🇫🇷 France compliance

Plateforme lanceur d'alerte pour France

En France, la Loi Waserman (modifiée Sapin II) transpose la Directive UE 2019/1937 et impose aux entreprises de 50+ salariés la mise en place d'un canal interne de signalement confidentiel. Les signalements doivent être accusés réception sous 7 jours et recevoir un retour substantiel sous 3 mois. Les sanctions administratives en cas de non-conformité atteignent €60,000.

Confidly is a GDPR-compliant whistleblowing channel built for companies in France (France) operating under Loi Waserman (modifiée Sapin II) (Loi Sapin II). The intake form is auto-configured with the categories and disclosures Loi Sapin II requires. Reporters can attach audio or video oral statements to a web submission; a native phone-hotline or voicemail channel is on roadmap. The mandatory 7-day acknowledgement and 3-month feedback updates are automated. Set up in 15 minutes. Hosted in the EU. Used by compliance teams from 50 to 5,000 employees.

What Loi Sapin II requires you to do

Loi Waserman (modifiée Sapin II) transposes the EU Whistleblower Directive 2019/1937 into France national law. The core obligations for companies above the threshold (50+ employees):

• Maintain a confidential internal reporting channel
• Acknowledge every report within 7 days
• Provide feedback to the reporter within 3 months
• Designate a person or unit to handle reports
• Protect the reporter from retaliation
• Keep records for the case duration + the audit window

In France, enforcement sits with Défenseur des droits. Maximum fines for non-compliance reach €60,000.

Estimate your exposure under Loi Sapin II with the fines calculator.

How Confidly covers Loi Sapin II

• Country-specific intake template for Loi Sapin II: the form is auto-configured with the categories, disclosures and fields the France transposition requires. No manual setup per channel.
• Anonymous intake available where France law permits. Reporters get a server-issued case code and their own 6-digit secret. No email, no IP, no identifier stored.
• Oral-statement attachments on every plan: reporters upload audio or video oral statements directly into the web form, with EXIF/metadata stripping. A staffed phone hotline or AI-transcribed voicemail channel is on roadmap, in support of the oral-reporting requirement that Loi Sapin II carries from EU Directive 2019/1937 Art. 16.
• Form pre-translated into FR, EN. AI translates incoming reports to your working language on the admin side.
• Auto reporter status updates at 7 days (acknowledgement) and 3 months (status), in the reporter's language. Loi Sapin II feedback obligation satisfied by default.
• AI investigation copilot (Pro): AI summarises, classifies severity, drafts neutral replies, and clusters multi-reporter patterns to surface systemic issues.
• Append-only audit log required for Défenseur des droits audits. Every action recorded with actor, timestamp and metadata.
• EU data residency: all data stored in EU data centres. Per-channel residency on Enterprise (data for France entities stays in France). No third-country transfers.
• Native HRIS sync (Pro): Personio, BambooHR. Auto-revoke channel access on offboarding; flag when a named-in-report person leaves the company.

What does Confidly cost in France?

Three plans, EUR-priced (VAT reverse-charged for EU B2B). Pick a tier by company size; everything else is included.

Frequently asked questions: Loi Sapin II

Qu'est-ce qui constitue une plainte de lanceur d'alerte ?

Le terme « plainte de lanceur d'alerte » est souvent employé dans le langage courant, mais la loi française parle plus précisément de « signalement ». Un signalement constitue une alerte au sens de la loi Waserman du 21 mars 2022 (modifiant la loi Sapin II) lorsque les cinq conditions cumulatives sont réunies : (1) l'auteur est une personne physique, agissant sans contrepartie financière directe et de bonne foi ; (2) il porte sur un crime, un délit, une menace ou un préjudice pour l'intérêt général, ou sur une violation (ou une tentative de dissimulation) du droit de l'Union européenne, de la loi ou du règlement ; (3) l'auteur en a eu personnellement connaissance, ou l'a obtenu dans le cadre de ses activités professionnelles s'il s'agit d'un signalement en contexte de travail ; (4) le signalement ne porte pas sur des informations couvertes par le secret de la défense nationale, le secret médical, le secret des délibérations judiciaires, le secret de l'enquête ou de l'instruction judiciaires, ou le secret professionnel de l'avocat (article 6, II de la loi Sapin II) ; (5) l'auteur suit l'un des trois canaux prévus : signalement interne, signalement externe auprès d'une autorité compétente (Défenseur des droits ou une autorité sectorielle), ou divulgation publique dans les conditions strictes de l'article 8. Ne constituent pas un signalement de lanceur d'alerte : une réclamation individuelle sur ses propres conditions de travail, un litige contractuel individuel sans dimension d'intérêt général, ou une simple opinion. En France, la Loi Waserman (modifiée Sapin II) (Loi Sapin II) oblige les entités de 50+ employees à mettre en place un canal interne conforme, avec des sanctions pouvant atteindre €60,000 en cas de manquement ou de représailles.

Is a whistleblowing channel mandatory in France?

Yes. Loi Waserman (modifiée Sapin II) (Loi Sapin II), the France transposition of EU Directive 2019/1937, requires companies with 50+ employees to operate a confidential internal whistleblowing channel. The law has been in force since 1 September 2022.

What are the fines for non-compliance with Loi Sapin II?

Maximum administrative fines under Loi Sapin II reach €60,000. Enforcement is carried out by Défenseur des droits. Fines apply both for failing to establish a channel and for retaliation against reporters.

Does Loi Sapin II require anonymous reporting?

Loi Sapin II permits anonymous reporting where France national law allows. Confidly's reporter UI issues a server-side case code and reporter-only secret (no email, IP address, or browser identifier is stored), so reporters can submit and follow up entirely anonymously.

What are the timelines under Loi Sapin II?

Companies must acknowledge a report within 7 days of receipt and provide substantive feedback to the reporter within 3 months. Confidly's dashboard tracks both SLAs with automatic reminders.

Is GDPR satisfied by Loi Sapin II compliance?

Loi Sapin II compliance and GDPR are complementary, not equivalent. Confidly is hosted entirely in the EU, signs a GDPR-compliant Data Processing Agreement, and runs an append-only audit log that satisfies both Défenseur des droits inspections and Article 30 GDPR records.

How long does it take to deploy a whistleblowing channel for France?

15 minutes for the channel itself. Branding, FR, EN translations, and policy import take an additional 1-2 hours. Most France customers go live the same day they sign up.