Whistlechannel
Login

Legal requirements

EU Whistleblower Protection Directive 2019/1937

Since 17 December 2021 every EU employer with 50 or more employees must operate a confidential internal reporting channel under Directive (EU) 2019/1937. Each Member State has transposed the directive into national law with its own deadlines and penalties.

Every EU member state has transposed the directive with its own regulator and penalties — from Germany's Hinweisgeberschutzgesetz to France's loi Waserman and Italy's Legislative Decree 24/2023. What stays constant is the core: a confidential internal channel, acknowledgement within 7 days, feedback within 3 months, and protection from retaliation backed by a reversed burden of proof. Whistlechannel is EU-incorporated and hosted exclusively in the EU, with no US sub-processors — so your reporting data stays beyond the reach of the US CLOUD Act and FISA Section 702, the laws that led the Court of Justice to strike down Privacy Shield in Schrems II.

Threshold
50 employees
Deadline
In force since 17 December 2021 across the EU (extended to 50–249 employees on 17 December 2023)
Sanctions
National sanctions vary — fines up to €1M and personal liability for management in several Member States.

What the directive requires

  • An internal reporting channel guaranteeing anonymity and confidentiality
  • Acknowledgement to the reporter within 7 days
  • Feedback on follow-up actions within 3 months
  • Protection against retaliation for reporters, facilitators and family
  • Documentation and case-tracking compliant with GDPR
  • An external reporting route to the competent national authority

Frequently asked questions

Does my organization need a whistleblower channel?
Yes, if you have 50 or more employees in any EU member state. Directive (EU) 2019/1937 covers private and public employers, and companies in financial services or other regulated sectors are covered regardless of headcount. The obligation has applied to organizations with 50–249 employees since 17 December 2023.
What deadlines apply once a report comes in?
You must acknowledge the report within 7 days and give the reporter feedback on follow-up within 3 months, extendable to 6 months for complex cases. The whistleblower's identity must stay confidential throughout.
What is the reversed burden of proof?
If a whistleblower suffers a detriment — dismissal, demotion, exclusion — after reporting, the law presumes it was retaliation. The employer, not the whistleblower, must then prove the measure had nothing to do with the report (Article 21(5) of the directive).
Where must whistleblower data be stored to stay GDPR-compliant?
After Schrems II, EU personal data held by US providers is exposed to the CLOUD Act and FISA 702 even when it sits in an EU data center. The safe route is EU-only hosting with no US sub-processors. Whistlechannel hosts exclusively in the EU and uses no US sub-processors.
Can we outsource the reporting channel to a third party?
Yes. The directive expressly allows a third party to operate your internal reporting channel; you remain responsible for following up on reports. That is exactly what Whistlechannel provides — a ready-made channel in 24 EU languages.
What does a compliant whistleblowing channel cost?
Whistlechannel is self-serve with transparent pricing from 99 SEK per month, no setup fee and no sales call. You can have a compliant channel live the same day.

Ready to comply with EU Directive 2019/1937?

Get started in minutes. No installation, no commitment, no credit card required for trial.

Create accountHome