The EU Whistleblower Directive, explained for employers
Who has to run an internal reporting channel, what the channel has to do, the two deadlines that matter most, and how anonymity is left to each country. Part of our guide to anonymous reporting software.
Hari SContent MarketerBuilds narratives on employee engagement, and on the channels people use when a survey is not enough.The EU Whistleblower Directive in one paragraph
Directive (EU) 2019/1937 protects people who report breaches of EU law they come across through their work. For employers, it does two things. It requires every organisation with 50 or more workers to run an internal channel for those reports, with set deadlines for responding. And it protects the people who use that channel, and several other routes, from retaliation.
It was adopted in October 2019. EU countries had until 17 December 2021 to write it into national law, and employers with 50 to 249 workers had until 17 December 2023 to set up their channels. Every EU country has now passed its own law, and several go further than the Directive, so the national law is always the one to check.
Which employers must run an internal reporting channel
- Private employers with 50 or more workers (Article 8(3)).
- Financial services firms of any size, where EU financial services or anti-money-laundering rules apply to them (Article 8(4)).
- Public sector bodies, though countries may exempt municipalities with fewer than 10,000 inhabitants or fewer than 50 workers (Article 8(9)).
Employers with 50 to 249 workers may share resources for receiving and investigating reports (Article 8(6)), so several smaller employers can run one channel between them. Each stays responsible for confidentiality, feedback and follow-up.
The Directive sets a floor, not a ceiling. Countries may extend the duty to smaller employers, so a company under 50 workers can still be caught by national law.
What the internal channel has to do
Article 9 sets out the procedure. It is short, and every line of it matters in an audit.
- Day 0Report received
- Within 7 daysAcknowledge receipt to the reporter
- Within 3 monthsGive feedback: what was done, and why
- Keep the reporter's identity confidential, and keep unauthorised staff out of the channel entirely.
- Acknowledge receipt within 7 days.
- Name an impartial person or team to follow up, which can be the same people who receive reports.
- Follow up diligently, including on anonymous reports where national law provides for them.
- Give feedback within 3 months: what action was taken or is planned, and why.
- Explain the external route: clear information on how to report to the relevant authorities instead.
Reports must be possible in writing, orally, or both (Article 9(2)). Where oral reporting is offered, it can be by phone or another voice system, and a reporter can ask for a meeting in person. A written-only channel meets the Directive; some national laws expect an oral option too.
Who is protected, and against what
The Directive protects more people than employees. Article 4 covers workers and civil servants, the self-employed, shareholders and board members, volunteers and trainees, and people working for contractors and suppliers. It also covers former workers, job applicants, and the colleagues or relatives who help someone report.
Retaliation is banned in any form, and Article 19 lists examples: dismissal or suspension, demotion or a withheld promotion, a cut in pay or a change of duties, a negative performance review, being denied training, intimidation, harassment or exclusion.
The most important protection is procedural. If a reporter suffers a detriment and brings a claim, the employer has to prove it was not retaliation (Article 21(5)). The burden of proof sits with the organisation, not the person who spoke up.
What can be reported under the Directive
Article 2 limits the Directive to breaches of EU law in listed areas:
- Public procurement, financial services and anti-money laundering
- Product safety, transport safety and nuclear safety
- Environmental protection, food and feed safety, and animal health
- Public health and consumer protection
- Privacy, personal data, and the security of networks and information systems
- Competition, state aid, tax avoidance and the EU's financial interests
Workplace issues such as harassment or discrimination are not on that list. Many countries widened the scope to cover breaches of national law too, and most employers run one channel for every kind of concern anyway, rather than asking a reporter to work out which law applies first.
Does the Directive require anonymous reporting?
No. Article 6(2) leaves it to each country to decide whether employers must accept and follow up anonymous reports, so the answer differs across the EU. What the Directive does guarantee is that someone who reported anonymously, and is later identified and retaliated against, is protected like anyone else (Article 6(3)).
In practice, accepting anonymous reports is the safer design. Most reports in benchmark data arrive anonymously, and a channel that turns them away loses most of what it would hear. What an anonymous channel should and should not store is covered in our piece on how anonymous it really is.
Confidentiality, data protection and record keeping
- Confidentiality (Article 16): the reporter's identity, and anything that could reveal it, goes no further than the staff authorised to handle the report, unless the reporter explicitly agrees.
- Data protection (Article 17): personal data in reports is processed under the GDPR, and data that is clearly not relevant should not be collected, or should be deleted without undue delay if it is.
- Records (Article 18): every report must be recorded, and kept no longer than necessary and proportionate.
Penalties and enforcement
Article 23 requires countries to set effective, proportionate and dissuasive penalties for anyone who hinders reporting, retaliates, brings vexatious proceedings against a reporter, or breaches confidentiality. The amounts are set nationally and vary widely.
Enforcement has been real at the country level too. In March 2025 the Court of Justice of the EU fined five member states for transposing the Directive late: Germany 34 million euro, Czechia 2.3 million, Hungary 1.75 million, Estonia 500,000 and Luxembourg 375,000, following a 2024 judgment against Poland.
What this means when you choose a reporting channel
The Directive does not require software. It requires a channel that does certain things reliably, and the deadlines are where manual processes slip first. When comparing options, check that the channel:
- Takes reports in writing, and anonymously if your country or your policy expects it
- Starts the 7-day and 3-month clocks on every report, and flags when either slips
- Limits access to named handlers, so confidentiality does not depend on goodwill
- Lets you reply to an anonymous reporter without learning who they are
- Keeps a dated record of every report and every step
No software makes an organisation compliant on its own; policy, communication and national law all play a part. What software can do is make the procedure hard to get wrong. Our page on whistleblowing software maps each of these requirements to how CultureMonkey's Speak Up handles it.
See the 7-day and 3-month clocks on a live case
Speak Up starts both deadlines the moment a report arrives, flags them when they slip, and keeps the report with only the people you name.
The Whistleblower Directive, answered
What is the EU Whistleblower Directive?
Directive (EU) 2019/1937, adopted in October 2019, protects people who report breaches of EU law they learn about through their work. It requires employers with 50 or more workers to run an internal reporting channel with set deadlines, and it protects reporters from retaliation. Each EU country has written it into its own national law.
Which companies does the EU Whistleblower Directive apply to?
Private employers with 50 or more workers, financial services firms covered by EU financial services or anti-money-laundering rules regardless of size, and public sector bodies, though countries may exempt small municipalities. Some countries apply lower thresholds, so check the national law where you employ people.
What are the deadlines under the Whistleblower Directive?
For internal reports: acknowledge receipt within 7 days, and give feedback within 3 months. The 3 months run from the acknowledgement or, if none was sent, from the end of the 7 days after the report was made.
Does the Directive require companies to accept anonymous reports?
No. It leaves that decision to each country, so the rule differs across the EU. It does protect anonymous reporters who are later identified and retaliated against. Most organisations accept anonymous reports anyway, because a large share of reports arrive that way.
Does a whistleblowing channel have to include a phone line?
Not under the Directive, which allows reports in writing, orally, or both. If oral reporting is offered, it can be by phone or another voice system, with an in-person meeting on request. Some national laws or policies expect an oral option, so check yours.
When did the EU Whistleblower Directive come into force?
Countries had to transpose it by 17 December 2021. Employers with 250 or more workers had to comply from then, and those with 50 to 249 workers from 17 December 2023.
Does the Directive cover harassment and discrimination reports?
Not directly: it covers breaches of EU law in listed areas such as financial services, product safety, the environment, data protection and competition. Many countries widened the scope to national law, and most employers run one channel for every kind of concern rather than splitting them.