AUG (Authorized User Group) Certified
IND Recognised Sponsor
Nasscom Certified
SNA Certified
Nasscom Certified
What Is the Whistleblower Directive?
The EU Whistleblower Directive (Directive (EU) 2019/1937) requires companies with 50 or more employees in an EU member state to establish a confidential internal reporting channel for breaches of EU law, and to protect anyone who reports misconduct from retaliation. Certain sectors, such as financial services, must comply regardless of headcount.
The 50-employee threshold applies per legal entity in each member state, not per global company. A US company with a 60-person subsidiary in Spain must comply with Spanish whistleblower law, even if the parent company's global headcount is much smaller elsewhere.
Whistleblower Directive at a Glance
| Attribute | Description |
|---|---|
| Legal Basis | Directive (EU) 2019/1937 |
| Threshold | 50+ employees per legal entity (some sectors regardless of size) |
| Compliance Deadline (250+ employees) | Since 17 December 2021 |
| Compliance Deadline (50-249 employees) | Since 17 December 2023 |
| Response Timelines | Acknowledge within 7 days; provide feedback within 3 months |
| Protected Reporters | Employees, contractors, suppliers, volunteers, job applicants |
Why Does It Matter?
Many foreign companies wrongly assume their existing US Sarbanes-Oxley or home-country whistleblowing channel satisfies EU requirements. It doesn't. Each EU subsidiary meeting the 50-employee threshold needs its own compliant, confidential reporting channel under that country's specific transposition law, and non-compliance is a real audit risk that most non-EU multinationals discover only once enforcement activity picks up.
When Is It Used?
Whistleblower Directive obligations apply whenever a company:
- Has 50 or more employees in a single EU member state entity.
- Operates in a regulated sector like financial services, where the threshold doesn't apply at all.
- Needs to establish, document, and communicate an internal reporting channel to staff.
A US software company's German subsidiary grows to 55 employees. Under Germany's Hinweisgeberschutzgesetz (the national transposition law), the company must set up a confidential internal reporting channel separate from regular HR, appoint an impartial person to handle reports, and be able to acknowledge reports within 7 days and provide feedback within 3 months.
Common Misconceptions
No. Each EU entity meeting the threshold needs its own channel compliant with that country's specific transposition law, home-country channels don't automatically satisfy this.
No. It's counted per legal entity within each EU member state, not globally.
Not entirely. Certain sectors, including financial services and anti-money laundering, must comply regardless of employee count.
Not necessarily. The directive permits but doesn't require anonymous reporting; some member states, like Italy, France, and the Netherlands, have gone further and made it mandatory.
The EU Whistleblower Directive requires companies with 50 or more employees in an EU country to maintain a confidential internal reporting channel and protect whistleblowers from retaliation, with the threshold assessed per country, not globally. Foreign employers should treat this as a country-by-country compliance requirement, not a single global policy.
Growing past 50 employees in an EU country?
We'll help you set up a compliant whistleblower reporting channel under the local transposition law.
experts@adtsolution.com
Queens towers, Delflandlaan 1, 1062 EA Amsterdam, The Netherlands
