Why this matters.
Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law — the EU Whistleblowing Directive — required all EU member states to implement domestic legislation by December 2021. Private-sector organisations with 50 or more workers must establish internal reporting channels and procedures, appoint a person or department responsible for follow-up, acknowledge receipt within 7 days, provide feedback within 3 months, and protect reporters from retaliation. Organisations in financial services are subject to the requirements regardless of size.
The Directive covers reporting of breaches in a wide range of EU law areas: financial services, product safety, transport safety, environmental protection, food safety, public procurement, competition law, corporate tax, data protection, and more. Member states may — and many have — extended national legislation to cover domestic law breaches too. Failure to implement compliant reporting channels, or retaliation against whistleblowers, exposes organisations to fines (amounts vary by member state) and civil liability to the affected reporter.