Upstract Image1

Related Practice Areas

Related Practice Areas

Upstract Image2

Related Industry Sectors

Related Industry Sectors


Whistleblower Directive, adopted in 2019, introduces the minimum standards for a high level protection of persons reporting breaches of Union law.

The Directive (EU) 2019/1937 on the protection of persons who report breaches of Union Law (the Whistleblower Directive or the Directive) was adopted on 23 October 2019 and Member States are required to bring into force the laws, regulations and administrative provisions necessary to comply with Whistleblower Directive by 17 December 2021.

What is Whistleblower Directive?

People working in public or private organisations are usually the first to witness the breaches of Union law. These people act as ‘whistleblowers’ when they report breaches of Union law that may be harmful to society and by whistleblowing, they potentially expose breaches and prevent wrongdoing and harm.

The purpose of the Directive is to ensure harmonized framework at national level for protection of persons reporting breaches of Union law in specific areas. Article 1 of the Directive sets out the specific areas for which the Directive is applicable such as tax fraud, money laundering, public procurement, transport safety, breaches affecting the financial interests of the Union, breaches relating to internal market.[1]

For effective detection and prevention of breaches of Union law, a three-tier reporting structure is being introduced by the Directive whereby employees can report their concerns swiftly through:

  1. Internal reporting channels: member states shall ensure that legal entities in the private and public sector establish channels and procedures for reporting and follow-up which will be directed to an internal dedicated person or department;
  1. External reporting channels: member states shall designate certain relevant national authorities or the appropriate EU institutions to receive reports; and
  1. Public reporting channels: such as going directly to the media, or a public forum such as Twitter if there is no response to the above.

According to the Directive, it is up to the relevant Member State to define how to establish the necessary whistleblower channels as long as the relevant potential whistleblowers’ identities are ensured to be kept confidential.

In order to provide such confidentiality, the Directive provides for minimum requirements to be met by companies/authorities such as the following:

  1. obligation to confirm receipt of the report to the whistleblower within seven (7) days. The whistleblower must be informed of any action taken within three (3) months, the status of the internal investigation and its outcome;
  2. obligation to appoint an impartial, competent person or department to follow up on the reports;
  3. reporting channel is designed and operated in a secure manner.

As long as the reporting person reports a breach in accordance with the Directive, the Directive prohibits Member States and employers to take any form of reprisal against whistleblowers to encourage whistleblowers to make a report. Such reprisals include suspension, termination, demotion or failed promotion, pay reduction, change in working hours, coercion, harassment or exclusion in the workplace etc.

Beyond the prohibition of reprisal, the Directive also provides for the possibility for legal action and compensation in the event that reporting person suffers retaliation for making a report.

Who are protected under the Whistleblower Directive?

The Directive states that protection should be granted to persons who provide information necessary to detect infringements which have already taken place, infringements which have not yet taken place but which are likely to take place, as well as acts or omissions which the reporting person has reasonable cause to regard as violations, as well as attempts to conceal violations.

It is therefore not necessarily a requirement that an infringement has taken place or will take place, as long as the person reporting had a reasonable reason to believe that this was the case.

The core feature of this Directive is to provide reporting channels and protection for all whistleblowers who acquired information on breaches in a work-related context. Therefore, if the reporting person has obtained the information in any other context it will not be covered under the Directive.

To enjoy protection under the Directive, reporting person should have reasonable grounds to believe, in light of the circumstances and the information available to them at the time of reporting, that the matters reported by them are true and correct and that the breach relates to a breach of Union law within the scope of the Directive.

Additionally, protection not only exists for employees, but without limitation, also for volunteers, trainees, contractors, former employees, supporters of the whistleblower and journalists.

How to prepare for the Whistleblower Directive?

The Whistleblower Directive obliges both companies (with more than 250 employees from 2021 and more than 50 employees from 2023) and authorities in general to introduce whistleblower schemes, which must be available to all employees in the company/authority. 

International businesses can prepare for compliance by starting now to prepare to:

  • review their policies, standards of business conduct and reporting arrangements, including internal whistleblower solutions or reporting systems, to ensure compliance with the Directive and continued compliance with GDPR; and
  • implement internal whistleblowing policies or revise their existing policies to ensure compliance with the Directive.


The Directive plays a key role in exposing breaches of Union Law by encouraging people to report such breaches and preventing harm to the society. However, according to the Directive, each Member State has discretion to decide whether it should be possible to report anonymously or not and whether each Member State is obliged to follow up on anonymous reports.

If one or more Member States decide to only follow up on non-anonymous reports, it may call into question the effectiveness of the Directive as employees may hesitate to report non-anonymously even though the Directive protects from retaliation. Undoubtedly, such a case will affect the effectiveness of the Directive to a certain extent.

In light of the above obligations, private sector is urged to start preparing for the above obligations and amending or introducing its internal policies, reporting channels and procedures to comply with the Directive.

Finally, the Directive provides for effective, proportionate and dissuasive penalties applicable to natural or legal persons that hinders or attempts to hinder the reporting, retaliates, brings vexatious proceedings and/or breaches the duty of maintaining confidentiality

[1] Full Whistleblower Directive can be found in this link.

For more information, please visit our website microsite on Procurement & Regulatory or contact Ms.Munevver Kasif at This email address is being protected from spambots. You need JavaScript enabled to view it..

Back to News

Monday – Friday

8:00 – 18:00

TEL: +357 24 201 600

FAX: +357 24 201 601

Privacy Policy