Governance
EU Whistleblower Protection Directive
Published Reviewed
What is Whistleblower Directive?
The EU Whistleblower Directive sets minimum standards for confidential reporting channels, independent follow-up and protection against retaliation for people reporting specified breaches.
| Jurisdiction | European Union |
|---|---|
| Authority | Directive (EU) 2019/1937 |
| Current status | Implemented through national law; verify each jurisdiction |
| Reviewed |
Why it matters operationally
Every EU employer with 50 or more workers must operate an internal reporting channel — confidential, staffed by impartial handlers, with acknowledgement and feedback on fixed clocks. The directive’s sharpest edge is the reversed burden of proof: once a reporter shows they reported and suffered detriment, the employer must prove the detriment was unrelated. A channel that exists on paper but responds late, leaks identity, or leads nowhere converts easily into a retaliation case — and reporters who get no response are entitled to go external.
Are you aware?
The dates that bind
Acknowledge the report
Receipt of a report must be acknowledged within seven days — which presumes someone is actually monitoring the channel, including through holidays.
Feedback is a deadline, not a courtesy
The reporter must receive feedback on follow-up within three months. Miss it, and escalation to the external authority channel — or the press, under conditions — becomes protected disclosure.
The 50-employee tier is fully in force
The final phase-in ended in December 2023: private employers from 50 workers up are covered everywhere in the EU, with national laws sometimes stricter on scope and anonymity.
Where to start
- 1
Stand up the channel with genuinely impartial handlers and a confidentiality model that survives small-company realities.
- 2
Wire the two clocks — 7-day acknowledgement, 3-month feedback — into the process with an owner and coverage plan.
- 3
Train managers on the anti-retaliation rules: most retaliation findings start with an ordinary manager’s ordinary reaction.
Authority links
Read the official sources
The official text is the authority. This guide is only a short orientation for operational planning.
Common questions
Frequently asked questions
Do we have to accept anonymous reports?
The directive leaves anonymity to member states, so it varies by country — but where an anonymous report arrives, protection applies if the reporter is later identified. Several national laws do require handling anonymous reports; check each jurisdiction you operate in.
What does the reversed burden of proof mean in practice?
In retaliation proceedings, the employer must prove that a dismissal, demotion or other detriment was based on duly justified grounds unrelated to the report. Documentation discipline around any adverse decision affecting a known reporter becomes essential.
Can group companies share one channel?
Only partially. Companies with 50–249 workers may share resources for receiving reports and investigations, but larger entities are generally expected to maintain their own channels — central-only models have been rejected by the Commission’s reading of the directive.
Side by side
Compared against
Key terms in this guide
A quick self-check
Are you ready?
- If a report arrived tonight, would the 7-day acknowledgement clock be met — and could you prove it?
- Do your handlers have a documented impartiality and confidentiality arrangement?
- Could you show that the last adverse HR decision near a known reporter was justified on unrelated grounds?
Every question above has a written, evidence-backed answer in a well-run compliance record. If one made you pause, that pause is the gap.