EU Whistleblower Protection Directive: What Every Company Must Know

Any private company with 50 or more employees, and every public-sector entity regardless of size, is legally required to operate an internal whistleblower reporting channel under Directive (EU) 2019/1937 — with a 7-day deadline to acknowledge reports and a 3-month deadline to resolve them.

Key takeaways

• The Directive applies to private companies with 50+ employees and all public-sector bodies, regardless of size.
• Reports must be acknowledged within 7 days and followed up within a maximum of 3 months.
• Anonymous reporting isn't mandated by the Directive itself, but several national laws (Portugal, Germany) require it.
• Penalties for non-compliance must be "effective, proportionate and dissuasive" (Article 23) — in practice this includes fines and, in some countries, criminal liability for retaliation.
• Each EU Member State transposed the Directive into national law with its own specifics — a generic channel isn't enough if it ignores local requirements.

Who must comply

Directive (EU) 2019/1937, adopted in October 2019, sets a European baseline for protecting people who report breaches of EU law encountered in a work-related context. Its scope is broad by design:

• Private companies with 50 or more workers — the threshold that captures the vast majority of mid-market and enterprise organisations.
• All public-sector entities, including municipalities with fewer than 10,000 inhabitants in some Member States, with no minimum headcount.
• Specific regulated sectors (financial services, transport safety, anti-money laundering) even below the 50-employee threshold, because sector-specific EU legislation already required reporting mechanisms.

Companies between 50 and 249 employees benefited from a later transposition deadline in several Member States, but that grace period has expired almost everywhere — non-compliance is no longer a matter of "not yet," it's a live legal exposure.

The two legal deadlines: 7 days and 3 months

This is the part compliance teams get wrong most often, because it isn't one deadline — it's two, and they're sequential:

1. Acknowledgement of receipt — the organisation must confirm to the reporter that their report was received, within 7 calendar days.
2. Feedback on the report — within a maximum of 3 months from the acknowledgement (not from the original submission), the organisation must give the reporter meaningful feedback: what action was taken or planned, and why.

Missing either deadline isn't just a process failure — in most transpositions it's independently sanctionable, and it erodes the single biggest driver of whether employees actually use the internal channel instead of escalating externally to a regulator or the press: trust that something will happen.

Anonymous reporting: what the Directive actually requires

The Directive protects the confidentiality of a reporter's identity in every case — that part is non-negotiable. What it leaves to Member States is whether organisations must also accept fully anonymous reports (where identity is never captured at all, even internally).

• Portugal (Lei n.º 93/2021) and Germany (HinSchG) require organisations to accept and process anonymous reports.
• Other Member States leave it optional, but permit it — and in practice, offering anonymity meaningfully increases report volume, because it removes the single biggest reason employees stay silent: fear of being identified.

A channel that only supports confidential (not anonymous) reporting is compliant in some countries and non-compliant in others — which matters immediately for any company operating across borders.

Penalties for non-compliance

Article 23 of the Directive requires Member States to establish penalties that are "effective, proportionate and dissuasive" against:

• Natural or legal persons who hinder or attempt to hinder reporting.
• Anyone who retaliates against a reporter.
• Anyone who breaches the duty of maintaining confidentiality of a reporter's identity.
• Organisations that fail to establish or maintain the required internal channel.

The exact figures vary by Member State — some set fixed administrative fine ranges, others tie fines to company turnover, and several attach criminal liability specifically to retaliation against a reporter. What's consistent everywhere is that "we didn't have a channel" is treated as an aggravating factor, not a defence.

National transpositions at a glance

Every Member State transposed the Directive, but the details diverge — deadlines, anonymity requirements, and penalty structures are not identical from Lisbon to Helsinki. A few examples: Portugal's Lei n.º 93/2021, Germany's HinSchG, France's Loi Waserman, Spain's Ley 2/2023, and Italy's D.Lgs. 24/2023 each add local specifics on top of the EU baseline. A generic, one-size-fits-all channel built for "EU compliance" in the abstract often misses at least one of these local requirements — which is exactly the gap a purpose-built, multi-jurisdiction platform is designed to close.

How Vaelo helps you comply in minutes, not months

Vaelo is a hosted whistleblower reporting platform built specifically around this Directive and its national transpositions. It gives you a branded, anonymous-capable reporting channel live in minutes — with the 7-day acknowledgement and 3-month resolution deadlines tracked automatically, two-way anonymous communication between reporter and investigator, encrypted evidence storage, and a case management dashboard your compliance team can actually use under deadline pressure, in all 24 official EU languages.

Frequently asked questions

Which companies must comply with the EU Whistleblower Protection Directive? Any private-sector organisation with 50 or more employees, and all public-sector entities regardless of size, must establish an internal reporting channel under Directive (EU) 2019/1937.

What is the deadline to acknowledge a whistleblower report? Organisations must acknowledge receipt of a report within 7 days and provide feedback to the reporter within a maximum of 3 months from that acknowledgement.

Does the Directive require anonymous reporting? The Directive itself leaves anonymous reporting optional at EU level, but several national transpositions (including Portugal and Germany) require organisations to accept anonymous reports and protect reporter identity end-to-end.

What happens if a company doesn't comply with the Directive? Article 23 requires Member States to set penalties that are effective, proportionate and dissuasive; in practice this ranges from administrative fines to criminal liability for retaliation against reporters, depending on national law.