Work & pay
Directive (EU) 2019/1937
Whistleblower Directive
Protection of persons who report breaches of Union law
Companies above a headcount must run a safe internal reporting channel for breaches of Union law — and they may not retaliate against the person who used it.
Does this hit me?
If you report in scope, you should not lose the job for it. Use the internal channel first unless you have a good reason not to. This is not a bounty statute.
Check in the wizardPick a country in the header to see who enforces this at home. Union text is not the last word for directives.
How it rolls in
2019
Directive adopted.
Dec 2021
Transposition deadline (many States late).
Dec 2023
50–249 worker private entities: internal channels.
Why it exists
Union law (finance, procurement, product safety, data, environment, tax avoidance) is hard to police from the outside. The Directive protects reporters and forces a mailbox that actually works.
What actually changes
- Internal channels for entities with 50 or more workers (some sectors at any size).
- External channels at competent authorities, and public disclosure in defined cases.
- Confidentiality, feedback clocks, and a ban on retaliation (dismissal, blacklisting, harassment).
- Member States can go further — many did, covering national law as well as Union law.
How it hits you
If you report in scope, you should not lose the job for it. Use the internal channel first unless you have a good reason not to. This is not a bounty statute.
For citizens
What this does to everyday life
Rights, bills, and what you can ignore. You are usually not the one who files — companies and states are.
A safe mailbox at work for Union-law breaches
If your employer has 50+ staff, there should be an internal channel. Retaliation for a report in scope is unlawful. A fight with your manager is not automatically a whistleblow.
Rights you actually get
- Confidential reporting, feedback, protection against retaliation.
- External authority channels.
Costs and trade-offs
- No EU bounty. Some national laws go further.
What you can do
- Use the internal channel unless you have a good reason not to.
- Keep a dated copy of the report.
What you can ignore
- You are not protected for inventing a claim to hurt a colleague.
If something goes wrong
The national external channel for that subject (labour, DPA, financial NCA) and, if needed, a union or lawyer.
More citizen notes across files: For people
Heard this? Not quite.
Claim: Every workplace complaint is a whistleblow.
The Directive is about breaches of specified Union (and often national) law, not a personality clash with your boss. Ordinary labour grievances stay in labour law.
Latest official statements
All EU NewsNo tagged Commission, Parliament or Council statement in the current feeds.
Board one-pager
Board one-pager
Who this is for: EU employers and workers. Directive (EU) 2019/1937. In national law; private entities with 50+ workers must have internal channels.
Scope
- You have 50 or more workers in the Union, or you sit in a listed sector (including some financial entities) at any size.
First 90 days
- This week: Confirm headcount and sector (50+ vs always-in).
- This month: Stand up or gap an internal channel with confidential intake.
- This quarter: Manager training: do not hunt the reporter; log the feedback clock.
Penalties: National fines, void dismissals, damages; in some States personal liability for retaliation.
For companies
How to stay on the right side of this file
Practical order of work, not a substitute for counsel. Private entities with 50+ workers, and specified sectors at any size; public bodies.
You are probably
Private entities with 50+ workers, and specified sectors at any size; public bodies.
Effort
Treat as an operating process, not a project.
Budget
SME: owner time plus one honest vendor. Large: a named lead, not a taskforce slide.
Roles in this file
The same company can wear more than one hat. Classify before you buy a tool.
HR / legal
This pack names HR / legal as an owner of early work.
Confirm headcount and sector (50+ vs always-in).
Compliance
This pack names Compliance as an owner of early work.
Stand up or gap an internal channel with confidential intake.
HR
This pack names HR as an owner of early work.
Manager training: do not hunt the reporter; log the feedback clock.
Are you in scope?
Act now- You have 50 or more workers in the Union, or you sit in a listed sector (including some financial entities) at any size.
Usually not, if
- A five-person studio with no Union-law reporting duty under the Directive — national law may still go further.
First moves
- This weekConfirm headcount and sector (50+ vs always-in).HR / legal
- This monthStand up or gap an internal channel with confidential intake.Compliance
- This quarterManager training: do not hunt the reporter; log the feedback clock.HR
- A shared in-box of the founder is not a channel. Use a hosted tool and a named intake person who is not the accused.
If you skip this
- Treating every HR grievance as a whistleblow — and treating a real Union-law report as a grievance.
Done looks like
- Channel policy
- Training records
- Case log with dates
- Anti-retaliation checks
Keep this evidence
- Channel policy
- Training records
- Case log with dates
- Anti-retaliation checks
Ask vendors
- Is the tool hosted in a way that preserves confidentiality against the accused managers?
- Who is the data controller for the reports (GDPR)?
Where programmes usually break
- Treating every HR grievance as a whistleblow — and treating a real Union-law report as a grievance.
Call counsel when
- National fines, void dismissals, damages; in some States personal liability for retaliation.
- A supervisor letter, a dawn information request, or a deal that warrants this file.
Enforcement
National fines, void dismissals, damages; in some States personal liability for retaliation.
National authorities designated to receive external reports (often labour inspectorates, DPAs, financial NCAs — several at once).
Need a stack, not one file? Open the company desk
Professional briefing
Legal architecture and duties
For counsel, compliance, and policy teams. Not advice. The Official Journal still wins.
- Instrument
- Directive
- Legal basis
- Art 114 TFEU · Directive (EU) 2019/1937
- Application
- In force in national law. Internal channels: 50+ workers (and listed sectors at any size). Many States extend to national-law breaches.
A process-and-protection statute, not a bounty. The litigation risk is retaliation. Group hotlines are fine if local access and confidentiality are real. GDPR applies to the case file.
How the file is built
Material scope (Art 2)
Breaches of specified Union acts — procurement, finance, product safety, transport, environment, radiation, food, animal, public health, consumer, privacy, competition, corporate-tax avoidance, etc.
Channels (Arts 7–12)
Internal, external, public disclosure with conditions.
Operators
| Role | Who | Core duties |
|---|---|---|
| Legal entity | 50+ or listed sector. | Internal channel, feedback, no retaliation, record-keeping. |
Scope
Entities in the Union; reports about Union-law breaches with a Union nexus.
In
- Work-related reporters: workers, contractors, shareholders, job applicants in many transpositions
Out, or narrower than assumed
- National security as carved out
- Lawyer-client and medical privilege as transposed
Operative provisions
| Anchor | Rule | What it does in practice |
|---|---|---|
| Art 8–9 | Internal channel design and 3-month feedback (6 in complex cases). | A clock you can prove. |
| Arts 19–21 | Prohibition of retaliation and remedies. | HR actions after a report need a clean, documented reason. |
Secondary law and guidance
- National transposition (often broader)
- EDPB/DPA guidance on the GDPR overlay
National layer. Gold-plating is the rule (France, Germany, others cover national criminal law). External authorities differ by subject-matter.
How it sits with other files
Enforcement and private rights
Who
Designated authorities; labour courts.
Tools
Fines, void dismissals, damages, public naming in some States.
Private rights
The reporter’s damages action is the private core.
Risk register
| Risk | Signal | Control |
|---|---|---|
| Retaliation | PIP after a report without a pre-existing file | Independent investigation; freeze unplanned HR moves. |
Open issues
- Anonymous reporting (optional in the Directive, mandatory in some States).
- Group vs local channel fights.
- Abuse vs protection borderline.
Primary sources
Companies above a headcount must run a safe internal reporting channel for breaches of Union law — and they may not retaliate against the person who used it.
You feel it now
Duties are already live.
Next
In national law; private entities with 50+ workers must have internal channels
Where it lands
| Channel | People | Companies |
|---|---|---|
| A channel that is not HR-as-accused | If you report in scope, you should not lose the job for it. Use the internal channel first unless you have a good reason not to. This is not a bounty statute. | Independent intake, confidentiality, and a three-month feedback clock. |
| Retaliation file | If you report in scope, you should not lose the job for it. Use the internal channel first unless you have a good reason not to. This is not a bounty statute. | Dismissal and blacklisting after a report are how you lose the case. |
| Group tools | If you report in scope, you should not lose the job for it. Use the internal channel first unless you have a good reason not to. This is not a bounty statute. | Shared channels are allowed with conditions — local access still matters. |
Who gains
Reporters, and supervisors who get a usable signal.
Who pays
Employers, in process and in damages if they retaliate.
Who pays
Employers, in process and in damages if they retaliate.
Who benefits
Reporters, and supervisors who get a usable signal.
Read the official text