Following the 21 December 2021 implementation of the EU Whistleblower Protection Directive (hereafter: the “Directive”), EU member states and institutions have been assiduously working to incorporate the directive’s regulations into their existing national laws. The primary objective of the Directive is to strengthen protections for whistleblowers who desire to report violations of EU regulations or unethical workplace conduct in all EU member states. Those who choose to report must now have easy access to reporting channels and be protected from retaliation, among other directive requirements.

Beginning on 17 December 2023, a broader range of companies will be required to comply with the Directive. This includes private sector companies with 50 to 249 employees, who are now required to comply with the EU Directive’s regulations (Art. 26(2) Directive). It is essential to note, however, that this new minimum requirement does not apply to regulated entities in the financial services sector or entities susceptible to money laundering or terrorism financing. Regardless of their scale, these organisations are still required to establish reporting channels.

The additional companies will have to follow regulations ensuring:

i) safe and accessible reporting channels

ii) that employees know how, when and where to report wrongdoing

iii) the protection of the confidentiality of whistleblowers and those involved

iv) that the receipt of the report is acknowledged within seven days and that the whistleblower gets a feedback

v) that an update on the investigation is provided within three months of the initial report

vi) the protection of whistleblowers from dismissal, demotion or other forms of workplace retaliation

vii) that record of reports are no longer kept than necessary to comply with GDPR data-keeping.

The Directive does not specify which national authorities whistleblowers can or should reference for external reporting. Thus, organisations should note that they are obligated to make information about external reporting readily accessible, rather than requiring individuals to visit official government websites for external reporting guidance and contact information for the relevant authorities. In addition to the Directive detailing the minimum requirements, several member states enacted additional legislation during transposition, while others revised their existing whistleblower protection policies.

In summary, it is essential that employees and those seeking employment have access to a robust and well-defined whistleblowing procedure from 17 December 2023 if a company has more than 50 employees. Furthermore, in 2023 and 2024, anticipated modifications to whistleblowing regulations in various nations, particularly the European Union, are expected to strengthen safeguards and align with the growing number of global policies and laws.