Global menu

Our global pages


Speaking up: the 2021 deadline for the EU Whistleblowing Directive

  • United Kingdom
  • Employment law


This briefing was updated in October 2021

The pandemic highlighted the key role of whistleblowing procedures, reflecting a rise in workers speaking up against corruption, unsafe practices and other misconduct. A recent record $200 million award to a whistleblower in the US serves as a reminder of the potentially grave consequences for employers. Yet, despite many businesses having whistleblowing programmes and hotlines, some whistleblowers encounter retaliation or are simply ignored, reflecting a potential disconnect between policies and culture in the workplace.

This is set to change. European Union (EU) member states must implement the Whistleblowing Directive into their national laws by 17 December 2021. This marks a significant step change which will have practical workplace consequences beyond Europe. In particular, those multi-nationals applying a one-size-fits-all global whistleblowing policy will need to decide whether to apply the EU’s higher standards beyond Europe.

Following on from our previous global briefings, focusing on topical considerations for HR strategists (Chapter one: Global workforce mental health protection and Chapter two: Global diversity data), this briefing summarises key aspects of the Directive, reports on how it is being implemented locally across EU Member States and considers practical steps employers can take.

The EU Whistleblowing Directive (“WBD”)

The WBD protects a broad range of people who acquire information about breaches of EU law in a work-related context and who decide to make a report (to ‘blow the whistle’). It introduces common minimum whistleblowing (“WB”) standards and supplements existing EU sector specific rules, such as in the financial services.

Reporting may be via internal channels to the employer, externally to certain national/EU authorities or publicly, such as to the media, depending on the circumstances. Member states may decide to extend the scope of the WBD beyond breaches of EU law, to include breaches of national law.

Protecting whistleblowers

The WBD extends protection beyond workers and includes former and current workers, the self-employed, shareholders, board members including non-executives, volunteers, trainees, those working for contractors, subcontractors and suppliers and job applicants. To qualify for protection they must have reasonable grounds to believe the information reported was true at the time of reporting and must report in accordance with the internal, external or public channels provided. There is no requirement to report in good faith, nor express public interest pre-condition.

Whistleblowers are protected against all work-related retaliations prompted by the report. In any court proceedings relating to a detriment suffered by the reporting person, the burden of proof is reversed meaning that the employer must prove a justifiable reason. Third parties, as well as the whistleblower, are also protected including those helping them to report at work. Their identities are protected by confidentiality and they have legal immunity in certain circumstances, such as those relating to confidentiality obligations.

Employer obligations

In broad terms, employers must operate internal WB channels meeting minimum criteria on diligent investigation and response. The requirement to establish internal reporting channels, under the WBD, extends to public sector legal entities and private sector employers of 50+ workers (the 50+ threshold does not apply to small employers covered by sector specific EU rules). Member States may delay this requirement until December 2023 for some private employers with 50-249 workers. These employer internal reporting channels:

a)    must be available to the entity’s workers

b)    must be secure, maintain confidentiality and comply with GDPR

c)    must designate a competent impartial person or department as responsible for diligently following up on reports

d)    must allow reporting to be in writing or orally, or both

e)    must acknowledge reports within 7 days of receipt and feedback must be provided within 3 months of the acknowledgement

f)     may be extended beyond the entity’s workers to others (such as contractors, suppliers, shareholders - identified above)

g)    may be operated by third parties, provided safeguards and other requirements, such as maintaining confidentiality, are applied

Sanctions and penalties

Member States must provide, when implementing the WBD, for effective penalties applicable to those: hindering reporting; bringing vexatious proceedings against whistleblowers; retaliating against reporting; and breaching the duty to maintain confidentiality. Interim relief must be made available to whistleblowers (and those assisting) pending resolution of legal proceedings. Penalties must also be applied to those knowingly making false reports. No waiver of rights and remedies in the WBD are permitted.

Internal, external or public whistleblowing?

The WBD contains no requirement to report internally as a first step. It contains general principles only in this respect, for example, that Member States should ‘encourage’ internal before external reporting. Therefore, employers must check national laws implementing the WBD to understand when whistleblowers may skip internal channels when reporting.

The WBD provides for two types of reporting which are outside of the employer: an ‘external’ report to a designated national authority (or EU body), or a ‘public’ report, such as to the media. Public whistleblowing is protected, as follows:

a)    a report has been made internally and externally, or directly externally, but no appropriate action has been taken within the prescribed timescale, or

b)    the whistleblower has reasonable grounds to believe that a breach constitutes imminent danger to the public interest, or

c)    no external report has been made due to reasonable belief in a risk of retaliation or low prospect of breach being effectively addressed

Anonymous reporting

Anonymous whistleblowers are not covered by the WBD unless they are subsequently identified. However, Member States can decide whether employers and national authorities must accept and follow up on anonymous reports. Again, this point needs checking as countries implement the WBD locally.

Member States’ progress on implementing the Whistleblowing Directive – October 2021

Many Member States have initiated the implementation process, such as opening consultations, but have yet to publish finalised legislation to implement the WBD. A small number have yet to make any announcements as to planned implementation. As a result, some Member States are not expected to meet the 17 December 2021 deadline for implementation, including the Czech Republic, Germany, Spain, Hungary and Italy.

A small number have progressed with implementation, such as Finland, France, Netherlands, Romania and Sweden (see the table below). For example, in France changes to the existing Sapin II law is expected to widen the scope of protected individuals and of public disclosures and to strengthen protection against retaliation.

Unfortunately, for employers seeking consistency of approach across Member States, we can already see some differences emerging:

  • many are extending the WBD framework to include whistleblowing on national issues, not just breaches of EU law. However, not all are treating national and EU whistleblowing as one (e.g. NLs)
  • some protect anonymous whistleblowers whether or not they are later identified (e.g. Sweden, Estonia), some only if they are identified (e.g. Romania) and some leave it to employers to decide (e.g. Poland)
  • some require employer internal WB channels to be made available to those outside the employer, such as to contractors (e.g. Romania)
  • differing sanctions, including some significant fines and terms of imprisonment, are beginning to be clarified (e.g. up to three years’ imprisonment – France and Poland, a potential EUR 400,000 penalty – Estonia or EUR 235,000 - Poland)

No longer an EU member, the UK is not required to implement the WBD and the Government has said that it has no plans to do so. While the UK has extensive WB legislation already, compliance with the WBD would necessitate some changes. For example, extending protection to the broad category of people who may report under the WBD.

Examples of Member States proposals (not yet finalised) for implementing the WBD:

France Finland Netherlands Romania Sweden
Do WB laws already exist in your jurisdiction? Legislation protects WB, as well as sector specific rules. However, the WBD requires the existing law to be strengthened
Legislation with limited scope only (such as covering trade secrets)
WB in the public interest is currently protected. However, the WBD requires the existing law to be strengthened
Legislation with limited scope only (public sector plus some sector specific WB rules)
Legislation with limited scope only (wide public sector protection, narrow private sector protection)
When do you expect the WBD to be implemented? By 17.12.21, however this is not certain
After 17.12.21 given recent delays
By 17.12.21 (however this is not certain), with internal reporting requirements postponed until 17.12.23 for some smaller employers
On 17.12.21, with internal reporting requirements postponed until 1.1.23 for some smaller private sector employers
By 17.12.21, with internal reporting requirements postponed until 17.7.22 for private sector employers with 250+ employees, until 1.1.23 for those with 50 to 249 employees
Is local implementation expected to exceed the standards set by the WBD?  Yes No Yes Yes Yes
If yes, give examples of differences that employers should note
  • Breaches of national laws will be included, not just of EU law

  • Suspicions of wrongdoing of public interest will be included (such as breach of a national law), not just breaches of EU law - although both will not always treated the same


  • The scope of reportable breaches is wider
  • Internal reporting channels must normally be used first. They must be made available not only to employees, but also to employees of independent contractors and suppliers


  • Breaches of national laws or other misconduct (subject to a public interest test) will be included, not just of EU law
  • WB can be made anonymously


What sanctions apply if employers fail to comply?

  • Damages, civil fines and imprisonment including three years' imprisonment and a fine of €45,000 for retaliation against a whistleblower


  • Damages and compensation for a person subject to retaliation
  • Up to 24 months’ salary for employees unlawfully terminated for whistleblowing
  • Breaching confidentiality risks penalties of up to EUR 21,750 or imprisonment (similarly for defaming a whistleblower)


  • Damages for a person subject to retaliation
  • Fines for failing to establish internal channels, hindering reporting and breaching confidentiality
  • Employers failing to comply risk fines and paying compensation

Key: WB = whistleblowing, WBD = Whistleblowing Directive

Practical implications for employers responding to the Whistleblowing Directive

Even where Member States have existing and comprehensive whistleblowing protection, it is anticipated that national laws will still need changing to reflect the standards set by the WBD. Therefore, even those employers with comprehensive WB procedures are advised to check, without delay given the approaching implementation date, whether they need adjusting in the following areas:

a)   who may report: the WBD protects a broader range of workers, including contractors, shareholders, others

b)   protection beyond the whistleblower: the WBD protects some third parties (facilitators, colleagues, others)

c)   review any good faith or public interest criteria: the WBD does not require whistleblowers to act in good faith and does not expressly require reports in the public interest

d)   a requirement to report first to the employer: the WBD encourages but does not mandate internal reporting in the first instance. Check local implementation to see how Member States approach the balance between internal and external reporting

e)   the administration of employer WB channels: these should be checked to ensure compliance with the confidentiality duty, the duty to respond diligently within set timescales and more. Where they do not currently exist, employers must set them up (unless they are exempt – see above)

f)    training: the WBD extends robust legal protection to qualifying whistleblowers and Member States are required to apply effective penalties for non-compliance. Employers should ensure that staff understand the important role of WB to support corporate governance and good health, and the gravity of hindering those reporting or retaliating in any way

g)  compliance: check whether procedures, and any proposed changes, comply with data protection, works council consultation and other legal requirements

h)  retaliation: ensure that disciplinary/dismissal and other procedures are alert to the risks of unjustifiably taking action against a potential whistleblower, reflecting the burden of proof falling on the employer

i)    spotting whistleblowing: is the organisation confident that managers recognise whistleblowing reports, whether verbal or written, and know how to respond, in what timeframe, the need for confidentiality and more?

In conclusion

In this age of the whistleblower, employers failing to provide easy access to confidential reporting mechanisms, or handling disclosures and disclosers inappropriately, risk problems escalating, reputational damage and, increasingly, significant sanctions for breaching whistleblowing regulation. It is notable that some Member States are criminalising non-compliance with up to three years’ imprisonment.

The WBD will make it more important than ever for in-scope employers to have set up effective, well-organised and trusted whistleblowing procedures and that they consider opening these channels up to non-employees such as those working for suppliers, contractors, the self-employed and more.

Given the 17 December 2021 implementation of the WBD, employers should be preparing their response now, particularly in those Member States with a requirement to first consult with employee representatives and works councils. However, a delayed 2023 implementation is permitted for some smaller private sector employers and this deadline should be checked locally as it will depend on each Member State’s approach to implementation.