EU Whistleblower Protection Directive
The EU's framework for protecting persons who report breaches of Union law -- establishing mandatory internal reporting channels, a 3-tier reporting system, and comprehensive anti-retaliation safeguards for organisations with 50+ employees across all Member States.
The EU Whistleblower Protection Directive requires every organisation with 50 or more employees to set up a secure, confidential channel through which workers can report wrongdoing. This is not limited to fraud or corruption -- the directive covers breaches across 14 areas of EU law, from environmental violations and food safety to data protection and public procurement. Any person who reports in good faith through the proper channels is protected, whether they are an employee, a contractor, a volunteer, or even a job applicant who spotted something during the hiring process.
The directive establishes three ways to report. First, through the organisation's own internal channel. Second, directly to a national authority -- and crucially, the whistleblower does not have to try the internal route first. Third, by going public, though legal protection for public disclosure only kicks in under specific conditions, such as when earlier reports were ignored or there is an imminent danger to the public interest. Organisations must acknowledge reports within seven days and provide feedback on actions taken within three months.
Retaliation against whistleblowers is flatly prohibited. The directive lists twelve specific forms -- from dismissal and demotion to blacklisting and punitive psychiatric referrals -- and makes clear the list is not exhaustive. If a whistleblower suffers any adverse treatment, the burden of proof flips: the employer must demonstrate the action was entirely unrelated to the report. Interim relief, reinstatement, and full compensation are all available as remedies.
The transposition deadline for large organisations (250+ employees) was 17 December 2021. For medium-sized organisations (50 to 249 employees), Member States had until 17 December 2023. In practice, only four countries -- Denmark, Malta, Portugal, and Sweden -- met the original deadline on time. The European Commission launched infringement proceedings against virtually every other Member State, making this one of the worst-transposed directives in recent EU history. By now, all 27 Member States have transposed the directive into national law.
The directive establishes a graduated reporting framework. Whistleblowers are encouraged -- but not required -- to report internally first. They may go directly to external authorities at any time.
The whistleblower reports through the organisation's internal reporting channel. This is the preferred first step encouraged by the directive.
The directive protects a very broad range of persons -- far beyond traditional employees. Anyone who acquires information about breaches in a work-related context is covered.
The directive protects reports concerning breaches in 14 specific areas of EU law, plus violations affecting the EU's financial interests and the internal market.
Article 19 prohibits any form of retaliation. The burden of proof is reversed: where a whistleblower suffers detriment, the employer must prove it was wholly unrelated to the report.
The directive imposes different requirements based on the size of the organisation. Medium enterprises (50-249 employees) received an extended deadline and may share reporting channels.
The transposition deadline was 17 December 2021. Only 4 of 27 Member States met it on time. The European Commission launched infringement proceedings against the remaining Member States for late transposition -- one of the worst compliance records of any EU directive in recent history.
Select your company type for tailored compliance guidance.