Whistleblower Protection Laws by Country: Germany, France, Spain & Portugal

The EU Whistleblower Protection Directive sets a common floor, but the law that actually applies to your company is the national statute your country used to transpose it — and those statutes differ on deadlines, thresholds, and fines. Germany's HinSchG, France's Loi Waserman, Spain's Ley 2/2023, and Portugal's Lei n.º 93/2021 all implement Directive (EU) 2019/1937, but a compliance team operating in more than one of these countries cannot simply run one generic policy and assume it satisfies all four.

Key takeaways

• All four laws share the same EU-wide floor: an internal reporting channel for entities with 50+ employees, confidentiality of the reporter's identity, and a ban on retaliation.
• Deadlines and fine amounts differ by country — Portugal fines the absence of an internal channel up to €125,000 for a company; Spain fines the absence of any channel at all up to €1,000,000.
• Germany's HinSchG (in force since 2 July 2023) and France's Loi Waserman (in force since 1 September 2022) both extend protection further than the EU minimum in specific ways — Germany on anonymous reports, France on who counts as a protected "lanceur d'alerte."
• Spain created a dedicated regulator, the Autoridad Independiente de Protección del Informante (A.A.I.), while Portugal enforces the law through its Mecanismo Nacional Anticorrupção (MENAC).
• A group operating across several of these countries needs one channel that adapts its workflow per jurisdiction, not four separate systems.

What the Directive requires everywhere

Directive (EU) 2019/1937 set a transposition deadline of 17 December 2021 for member states, with a further grace period until 17 December 2023 for private entities with 50-249 employees to stand up their internal channel. Every national law inherits three baseline obligations: acknowledge receipt of a report within 7 days, give the reporter feedback within 3 months (extendable to 6 in complex cases), and protect the reporter's identity from anyone outside the people handling the case. Where the four countries diverge is in how strictly they enforce this, what counts as a valid report, and how heavily they fine non-compliance.

Germany: HinSchG — broad scope, tiered fines

The Hinweisgeberschutzgesetz (HinSchG) entered into force on 2 July 2023. It requires an internal reporting office ("interne Meldestelle") for any private employer with 50 or more staff, with companies of 50-249 employees granted until 17 December 2023 to comply. A distinctive feature of the German law is that internal channels must be capable of accepting anonymous reports, even though employers are not obliged to actively solicit them. Retaliation or hindering a report can be fined up to €50,000 against a responsible individual under § 40 HinSchG, and under § 30 of the Ordnungswidrigkeitengesetz (OWiG) that base fine can multiply up to tenfold — up to €500,000 — when the offender is a company. A separate fine of up to €20,000 for simply failing to operate a channel at all took effect on 1 December 2023, once the initial transition period ended.

France: Loi Waserman — who counts as protected got much wider

Law No. 2022-401 of 21 March 2022, known as the Loi Waserman, took effect on 1 September 2022 alongside its implementing decree of 3 October 2022. It amends the earlier Sapin II framework rather than replacing it outright. Its most consequential change: a whistleblower no longer needs to act "désintéressé" (without personal interest) to qualify for protection — good faith is now enough. The law also extends protection to "facilitateurs" (colleagues, unions, or associations who help a whistleblower) and to legal entities connected to the whistleblower. The 50-employee threshold applies to companies and to public bodies and municipalities of more than 10,000 inhabitants. Sanctions bite on obstruction rather than on the absence of a channel: obstructing a report carries up to 1 year's imprisonment and a €15,000 fine under Article 13 of the amended Sapin II law, and bringing an abusive or dilatory ("bâillon") legal action against a whistleblower can now draw a civil fine of up to €60,000.

Spain: Ley 2/2023 — the highest fines and a dedicated authority

Ley 2/2023, de 20 de febrero, entered into force on 13 March 2023 and, unusually among the four, created a standalone regulator: the Autoridad Independiente de Protección del Informante, A.A.I., which operates the external channel and holds sanctioning power, including the ability to bar a non-compliant company from public contracts. Spain's fine structure is the steepest of the group: entities that go entirely without an internal channel, or that commit other "muy graves" infractions, face fines ranging from €600,001 to €1,000,000. The 50-employee threshold mirrors the EU floor, and companies of 50-249 employees received the same transitional runway that applies EU-wide.

Portugal: Lei n.º 93/2021 — the most granular fine schedule

Lei n.º 93/2021, de 20 de dezembro, entered into force on 18 June 2022. It applies to private entities with 50 or more employees and to public entities regardless of size, and it sets the same 7-day acknowledgment and 3-month resolution deadlines as the EU baseline. Article 27 of the law grades infractions into two tiers with precise fine bands: "muito grave" infractions — which include obstructing a report, retaliation, breaching confidentiality, or failing to operate any external channel — carry fines of €1,000 to €25,000 for an individual or €10,000 to €250,000 for a company; "grave" infractions, which include simply not having an internal channel, carry fines of €500 to €12,500 for an individual or €1,000 to €125,000 for a company. Negligent conduct and attempted infractions both cut the applicable maximum fine in half. Enforcement sits with the Mecanismo Nacional Anticorrupção (MENAC).

How Vaelo helps you comply across all four jurisdictions

Running separate whistleblowing systems per country is the most common way multi-country compliance teams waste budget and still end up with gaps — one office rolls out a policy that satisfies HinSchG but misses the Loi Waserman's protection for facilitateurs, or a Spanish subsidiary's channel doesn't route reports to the AAI's expectations. Vaelo is built as a single channel that adapts per jurisdiction: each business unit is configured with the acknowledgment and resolution deadlines, retention rules, and escalation paths that match its country's transposition, while your compliance team keeps one dashboard instead of four disconnected tools. If you already have the EU-wide obligations mapped, our overview of the EU Whistleblower Protection Directive covers the baseline every one of these national laws builds on.

Frequently asked questions

Do all EU countries enforce the same whistleblower rules? No. They share the same floor set by Directive (EU) 2019/1937 — a 50-employee threshold, a 7-day acknowledgment, and a 3-month resolution window — but national laws diverge sharply on fine amounts, who qualifies for protection, and which authority enforces the rules.

Which country has the highest fines for non-compliance? Spain's Ley 2/2023 sets the steepest bracket among the four: €600,001 to €1,000,000 for entities that fail to operate a channel at all or commit other "muy graves" infractions.

Does a company with fewer than 50 employees need to comply? Generally no, under any of the four laws, unless it operates in a regulated sector (financial services, for example) where sector-specific EU rules can lower or remove the employee threshold.

Can one whistleblowing channel satisfy all four countries at once? Yes, provided the channel is configured per jurisdiction — matching each country's deadlines, retention rules, and reporting-authority integrations — rather than applying one generic policy across all subsidiaries.

Does the Directive require anonymous reporting everywhere? No. The EU Directive leaves this to member states. Germany's HinSchG explicitly requires channels capable of receiving anonymous reports; the other three laws in this comparison require confidentiality of identity but do not universally mandate that channels accept fully anonymous submissions.