Legal requirements
Directive (EU) 2019/1937
National law determines which organisations need an internal reporting channel. The EU directive generally covers private entities with 50 or more workers, with sector-specific rules and public-sector provisions. Check the applicable national law and implementation dates.
Whistlechannel supports receiving and following up whistleblower reports. The organisation remains responsible for independent case handling, information, procedures and applicable legal duties.
Threshold
In Sweden, the internal-channel requirement began on 17 July 2022 for public employers with at least 50 workers and private employers with at least 250. It has applied to private employers with 50–249 workers since 17 December 2023. The Act entered into force on 17 December 2021. Worker numbers are assessed at the start of the calendar year; sector-specific rules may also apply. Other countries have their own national provisions.
Deadline
National law determines which organisations need an internal reporting channel. The EU directive generally covers private entities with 50 or more workers, with sector-specific rules and public-sector provisions. Check the applicable national law and implementation dates.
Sanctions
In Sweden, the Swedish Work Environment Authority may issue injunctions backed by conditional fines. Obstructing reporting or retaliating against a reporting person can result in damages. The Act does not set a general turnover-based penalty. Other countries determine penalties under their national law.
What the directive requires
- Confidentiality and anonymity differ. The EU directive protects identity; national law determines duties to accept anonymous reports. A voice, attachments and report details can identify a reporter.
- Internal channels generally require acknowledgement within seven days and feedback within three months, subject to applicable legal exceptions. The organisation remains responsible for follow-up.
- Audio add-on – coming soon. Audio recording and audio-file uploads are unavailable. Written reporting and in-person meeting requests are included. The organisation arranges its oral reporting route and requested meetings under applicable law.
- Whistlechannel supports receiving and following up whistleblower reports. The organisation remains responsible for independent case handling, information, procedures and applicable legal duties.
Sources
Sources checked:
Frequently asked questions
Does my company need a whistleblower channel?
National law determines which organisations need an internal reporting channel. The EU directive generally covers private entities with 50 or more workers, with sector-specific rules and public-sector provisions. Check the applicable national law and implementation dates.
How is anonymity guaranteed?
Confidentiality and anonymity differ. The EU directive protects identity; national law determines duties to accept anonymous reports. A voice, attachments and report details can identify a reporter.
Where is data stored?
GDPR permits transfers outside the EU/EEA with an appropriate legal basis and transfer mechanism. EU hosting is an operational choice, not a universal legal requirement. The subprocessor list distinguishes providers and data types; billing data is handled separately.
Whistlechannel
Whistlechannel supports receiving and following up whistleblower reports. The organisation remains responsible for independent case handling, information, procedures and applicable legal duties.