Internal reporting channels are mandatory across the EU

EU Whistleblower Protection Directive

Every private company with 50 or more employees operating in the EU must establish a confidential internal reporting channel, acknowledge reports within seven days, investigate and respond within three months, and protect reporters from all forms of retaliation. Non-compliance penalties reach up to €1M in some member states.

Request a demo Explore the solution

Next deadline:

The obligation is already in force. For companies with 250 or more employees in the EU, the compliance deadline was December 17, 2021. For those with 50 to 249 employees, it was December 17, 2023. Both deadlines have passed. The European Commission's July 2024 implementation report found widespread compliance gaps across member states. Organizations without a compliant internal reporting channel in place are currently in breach of national whistleblower protection law.

National implementing legislation differs in scope and enforcement approach: companies operating across multiple EU member states may face distinct obligations under each country's law, not just the Directive baseline. A group-level channel is not automatically sufficient for all jurisdictions.

Regulation timeline

16. December 2019

Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law enters into force.

2. July 2023

Germany’s Hinweisgeberschutzgesetz (HinSchG) enters into force, applying initially to organizations with 250 or more employees in Germany.

25. April 2024

Court of Justice of the EU issues its first late-transposition judgment, imposing sanctions on Poland (Case C-147/23).

6. March 2025

Court of Justice of the EU imposes financial penalties on five further member states for late transposition, Germany (fined €34 million), the Czech Republic, Hungary, Estonia, and Luxembourg.

17. December 2021

Member states’ transposition deadline. Private companies with 250 or more employees must have compliant internal reporting channels in place.

17. December 2023

Compliance deadline for private companies with 50 to 249 employees across all transposing member states. All in-scope companies are required to have a compliant reporting system in place.

3. July 2024

European Commission publishes its implementation report (COM(2024) 269), finding that all member states transposed the Directive’s main provisions but that key areas, material scope, conditions for protection, and protection against retaliation, still need improvement.

August 2025

European Commission opens a public consultation as part of its formal evaluation of the Directive, inviting assessment of its effectiveness and potential scope extensions.

1 / 8

2019

16. December 2019
Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law enters into force.
2021

17. December 2021
Member states’ transposition deadline. Private companies with 250 or more employees must have compliant internal reporting channels in place.
2023

2. July 2023
Germany’s Hinweisgeberschutzgesetz (HinSchG) enters into force, applying initially to organizations with 250 or more employees in Germany.
17. December 2023
Compliance deadline for private companies with 50 to 249 employees across all transposing member states. All in-scope companies are required to have a compliant reporting system in place.
2024

25. April 2024
Court of Justice of the EU issues its first late-transposition judgment, imposing sanctions on Poland (Case C-147/23).
3. July 2024
European Commission publishes its implementation report (COM(2024) 269), finding that all member states transposed the Directive’s main provisions but that key areas, material scope, conditions for protection, and protection against retaliation, still need improvement.
2025

6. March 2025
Court of Justice of the EU imposes financial penalties on five further member states for late transposition, Germany (fined €34 million), the Czech Republic, Hungary, Estonia, and Luxembourg.
August 2025
European Commission opens a public consultation as part of its formal evaluation of the Directive, inviting assessment of its effectiveness and potential scope extensions.

What the EU Whistleblower Protection Directive requires

The EU Whistleblower Protection Directive (Directive EU 2019/1937) entered into force on December 16, 2019, setting minimum standards across all EU member states for the protection of persons who report breaches of EU law.

Private companies with 50 or more employees and all public sector entities, regardless of size, must establish a secure internal reporting channel, designate a responsible person to handle reports, acknowledge receipt within seven days, and provide substantive feedback on the outcome of the investigation within three months. Reporters must be protected from any form of retaliation, including dismissal, demotion, and blacklisting.

Covered breaches span public procurement, financial services, anti-money laundering, consumer protection, environmental protection, food safety, transport safety, public health, and data privacy. Each member state has transposed the Directive into national law, with the option to set stricter requirements than the Directive baseline.

Common whistleblower compliance challenges

General-purpose tools cannot meet the Directive's technical channel requirements

Internal reporting channel requirements go beyond a shared email address or a general HR portal: a compliant channel must protect reporter identity, support written and oral reporting, accommodate anonymous submission where national law requires it, and provide a two-way communication mechanism. General-purpose communication tools typically lack the access controls and anonymity architecture these obligations require.

Varnish cache server