Note: This content is for information only and is not legal advice.
What is the Directive?
The EU Whistleblowing Directive — 2019/1937 was adopted to give people who report breaches a high level of protection across the European Union. Member states were required to transpose it into national law, and organizations were required to set up secure internal reporting channels.
Who does it cover?
As a general rule, organizations with 50 or more employees are expected to provide a secure internal reporting channel (the threshold is lower in certain sectors). Protection is broad, covering not only employees but also interns, suppliers, contractors and shareholders.
Key obligations
- Internal reporting channel: An accessible channel that protects confidentiality.
- Feedback timelines: Acknowledging receipt within a reasonable period (typically 7 days) and providing feedback on the outcome within a set period (typically 3 months).
- Confidentiality: Protecting the reporter's identity.
- Anti-retaliation: Prohibiting retaliation such as dismissal or demotion against reporters.
- Record-keeping: Properly recording reports.
Why it matters beyond the EU
Even organizations outside the EU are affected: those with subsidiaries, branches or significant trade in the EU may need to meet similar standards because of supply-chain expectations. Together with GDPR/KVKK, ISO 37001/37002 and corporate-governance expectations, the Directive has made a secure ethics hotline a global best practice.
For a company doing business with the EU, the question is often not "is it required?" but "when will our partners ask us for it?"
What compliance requires
The core elements of a Directive-aligned setup:
- A confidential and (preferably) anonymous reporting channel.
- Case management that gives the reporter status updates and tracks timelines.
- Role-based access restriction and an audit trail.
- Multilingual access and multiple reporting channels.
Ethics Hotline Portal is designed to support these elements. See the Compliance page or request a demo.