EU Whistleblowing Directive
Directive (EU) 2019/1937 sets the rules for internal reporting channels across the EU. Each member state turns it into its own law; in Germany that is the HinSchG. This page is a summary, not legal advice.
Who must have a channel
Member states may go further than these minimums.
| Article | Rule |
|---|---|
| Art. 8(3) | Private employers with 50 or more workers. |
| Art. 8(4) | Firms under the Annex acts on financial services and money laundering, transport safety and the environment, at any size. |
| Art. 8(9) | Every public-sector body, including entities it owns or controls. States may exempt municipalities with fewer than 10,000 inhabitants or 50 workers, and other public bodies with fewer than 50 workers. |
| Art. 8(6) | Private employers with 50 to 249 workers may share the receipt and investigation of reports. Confidentiality, feedback and the remedy stay with each of them. |
| Art. 8(7) | After a risk assessment, states may oblige smaller private employers too. |
| Art. 26(2) | For private employers with 50 to 249 workers, national law had to apply the duty by 17 December 2023. |
Requirement by requirement
The binding text is on EUR-Lex.
| Requirement | Article | OpenWhistle | Shown in |
|---|---|---|---|
| Internal channel from 50 workers | Art. 8(3) | The channel, on your own server | Install |
| Reports in writing or orally | Art. 9(2) | The web form; a guide for a telephone channel | Whistleblower guide, Telephone channel |
| Confidential identity | Art. 9(1)(a), Art. 16 | Confidential mode; the identity shown only to the case handler (while unassigned, an admin of the case's organisation), with an audited reason | Managing reports |
| Acknowledge within 7 days | Art. 9(1)(b) | The 7-day deadline on dashboard, case and status page | Deadline tracking |
| An impartial person or department | Art. 9(1)(c) | not covered: you appoint them; roles limit who sees a case | Roles |
| Diligent follow-up | Art. 9(1)(d) | not covered: you take the follow-up; the case page records it | Managing reports |
| Feedback within 3 months | Art. 9(1)(f) | The 3-month deadline; replies through the anonymous channel | Deadline tracking |
| Information on reporting externally | Art. 9(1)(g) | not covered: the organisation publishes it | — |
| Record keeping | Art. 18 | Every report and message stored, encrypted; PDF export. The audit log records admin actions | Managing reports, Audit log |
| Personal data and deletion | Art. 17 | Retention; four-eyes deletion | Data retention, Managing reports |
| Anonymous reports | Art. 6(2), left to member states | Anonymous mode; no IP address stored | Anonymity layers |