may extend protection to additional areas. The list is exhaustive at EU level; reports outside the listed areas may be protected by national law but fall outside the Directive's minimum standard.
What protection does the Directive give to anonymous reporters?
Article 6(2) of Directive 2019/1937 requires member states to encourage organisations to accept anonymous reports. An anonymous reporter who is subsequently identified is entitled to the same protections against retaliation as an identified reporter, provided the conditions of Article 6(1) are met. The organisation must therefore design its channel to accept anonymous submissions and its case management process to handle them without requiring identification. Anonymous reports also present a challenge for feedback obligations, as the reporter cannot be contacted unless they have provided a means of communication.
How long must closed whistleblowing cases be retained?
Directive 2019/1937 does not specify a retention period for closed cases. Retention must comply with the data minimisation principle of Regulation (EU) 2016/679 (GDPR), which requires that personal data not be kept longer than necessary for the purpose for which it was collected. In practice, organisations retain closed case records for a period sufficient to defend against a retaliation claim; this depends on national employment law limitation periods, which vary by member state. The retention period must be documented in the organisation's record of processing activities under Article 30 of the GDPR.
Back to top
On the same topic