EU Whistleblower Directive

The EU Whistleblower Directive (Directive 2019/1937/EU) is the European Union's primary legislative instrument for protecting individuals who report breaches of EU law. Adopted in October 2019, it establishes minimum standards for the protection of whistleblowers across all member states and covers a broad range of policy areas, including public procurement, financial services, anti-money laundering, product safety, environmental protection, food safety, and data protection.

The Directive requires private sector organisations with 50 or more employees and all public sector bodies to establish secure internal reporting channels. It mandates specific procedural safeguards, including acknowledgement of reports within seven days, a follow-up response within three months, and strict protection of the reporter's confidentiality. Whistleblowers who report in good faith must be protected from any form of retaliation, and member states must provide effective remedies and penalties for violations.

Germany transposed the Directive into national law with the Whistleblower Protection Act (HinSchG), which entered into force on 2 July 2023 – approximately eighteen months after the original EU deadline. The Directive sets a floor, not a ceiling: member states are free to provide broader protections. Organisations operating across multiple EU member states should be aware that national implementations may differ in scope and detail.