Internal reporting channel and whistleblower protection

In the private sector, the general threshold is at least 50 workers. For certain entities in the sectors specified by law, the obligation may apply regardless of the number of workers. The calculation and group structure must be assessed in each case.

Private entities with 50–249 workers may share certain resources for receiving reports and carrying out follow-up action, while retaining their confidentiality and feedback obligations.

The channel must allow written reports and, on request, a face-to-face meeting, as provided by law. The designated person or department must be impartial and able to act without conflicts of interest.

• reporting methods that are easy to find and use;
• acknowledgement of receipt within seven days;
• assessment, requests for information and follow-up action;
• feedback within the statutory maximum of three months;
• confidentiality of identity and restricted access to the file;
• a register, retention and deletion in accordance with the law and the GDPR.

Anonymous reports are examined if they provide sufficient indications of breaches of the law. The company should neither exclude them automatically nor attempt to identify the author by technical means without a legitimate basis.

The whistleblower’s identity and information that may indirectly reveal it are protected. Any disclosure permitted by law must be limited, documented and, where necessary, notified to the person under the applicable conditions.

Dismissal, demotion, salary reduction, intimidation, negative appraisals or other disadvantages linked to the report may constitute retaliation. Managers must be trained, and subsequent decisions concerning the whistleblower must be independently justified and documented.

Whistleblower protection does not mean that the person concerned by the report has no rights. The investigation must be impartial and protect the presumption of innocence, reputation and the right of defence, without exposing the whistleblower’s identity.