🇮🇪 Ireland compliance

Whistleblower software for Ireland

In Ireland, Protected Disclosures (Amendment) Act 2022 transposes EU Directive 2019/1937 and requires companies with 50+ employees to operate a confidential internal whistleblowing channel. Reports must be acknowledged within 7 days and answered substantively within 3 months. Administrative fines for non-compliance can reach €250,000.

Confidly is a GDPR-compliant whistleblowing channel built for companies in Ireland (Ireland) operating under Protected Disclosures (Amendment) Act 2022 (PDAA 2022). The intake form is auto-configured with the categories and disclosures PDAA 2022 requires. Reporters can attach audio or video oral statements to a web submission; a native phone-hotline or voicemail channel is on roadmap. The mandatory 7-day acknowledgement and 3-month feedback updates are automated. Set up in 15 minutes. Hosted in the EU. Used by compliance teams from 50 to 5,000 employees.

What PDAA 2022 requires you to do

Protected Disclosures (Amendment) Act 2022 transposes the EU Whistleblower Directive 2019/1937 into Ireland national law. The core obligations for companies above the threshold (50+ employees):

• Maintain a confidential internal reporting channel
• Acknowledge every report within 7 days
• Provide feedback to the reporter within 3 months
• Designate a person or unit to handle reports
• Protect the reporter from retaliation
• Keep records for the case duration + the audit window

In Ireland, enforcement sits with Office of the Protected Disclosures Commissioner. Maximum fines for non-compliance reach €250,000.

Estimate your exposure under PDAA 2022 with the fines calculator.

How Confidly covers PDAA 2022

• Country-specific intake template for PDAA 2022: the form is auto-configured with the categories, disclosures and fields the Ireland transposition requires. No manual setup per channel.
• Anonymous intake available where Ireland law permits. Reporters get a server-issued case code and their own 6-digit secret. No email, no IP, no identifier stored.
• Oral-statement attachments on every plan: reporters upload audio or video oral statements directly into the web form, with EXIF/metadata stripping. A staffed phone hotline or AI-transcribed voicemail channel is on roadmap, in support of the oral-reporting requirement that PDAA 2022 carries from EU Directive 2019/1937 Art. 16.
• Form pre-translated into EN. AI translates incoming reports to your working language on the admin side.
• Auto reporter status updates at 7 days (acknowledgement) and 3 months (status), in the reporter's language. PDAA 2022 feedback obligation satisfied by default.
• AI investigation copilot (Pro): AI summarises, classifies severity, drafts neutral replies, and clusters multi-reporter patterns to surface systemic issues.
• Append-only audit log required for Office of the Protected Disclosures Commissioner audits. Every action recorded with actor, timestamp and metadata.
• EU data residency: all data stored in EU data centres. Per-channel residency on Enterprise (data for Ireland entities stays in Ireland). No third-country transfers.
• Native HRIS sync (Pro): Personio, BambooHR. Auto-revoke channel access on offboarding; flag when a named-in-report person leaves the company.

What does Confidly cost in Ireland?

Three plans, EUR-priced (VAT reverse-charged for EU B2B). Pick a tier by company size; everything else is included.

Frequently asked questions: PDAA 2022

What is reportable under a whistleblowing policy?

Under PDAA 2022, a whistleblowing channel covers breaches acquired in a work-related context: corruption and fraud, breaches of EU law (public procurement, financial services, product and transport safety, environmental protection, food safety, public health, consumer protection, data protection), and serious risks to health, safety, or the public interest. Personal workplace grievances fall outside the channel and belong in a grievance procedure. Confidly's intake form lets reporters categorise the breach so the case handler can triage it.

What should a whistleblowing policy include?

A compliant whistleblowing policy under PDAA 2022 should set out who can report, the breaches covered, how to reach the internal channel, the external authority alternative (Office of the Protected Disclosures Commissioner), the 7-day acknowledgement and 3-month feedback commitments, the named case handler, confidentiality and data-protection terms, and the prohibition of retaliation. Our whistleblowing policy guide covers the full ten-element checklist.

What is not covered under whistleblowing?

Personal grievances (individual disputes about your own pay, conditions, or treatment) are generally not covered by PDAA 2022 unless the matter is also in the public interest. Those belong in your employer's grievance procedure. The channel is for breaches of EU or national law acquired in a work-related context, not interpersonal conflict on its own.

What are common whistleblower policy mistakes?

The most common whistleblowing policy mistakes: a policy that exists but was never communicated to staff, a named case handler who has since left, a policy that contradicts the live channel (promising anonymity while the form demands an email), hedged retaliation wording instead of the statutory prohibition, and failing to name the external authority (Office of the Protected Disclosures Commissioner). Confidly keeps the policy and the channel consistent so these gaps do not open up.

Is a whistleblowing channel mandatory in Ireland?

Yes. Protected Disclosures (Amendment) Act 2022 (PDAA 2022), the Ireland transposition of EU Directive 2019/1937, requires companies with 50+ employees to operate a confidential internal whistleblowing channel. The law has been in force since 1 January 2023.

What are the fines for non-compliance with PDAA 2022?

Maximum administrative fines under PDAA 2022 reach €250,000. Enforcement is carried out by Office of the Protected Disclosures Commissioner. Fines apply both for failing to establish a channel and for retaliation against reporters.

Does PDAA 2022 require anonymous reporting?

PDAA 2022 permits anonymous reporting where Ireland national law allows. Confidly's reporter UI issues a server-side case code and reporter-only secret (no email, IP address, or browser identifier is stored), so reporters can submit and follow up entirely anonymously.

What are the timelines under PDAA 2022?

Companies must acknowledge a report within 7 days of receipt and provide substantive feedback to the reporter within 3 months. Confidly's dashboard tracks both SLAs with automatic reminders.