What is the EU Whistleblower Directive?

EU Directive 2019/1937, formally the Directive on the protection of persons who report breaches of Union law, requires companies with 50+ employees and all public-sector entities to maintain a confidential internal reporting channel, acknowledge reports within 7 days, give feedback within 3 months, and protect reporters from retaliation. It has been in force across all 27 EU member states since 17 December 2023.

When did the EU Whistleblower Directive come into force?

The directive was adopted on 23 October 2019 and EU member states were required to transpose it into national law by 17 December 2021. The obligation extended to companies with 50-249 employees on 17 December 2023. Several member states missed the deadlines and faced infringement procedures from the European Commission.

Who must comply with Directive 2019/1937?

Private-sector legal entities with 50+ employees and all public-sector entities (regardless of size, except municipalities under 10,000 inhabitants). The 50-employee threshold is calculated per legal entity, not per group, though the directive allows mid-sized companies (50-249 employees) to share resources for the channel.

What are the fines for non-compliance with the EU Whistleblower Directive?

Fines vary by national transposition. The highest cap is Spain's Ley 2/2023 at €1,000,000. France's Loi Sapin II caps at €60,000, Germany's HinSchG at €50,000, Austria's HSchG at €20,000. Fines apply both for failing to establish a channel and for retaliating against a reporter.

Can reports be anonymous under the EU Whistleblower Directive?

The directive itself leaves anonymous reporting optional, each member state decides. In practice, most member states (Germany, France, Italy, Spain, Netherlands, and others) permit anonymous reports. Confidly's reporter UI supports fully anonymous reporting via server-issued case codes with no email, IP, or browser identifier stored.

What is the difference between internal, external, and public reporting?

Internal: reporting to the employer's confidential channel, recommended first; preserves confidentiality. External: reporting directly to a national competent authority (e.g., Bundesamt für Justiz in Germany, Défenseur des droits in France). Public disclosure: reporting through media or NGOs, only protected under strict conditions (no action taken on prior internal/external report, or imminent danger).

What are the timelines under the EU Whistleblower Directive?

Acknowledgement of receipt: within 7 days. Substantive feedback to the reporter on the action taken: within 3 months of acknowledgement. Records must be kept for the duration of the case + the national retention period (typically 5 years).

Does the EU Whistleblower Directive apply to the UK?

No. The United Kingdom left the European Union on 31 January 2020 and did not transpose Directive 2019/1937. UK whistleblower protection is governed by the Public Interest Disclosure Act 1998 (PIDA), which amended the Employment Rights Act 1996. Two cross-border situations still pull UK-headquartered groups into scope: (1) any EU subsidiary with 50+ employees must operate a local Directive-compliant channel; (2) UK companies subject to the Senior Managers and Certification Regime (FCA/PRA) or to EU-facing GDPR enforcement often operate a Directive-aligned channel voluntarily. Confidly is hosted in the EU and works for both EU subsidiaries of UK groups and UK companies wanting a single pan-European channel.

Is it a legal requirement to have a whistleblowing policy?

Yes, for any private-sector legal entity in the EU with 50 or more workers and for all public-sector entities (Article 8 of Directive 2019/1937). The 50-employee floor has applied to companies of 250+ since 17 December 2021 and to companies of 50-249 since 17 December 2023. The obligation is not only to have a written policy: Article 9 requires an operating procedure (confidential channel, 7-day acknowledgement, designated impartial case handler, 3-month substantive feedback, information about external reporting). Each national transposition adds its own enforcement teeth. Failing to set up the channel is a fineable offence under HinSchG (€50,000 cap), HSchG Austria (€20,000), Loi Sapin II France (€60,000), Ley 2/2023 Spain (€1,000,000), D.lgs 24/2023 Italy (€50,000), and the Irish Protected Disclosures Acts. For companies below 50 workers, the EU obligation does not apply, but national law may still require a channel (the Irish Protected Disclosures Acts apply to all employers, regardless of size, since the 2022 amendment).

What is not covered by the EU Whistleblower Directive?

Article 3 lists the carve-outs and Article 22 sets the rights of subjects, which together define the boundary of the directive's protection. The directive does not cover: (1) classified information and information protected by legal professional privilege or medical confidentiality (Article 3(2) and (3)), (2) judicial deliberations (Article 3(3)), (3) rules of criminal procedure (Article 3(3)), (4) procurement involving defence or security aspects unless governed by relevant Union acts (Article 3(2)). It also does not cover, at the substantive level: personal grievances about pay, promotion, manager tone, or interpersonal disputes that do not involve a breach of EU or extended national law (Article 22 and Recital 22, reinforced by Article 5(2)). Information acquired purely in a private capacity with no work-related context (Article 4(2)) is also out of scope. Reports of these matters can still be investigated under the employer's ordinary grievance or HR procedure, but the reporter does not get the directive's anti-retaliation regime, including the Article 21(5) reverse burden of proof.

Is Directive 95/46/EC still in force?

No. Directive 95/46/EC was the EU's data protection directive of 1995, and it was repealed when the General Data Protection Regulation (Regulation (EU) 2016/679, the GDPR) came into application on 25 May 2018 (Article 94 GDPR). It is distinct from EU Directive 2019/1937, the Whistleblower Directive, which is the legal text this page covers. People often type the wrong number because the two pieces of EU law overlap operationally: a whistleblowing channel processes personal data, so it is governed by the GDPR for processing rules (lawful basis under Article 6(1)(c) for legal obligation, identity confidentiality under Article 14(5)(b) and Article 23, retention under Article 5(1)(e)), and by Directive 2019/1937 for substantive obligations (the channel itself, the 7-day acknowledgement, the 3-month feedback, anti-retaliation). A compliant Confidly deployment satisfies both. The European Data Protection Board's guidance 01/2024 on processing personal data in the context of whistleblowing systems is the authoritative cross-reference.

What are the changes in whistleblowing in April 2026?

Directive 2019/1937 itself was not amended in April 2026. The legal framework is unchanged: the 2019 text, with the December 2023 deadline now fully in force across all 27 EU member states. What shifted in early 2026 is enforcement and case-law context. (a) The European Commission escalated infringement proceedings against the last member states with transposition gaps, signalling that national-level audits will tighten in 2026 and 2027. (b) Several national supreme courts (Spain's Tribunal Supremo, France's Cour de cassation, Germany's Bundesarbeitsgericht) issued rulings in 2025 and early 2026 confirming the Article 21(5) reverse burden of proof in retaliation claims, making employer defences harder. (c) National supervisors in Germany (Bundesamt für Justiz), Spain (Autoridad Independiente de Protección al Informante) and Italy (ANAC) published updated 2026 guidance tightening documentation expectations at inspections. The practical implication for compliance teams: existing channels need an annual audit against the latest national guidance, not a new directive-level rebuild.

Can I be sacked for whistleblowing?

No. Article 19 of Directive 2019/1937 prohibits dismissal in retaliation for a protected disclosure across all 27 EU member states, and the prohibition is enforced at national level with bite. Article 21(5) reverses the burden of proof: once the worker shows the disclosure and the adverse measure, the employer must prove the measure was unrelated. National transpositions add specific remedies. Germany: §36 HinSchG declares retaliatory measures null and void, with reinstatement and damages under §37, plus administrative fines up to €50,000 against the natural person responsible (Bundesamt für Justiz enforces). France: Article L1132-3-3 of the Code du travail makes the dismissal null, restores the contract, and entitles the worker to back-pay plus damages. Italy: Article 17 of D.lgs 24/2023 reinstates the worker, voids the measure, and ANAC can fine up to €50,000. Spain: Article 36 of Ley 2/2023 voids the dismissal and entitles the worker to reinstatement plus compensation, with the Autoridad Independiente de Protección al Informante fining up to €1,000,000. Ireland: Section 12 of the Protected Disclosures Act 2014 (amended 2022) makes the dismissal automatically unfair, awards compensation up to 5 years' remuneration through the Workplace Relations Commission, and gives the worker interim relief in the Circuit Court within 21 days. The directive's protection extends beyond dismissal to demotion, transfer, suspension, written warnings, withholding of training, and any other detriment listed in Article 19. The UK is outside the directive but its Public Interest Disclosure Act 1998 (now in the Employment Rights Act 1996, sections 47B and 103A) provides analogous protection, with uncapped compensation in an automatic-unfair-dismissal claim before the Employment Tribunal.

Compliance guide · Updated 2026

EU Whistleblower Directive 2019/1937 - complete guide

EU Directive 2019/1937 - also called the EU Whistleblower Directive - has been in force across all 27 member states since December 2023 (for companies with 50+ employees). It requires every mid-sized company in Europe to set up an internal reporting channel, investigate every report within 90 days, and protect reporters from retaliation. This guide covers what it means in practice, who's covered, what the fines look like, and how to comply.

What the directive actually requires

Three obligations sit at the centre of the directive:

Maintain an internal reporting channel that lets employees, contractors, suppliers, shareholders, and former staff report breaches of EU law. The channel must be confidential, separate from regular HR, and allow anonymous reports if the local transposing law permits.
Acknowledge every report within 7 days and provide feedback to the reporter within 3 months on what was done. Both timeframes start from the date the channel receives the submission.
Protect reporters from retaliation - dismissal, demotion, harassment, and reputational harm tied to their report. Tribunals across the EU now place the burden of proof on the employer to show retaliation didn't happen.

Who's covered

The threshold is 50 or more workers, counted as headcount (full-time equivalents in some jurisdictions). Some sectors are covered regardless of size: financial services, anti-money-laundering, transport safety, food safety, and a few others. Public bodies are covered from 50 workers (no SMB exemption).

Three groups, three deadlines

Group	Threshold	Deadline
Large companies + public sector	250+ workers	17 December 2021
Medium-sized companies	50–249 workers	17 December 2023
Financial / AML / transport, regardless of size	1+ worker	17 December 2021

How each EU country transposed it

The directive sets the floor; each member state can be stricter. Click any country on the map for the local transposing law + enforcement authority, or scroll past for the full reference list.

Deep-dive guides per jurisdiction (in the local language): HinSchG (DE) · Loi Sapin 2 (FR) · Ley 2/2023 (ES) · D.Lgs. 24/2023 (IT) · Wbk (NL).

What happens if you don't comply

Fines for missing or non-compliant channels range from a few thousand euros to €1,000,000 in Spain, with Italy, Germany, and France clustering in the €20,000–€60,000 range per violation. Beyond fines, regulators can require remediation, and tribunals routinely award damages to retaliated reporters (uncapped in many jurisdictions).

The bigger risk is reputational. A botched whistleblower report that surfaces in the press (or via an external channel like a national authority) creates the kind of scandal that destroys customer trust for years. Tools like Confidly prevent that by keeping reports internal long enough for the company to actually solve the underlying problem.

What a compliant channel looks like

The directive doesn't mandate a specific technology. It mandates a set of guarantees:

Confidentiality - only the people investigating may see the report
Anonymity option - where the national law allows it (most do)
Acknowledgment within 7 days
Feedback within 3 months
A dedicated, designated person or unit handling reports
Records of every report retained for the duration of the case + audit window
Multiple submission methods - written, verbal, in-person on request

You can build this yourself with a Google Form + a spreadsheet + an inbox + a paralegal - and many companies tried that in 2021–2023. The problem isn't the form. The problem is the audit trail, confidentiality (Google Forms is owned by the company), anonymity (the form sees the user's Google account), and retention. By the time the auditor visits, the spreadsheet has gaps and the Google Form has changed shape.

How Confidly handles each requirement

Directive requirement	Confidly
Anonymous intake	No email, no IP, no fingerprint. Server-issued case code + reporter's own 6-digit secret.
Confidentiality	Multi-tenant Postgres with row-level org scoping enforced by every authenticated endpoint.
7-day acknowledgement	Built-in dashboard SLA timer + email reminder to the assigned investigator.
3-month feedback	Same SLA timer escalates if a case sits 90 days without status change.
Designated handler	Cases are assigned to a named investigator; role separation (owner / admin / investigator / viewer).
Records of every report	Append-only audit log - never UPDATE, never DELETE. CSV/JSON export on Enterprise tier.
Configurable retention	Per-channel retention policy (days). Cases auto-purged with audit-stub left behind.
Multiple submission methods	Web form (default) + email forwarding + in-person logged via admin UI.

The 15-minute compliance path

Sign up with your work email
Create your organisation (you become the owner)
Confidly auto-creates a default channel with the standard categories
Customise categories if needed (e.g. add "research misconduct" for a university)
Copy the public link (confidly.eu/your-slug)
Paste it into your careers page, intranet, and HR handbook
Done. You're directive-compliant.

The next employee who has something to report knows where to go. The next compliance audit, you'll have the trail. Most importantly: when something real does happen, you'll hear about it from your own employee first - not from a journalist.