The Directive of the European Parliament and of the Council on the Protection of Persons Who Report Breaches of Union Law (the “Whistleblowing Directive”) requires EU Member States to create rules mandating that private and public organizations with more than 50 workers must set up whistleblowing hotlines and accept reports about violations of EU law.

The Whistleblowing Directive also provides minimum standards for responding to and handling concerns raised by whistleblowers.

The Whistleblowing Directive does not have a direct effect in the EU Member States like the EU General Data Protection Regulation (GDPR). Each of the Member States must implement the Whistleblowing Directive into its local law, which they are currently in the process of doing.

Organizations with 250 or more workers are required to comply with the new rules by December 17, 2021, while organizations with 50 to 249 workers had an additional two years to become compliant by December 17, 2023.

National implementation means that there will be no full harmonization, so the whistleblowing rules in the EU will to a certain extent likely vary according to country.

We will be closely monitoring all developments related to local implementation on behalf of our clients and will make them available here so you can track them as well.

roadmap new eu whistleblowing directive
Sign up to receive up-to-the-minute legal and business analysis on the latest privacy and data security topics.