Global menu

Our global pages


The global HR strategist, chapter three: Speaking up - the 2021 deadline for the EU Whistleblowing Directive

  • United Kingdom
  • Employment law
  • Consumer
  • Food and drink
  • Retail


The pandemic has highlighted the importance of employer whistleblowing procedures, reflecting a rise in workers speaking up against corruption, unsafe practices and other misconduct. Yet some whistleblowers have encountered retaliation or have simply been ignored.

This is set to change. The implementation of the EU Whistleblowing Directive later this year marks a significant step change which will have practical workplace consequences beyond Europe. In particular, those multi-nationals applying a one-size-fits-all global whistleblowing policy will need to decide whether to apply the EU’s higher standards beyond Europe.

Following on from our previous global briefings, focusing on topical considerations for HR strategists (Chapter one: Global workforce mental health protection and Chapter two: Global diversity data), this briefing summarises key aspects of the Directive, reports on how it is being implemented locally across EU Member States and considers practical steps employers can take.

The EU Whistleblowing Directive (“WBD”)

The WBD protects a broad range of people who acquire information about breaches of EU law in a work-related context and who decide to make a report (to ‘blow the whistle’). It supplements existing EU sector specific whistleblowing (“WB”) rules, such as in the financial services.

Reporting may be via internal channels to the employer, externally to certain national/EU authorities or publicly, such as to the media, depending on the circumstances. Member states may decide to extend the scope of the WBD beyond breaches of EU law, to include breaches of national law.

Protecting whistleblowers

The WBD extends protection beyond workers and includes former and current workers, the self-employed, shareholders, board members including non-executives, volunteers, trainees, those working for contractors, subcontractors and suppliers and job applicants. To qualify for protection they must have reasonable grounds to believe the information reported was true at the time of reporting and must report in accordance with the internal, external or public channels provided. There is no requirement to report in good faith, nor express public interest pre-condition.

Whistleblowers are protected against all work-related retaliations prompted by the report. Third parties, as well as the whistleblower, are also protected including those helping them to report at work. Their identities are protected by confidentiality and they have legal immunity in certain circumstances, such as those relating to confidentiality obligations.

Employer obligations

In broad terms, employers must operate internal WB channels meeting minimum criteria on diligent investigation and response. The requirement to establish internal reporting channels, under the WBD, extends to public sector legal entities and private sector employers of 50+ workers (the 50+ threshold does not apply to small employers covered by sector specific EU rules). Member States may delay this requirement until December 2023 for some private employers with 50-249 workers. These employer internal reporting channels:

  • must be available to the entity’s workers
  • must be secure, maintain confidentiality and comply with GDPR
  • must designate a competent impartial person or department as responsible for diligently following up on reports
  • must allow reporting to be in writing or orally, or both
  • must acknowledge reports within 7 days of receipt and feedback must be provided within 3 months of the acknowledgement
  • may be extended beyond the entity’s workers to others (such as contractors, suppliers, shareholders - identified above)
  • may be operated by third parties, provided safeguards and other requirements, such as maintaining confidentiality, are applied

Sanctions and penalties

Member States must provide, when implementing the WBD, for effective penalties applicable to those: hindering reporting; bringing vexatious proceedings against whistleblowers; retaliating against reporting; and breaching the duty to maintain confidentiality. Interim relief must be made available to whistleblowers (and those assisting) pending resolution of legal proceedings. Penalties must also be applied to those knowingly making false reports. No waiver of rights and remedies in the WBD are permitted.

Internal, external or public whistleblowing?

The WBD contains no requirement to report internally as a first step. It contains general principles only in this respect, for example, that Member States should ‘encourage’ internal before external reporting. Therefore, employers must check national laws implementing the WBD to understand when whistleblowers may skip internal channels when reporting.

The WBD provides for two types of reporting which are outside of the employer: an ‘external’ report to a designated national authority (or EU body), or a ‘public’ report, such as to the media. Public whistleblowing is protected, as follows:

  • a report has been made internally and externally, or directly externally, but no appropriate action has been taken within the prescribed timescale, or
  • the whistleblower has reasonable grounds to believe that a breach constitutes imminent danger to the public interest, or
  • no external report has been made due to reasonable belief in a risk of retaliation or low prospect of breach being effectively addressed

Anonymous reporting

Anonymous whistleblowers are not covered by the WBD unless they are subsequently identified. However, Member States can decide whether employers and national authorities must accept and follow up on anonymous reports. Again, this point needs checking as countries implement the WBD locally.

Member States’ progress on implementing the Whistleblowing Directive – July 2021

Possibly reflecting the pandemic occupying politicians and legislators across Europe, many Member States have yet to publish draft legislation to implement the WBD. This includes Estonia, Germany, Hungary, Italy, Poland, Portugal and Spain - all of which have limited existing WB protections in place. Most are expected to meet the 17 December 2021 deadline for implementation.

A minority of Member States have progressed with implementation, for example, the Czech Republic, Finland, Netherlands, Romania and Sweden (see the table below). Already we can see some differences in approach:

  • the Czech proposal will extend WB obligations further, to smaller private sector employers
  • many are extending the WBD framework to national law, not just breaches of EU law. However, they are not always treated the same (Sweden, NLs)
  • the Czech and Swedish proposals protect anonymous whistleblowers, whereas Romania will not at employer level
  • the Romanian proposal will require employer internal WB channels to be made available to those outside the employer, such as contractors
  • sanctions, including some significant fines, are beginning to be clarified

No longer an EU member, the UK is not required to implement the WBD and the Government has said that it has no plans to do so. While the UK has extensive WB legislation already, compliance with the WBD would necessitate some changes. For example, extending protection to the broad category of people who may report under the WBD.

Member States moving ahead with implementation of the WBD:

Czech Republic Finland Netherlands Romania Sweden
Do WB laws already exist in your jurisdiction? No general whistleblowing laws Legislation with limited scope only (such as covering trade secrets) WB in the public interest is currently protected. However, the WBD requires the existing law to be strengthened Legislation with limited scope only (public sector plus some sector specific WB rules) Legislation with limited scope only (wide public sector protection, narrow private sector protection)
When do you expect the WBD to be implemented? By 17.12.21 By 17.12.21 By 17.12.21, with internal reporting requirements postponed until 17.12.23 for some smaller private sector employers By 17.12.21, with internal reporting requirements postponed until 1.1.23 for some smaller private sector employers By 17.12.21
Is local implementation expected to exceed the standards set by the WBD?  Yes Yes Yes Yes Yes
If yes, give examples of differences that employers should note


  • Employers with more than 25 employees (not 50, under the WBD) are within scope
  • WB can be made anonymously
  • It is the whistleblower’s decision whether to use internal or external reporting channels


  • Breaches of national laws may be included, not just of EU law
  • Suspicions of wrongdoing of public interest will be included (such as breach of a national law), not just breaches of EU law - although both will not always treated the same


  • Breaches of national laws will be included, not just of EU law
  • Internal reporting channels must be made available not only to employees, but also to employees of independent contractors and suppliers



  • Breaches of national laws or other misconduct (subject to a public interest test) will be included, not just of EU law
  • WB can be made anonymously


What sanctions apply if employers fail to comply?
  • Fines, including a maximum fine of approx. EUR. 40,000 or 5% of net turnover if employer fails to prevent retaliation


  • Damages and compensation for a person subject to retaliation
  • Up to 24 months’ salary for employees unlawfully terminated for whistleblowing


  • Breaching confidentiality risks penalties of up to EUR 21,750 or imprisonment (similarly for defaming a whistleblower)


  • Damages for a person subject to retaliation
  • Fines for failing to establish internal channels, hindering reporting and breaching confidentiality



  • Employers failing to comply risk fines and paying compensation 

WB = whistleblowing
WBD = Whistleblowing Directive

Practical implications for employers responding to the Whistleblowing Directive

Even where Member States have existing and comprehensive whistleblowing protection, it is anticipated that national laws will still need changing to reflect the high standards set by the WBD. Therefore, even those employers with comprehensive WB procedures are advised to check whether they need adjusting in the following areas:

  • who may report: the WBD protects a broader range of workers, including contractors, shareholders, others
  • protection beyond the whistleblower: the WBD protects some third parties (facilitators, colleagues, others)
  • review any good faith or public interest criteria: the WBD does not require whistleblowers to act in good faith and does not expressly require reports in the public interest
  • a requirement to report first to the employer: the WBD encourages but does not mandate internal reporting in the first instance. Check local implementation to see how Member States approach the balance between internal and external reporting
  • the administration of employer WB channels: these should be checked to ensure compliance with the confidentiality duty, the duty to respond diligently within set timescales and more. Where they do not currently exist, employers must set them up (unless they are exempt – see above)
  • training: the WBD extends robust legal protection to qualifying whistleblowers and Member States are required to apply effective penalties for non-compliance. Employers should ensure that staff understand the gravity of hindering those reporting or retaliating in any way
  • compliance: check whether procedures, and any proposed changes, comply with data protection, works council consultation and other legal requirements

In conclusion

In this age of the whistleblower, employers failing to provide easy access to confidential reporting mechanisms, or handling disclosures and disclosers inappropriately, risk problems escalating, reputational damage and, increasingly, significant sanctions for breaching whistleblowing regulation. 

The WBD will make it more important than ever for in-scope employers to have set up effective, well-organised and trusted whistleblowing procedures and that they consider opening these channels up to non-employees such as those working for suppliers, contractors, the self-employed and more.

Given the 17 December 2021 implementation of the WBD, employers should be preparing their response now. However, a delayed 2023 implementation is permitted for some smaller private sector employers and this deadline should be checked locally as it will depend on each Member State’s approach to implementation.