Whistleblower protections across Europe – the legal context

Many European countries have only partial legal protections for whistleblowers. Here is a country-by-country overview.

Lorenzo Trevisiol

Chapters

Whistleblowers play a vital role in exposing corruption, fraud and mismanagement. Because many whistleblowers face reprisals after they report, adequate legal protection is needed urgently. But many countries in Europe have failed to implement this. We provide an overview of current whistleblowing legislation, both inside and outside the EU.

Whistleblower protection people with umbrella | integrityline.com

EU countries

Note: The new EU Whistleblowing Directive 2019 introduces minimum standards for the protection of whistleblowers and obliges many public and private entities to introduce their own internal whistleblowing channels. EU countries are required to transpose the directive by December 2021.

Below you will find a detailed overview of whistleblowing legislation in the individual EU countries.

Map that shows the implementation status of the EU Whistleblowing Directive in Europe
Status: 20th December 2021

Austria

While Austria still lacks a specific whistleblower protection law, the Federal Ministry of Labor has confirmed that work on the transposition of the EU Whistleblowing Directive has been underway since June 2020. The government has confirmed that a first internal draft of a new whistleblowing law has been created after discussions with various departments and federal states. 

It was supposed to be transposed into Austrian law by December 17 but this is very unlikely, given that the legislation is considered a working draft and is not fully developed. Most analysts expect the Austrian transposition of the EU Whistleblowing Directive to occur in early 2022.

Under Austria’s current legislation, the 2011 amendment to the Public Service Law guarantees protection for public employees against discrimination for reporting corruption. There are very few whistleblower mechanisms in the private sector, though banks do have a requirement to have internal whistleblowing systems in place and provide protection for employees reporting misconduct.   

Last updated: 09/12/2021

Belgium

In Belgium only companies in the financial services sector and public institutions are required to implement a whistleblowing system. The 8 mai 2019 law states that employees and former public sector employees are entitled to submit reports and receive protection against retaliation. There are no comprehensive protections for employees of private companies.

On 9 January 2021 the Défi Party proposed a legislative draft on the transposition of the EU Whistleblowing Directive to the House of Representatives.

Last updated: 11/02/2021

Bulgaria

Despite growing public and political interest in the issue in recent years, Bulgaria has no specific legislation regarding whistleblower protection and there is no legal obligation for entities to implement a whistleblowing system. The only law providing meaningful protection is the Administrative Procedure Code, passed in 2006. This law allows persons and organisations to report abuses of power, corruption, mismanagement of public property, and other illegal or inappropriate acts that affect state or public interests. The law, however, only applies to public sector wrongdoing. Private sector employees have no specific protections other than a generic labour law provision that grants workers the right to compensation if they are treated unjustly.

Bulgaria has just published an anti-corruption programme, which also includes the issue of whistleblowing. It is expected to be adopted by end of Q1 2021  before the April elections.

Relevant topics of the programme are:

Last updated: 15/03/2021

Croatia

On 1st July 2019, Croatia received its first whistleblower protection act, the Law on the Protection of Persons reporting Irregularities. This act is designed to prohibit actions that may hinder the reporting of irregularities and offers whistleblowers protection against retaliation. The act obliges employers with 50 or more employees to implement a whistleblowing system. Although the protection of whistleblowers was already subject to partial regulation through the Labour Act, Criminal Code, and Act on Data Secrecy, the act is the first piece of Croatian legislation that sets out a comprehensive legal framework on this subject.

As part of the legislative activities 2021 the Croatian Government plans to adopt amendments to the 2019 act in accordance with the EU Directive until the third trimester of the year.

Last updated: 15/03/2021

Cyprus

After years of delays, Cypriot lawmakers passed the EU Whistleblowing Directive on January 20, 2022. The legislation was introduced by MP Irini Charalambides back in 2016 and it was passed in parliament by a 49 to 1 vote. Previously, Cyprus had no specific regulations regarding the implementation of whistleblowing systems or the protection of whistleblowers. 

Certain and limited protections were offered under section 59 (6B) of the Anti-Money Laundering and Combating Money Laundering Law of 2007. The new bill now offers whistleblowers protection at national level and brings Cyprus in line with uniform EU standards. 

Last updated: 21/01/2022

Czech Republic

Commercial and public entities are currently not obligated to establish whistleblowing systems. On 18 February 2019, the Czech Ministry of Justice submitted a proposal for a new law – the Act on Protection of Whistleblowers – to the Czech Government, but no complex regulation which would support whistleblowers and provide them with protection has been implemented yet in the Czech legal system.

In May 2021, the draft law to transpose the EU Whistleblower Directive was voted on and passed by a majority. However, the legislative process is still not complete and will probably be finalised after the elections in October.

Last updated: 30/06/2021

Denmark

Denmark is the first member state to transpose the EU Whistleblowing Directive into national law. Find out more about the scope of the “Lov om beskyttelse af whistleblowere” in our dedicated blog article.

Last updated: 30/06/2021

Estonia

There is currently no obligation for entities to set up a whistleblowing system. Legal protection for whistleblowers is limited to public sector employees in corruption cases. The Estonian Anti-Corruption Act decrees that reports from staff of public institutions regarding suspected corruption or other misconduct by colleagues made in good faith shall remain confidential and can be disclosed only with the written consent of the official who made the report. An amendment to the act provides public employees with protection from retaliation. On 22 July 2020, the Estonian Minister of Justice confirmed that the bill to transpose the EU Whistleblowing Directive was underway. In September 2020 the Ministery of Justice created an intention to draft a bill on whistleblower protection.

Last updated: 15/03/2021

Finland

Though frequently ranked as one of the least corrupt countries in the world, Finland currently does not oblige entities to implement a whistleblowing system and has no legal protection in place for whistleblowers. However in cases where there are whistleblowing systems in place, these systems have to adhere to the requirements laid out in the Personal Data Act (523/1999), the Act on Protection of Privacy in Working Life (759/2004) and the Employment Contracts Act (55/2001). In March 2020 it was reported that Finland’s Ministry of Justice had set up a national working group for the purpose of transposing the EU Whistleblower Directive.

Last updated: 15/03/2021

France

The French anti-corruption Law “Sapin II” requires that companies establish an internal whistleblowing system that allows employees to report behaviour that violates the corporate code of conduct (if registered office in France & over 50 employees). Subject to certain conditions, the whistleblower can benefit from criminal immunity. Whistleblowers benefit from specific protection against any retaliatory or discriminatory measures within the workplace.

In November 2021, two bills have been decided by the chamber of the parliament and are now being sent to the senate for final approval.

Last updated: 17/12/2021

Germany

In December 2020 the German judiciary has presented a draft of the Whistleblower Protection Act, thus the need for implementing the EU Whistleblowing Directive. The law is intended to provide extensive protection for people who report wrongdoing in companies or to authorities. The German law goes one step further than the EU directive requirements – and also protects whistleblowers who report violations of national law.

Last updated: 22/12/2020

Greece

While there is no obligation for entities to implement a whistleblowing system, it is encouraged. There is no comprehensive legal protection for whistleblowers, however in April 2014 Greece introduced provisions that aimed to protect people who report corruption from criminal prosecution for perjury, slander, libel, and breach of confidentiality and personal data. Additionally, the law bans various forms of retaliation against public employees who report corruption, including firing, disciplinary actions, discrimination and withholding promotions. On 20th June 2020 it was announced that the government had established a legal drafting committee to prepare the draft law to transpose the EU Whistleblowing Directive.

Last updated: 13/08/2020

Hungary

Act CLXV 2013 on Complaints and Whistleblowing came into force on 1st January 2014 which established an electronic whistleblowing system for the public sector operated by the Commissioner for Fundamental Rights (an ombudsman). Whistleblowing reports are registered with an anonymised code and published on the internet in a form accessible to all without any data relating to the whistleblower’s identity. The ombudsman then transfers the report to the competent authority for investigation. The act emphasises that the whistleblower should be protected against retaliation. In the private sector there is no legal obligation for companies to establish whistleblowing systems, but if they do, they must meet several requirements. The whistleblowing rules must be published on the company’s website in Hungarian and the company must request an application to the data protection authority for permission to process such data.

The transposition of the EU Whistleblowing Directive has not yet started.

Last updated: 15/03/2021

Ireland

While Ireland currently has no general obligation on companies to provide whistleblowing channels, the Money Laundering and Terrorist Financing Regulations 2019 oblige financial institutions and other persons subject to anti-money laundering/counter-terrorist financing compliance obligations to put in place independent and anonymous whistleblowing arrangements. The Protected Disclosures Act 2014 (currently under review) provides legal protection for whistleblowers and ensures whistleblowers can avail of significant employment and other protections if they are penalised by their employer.

In May 2021 the Government approved the General Scheme of a Bill to amend the Protected Disclosures Act to give effect to the Directive.

Last updated: 30/06/2021

Italy

Law No. 179/2017, which came into force on 29th December 2017, expanded existing whistleblowing protections to the private sector, requiring companies that have adopted formal compliance programmes pursuant to Legislative Decree No. 231/2001 to also implement a formal whistleblower programme. Acts of discrimination or retaliation against whistleblowers are prohibited.

The transposition of the EU Whistleblowing Directive has not yet started.

Last updated: 15/03/2021

Latvia

The Latvian Whistleblowing Law obliges companies with more than 50 employees to establish a whistleblowing system. The law which came into force on 1st May 2019 ensures legal protection for whistleblowers and that sufficient information and support for the whistleblowers and support for companies establishing a system are accessible.

Last updated: 13/08/2020

Lithuania

Lithuania transposed the EU Whistleblowing Directive into local law in December 2021. It is expected to come into force in February 2022 and mostly follows the specifications of the EU Directive. The law allows the reporting of all illegal violations and therefore goes beyond the specifications in other EU countries, such as Denmark or Portugal.

Last updated: 17/12/2021

Luxembourg

Companies regulated by the CSSF (credit institutions and investment firms incorporated under Luxembourg Law) are obliged to implement a whistleblowing system. Other companies that fall outside of the CSSF’s purview are free to decide whether to opt in on this obligation. The Law of 13th February 2011 introduced specific provisions to the Labour Code which protect whistleblowers in both the private and public sector.

The transposition of the EU Whistleblowing Directive has not yet started.

Last updated: 15/03/2021

Malta

Malta transposed  the EU Whistleblowing Directive into national law in early December 2021, following Denmark, Sweden, Portugal and Lithuania. Valetta passed a bill entitled the ‘Protection of the Whistleblower (Amendment) Act 2021’, which amends and expands the country’s existing whistleblower protection legislation, the Whistleblower Act (Cap 527) of 2013. Among the provisions included in the bill are protection from employer retaliation, extended protection for third parties and financial support for whistleblowers.  

Last updated: 20/12/2021

Netherlands

On 1st July 2016 the House for Whistleblowers Act came into force which required companies with more than 50 employees to put in place internal reporting procedures. In addition to this act, the Corporate Governance Code requires all companies listed on the Dutch stock exchange to have whistleblowing procedures in place. The House for Whistleblowers Act bans retaliation if an employee has a reasonable belief that their report was accurate. The Dutch bill to implement the Whistleblower Directive is expected to open for consultation in July 2020.

For the point being it seems like the Dutch Government will go for a minimal implementation of the EU Directive (also see draft bill).

Last updated: 15/03/2021

Poland

Except for banks and investments companies, Polish law does not require Polish companies to implement whistleblowing systems or provide protection to whistleblowers. The proposed new Polish law on corporate criminal liability will however provide protection for whistleblowers and this is in line with the most recent EU policy.

In December 2020 the first steps toward the implementation of the EU Directive were taken by the Prime Minister who got in touch with the Ministry of Development, Labor and Technologies with regards to preparing a draft law.

Last updated: 15/03/2021

Portugal

The Portuguese parliament approved a new draft law on whistleblower protection through a majority vote on 26 November 2021. That has made Portugal the third country to transpose the EU Whistleblowing Directive into national law after Denmark and Sweden, though it is not expected to come into force until around June 2022. Immediately affecting any organisation with 50+ employees, Portugal’s new law establishes protection and support for whistleblowers while prohibiting any form of retaliation. Previously, Portugal did not have a comprehensive whistleblower protection law in place. 

Last updated: 09/12/2021

Romania

In Romania there is no obligation on any company or entity to implement a whistleblowing system. Legal protection for whistleblowers is limited to public sector employees. Law 571/2004 protects personnel within public authorities and institutions who disclose violations of the law.

The Romanian Ministry of Justice published a draft law on 5 March 2021. Until 26 March 2021 the public consultation is open for recommendations and ammendments. Key elements of the proposal are amongst others:

Last updated: 15/03/2021

Slovakia

The Act on Certain Measures Related to the Reporting of Anti-social Activities came into force in 2015. The act was modified in March 2019 to require all private employers with at least 50 employees, and all public institutions, to have internal whistleblowing systems in place. The act provides pre-emptive protections from retaliation in the workplace. In 2019 a new Office for the Protection of Whistleblowers was established.

In February 2021 the Head of the Office of the Protection of Whistleblowers was announced. There are speculations that there won’t be big changes to the 2019 law as it already includes the minimum requirements stated in the EU Directive.

Last updated: 15/03/2021

Slovenia

There is currently no requirement for companies or organisations to implement a whistleblowing system. While there is no designated law to protect whistleblowers, the Integrity and Prevention of Corruption Act provides near-comprehensive protection to employees who report crime and corruption in good faith.

In October 2020 the National Assembly has passed amendments to the Integrity and Prevention of Corruption Act. But there are further changes necessary to fulfill the EU Directive.

Last updated: 15/03/2021

Spain

The Organic Law on Data Protection and Guarantee of Digital Rights (3/2018) took effect in Spain on 7th December 2018 and stated that companies may establish whistleblowing systems in which employees can report — anonymously, if necessary — any act or behaviour in breach of company regulations, policies, or rules. Spain is currently debating a proposal for the protection of whistleblowers and on 2nd July 2020 the ABRE Coalition published an open letter calling for the participatory transposition for the protection of whistleblowers in Spain. The proposal was rejected in summer 2020.

On 27 January 2021 the second call of submissions ended.

Last updated: 11/02/2021

Sweden

After Denmark, Sweden become the second EU member state to transpose the EU Whistleblowing Directive into national law. A bill called “genomförande av visselblåsardirektivet” or “implementation of the Whistleblowing Directive” entered the country’s parliament in May and it was approved in late September, with the law set to come into force on December 17, 2021. The legislation goes beyond the minimum standards of the EU Directive, containing extra protection provisions and requiring implementation from smaller municipalities. Companies in Sweden with more than 250 employees have to establish internal whistleblowing channels by July 17, 2022 while organisations with between 50 and 250 employees will have until December 17, 2023. Find out more about the scope of the “genomförande av visselblåsardirektivet” in our dedicated blog article.

Last updated: 04/11/2021

Guide to the Introduction of Whistleblowing Systems

How to successfully implement a whistleblowing system in your organisation.

Countries outside the EU

Albania

In Albania private entities with more than 100 employees and public entities with more than 80 employees (Art. 10 of the Law 60/2016) are obliged to establish internal reporting units responsible for both receiving and acting on reports. Law 60/2016 also provides legal protection for whistleblowers. In principle a report should contain the identification data of the whistleblower and his/her contact data, but the law also permits anonymous reports if the whistleblower has clearly provided reasons for anonymity, and if the report contains sufficient data on which the investigation may start.

Last updated: 13/08/2020

Kosovo

Public employers with more than 15 employees, and private employers with more than 50 employees are obliged to appoint a whistleblowing officer responsible for processing reports. Laws No. 04/L-043 on Protection of Informants and No. 06/L –085 on Protection of Whistleblowers protect the whistleblower and the persons associated with the whistleblower from reprisals.

Last updated: 13/08/2020

Norway

Under the Working Environment Act established in July 2017, all companies regularly employing five or more employees need to have a written whistleblowing policy. This policy should include encouragement for whistleblowers to report on ‘censurable conditions’, the procedure for internal reporting and name the person(s) responsible for handling internal reports. The act also prohibits retaliation by the employer against the whistleblower.

Last updated: 13/08/2020

Russia

There is no legal obligation for companies or organisations to establish whistleblowing systems. However, in the document “Measures to prevent corruption in organisations” (Меры по предупреждению коррупции в организациях) the Ministry of Labour and Social Protection strongly encourages it. The Federal Anticorruption Law No. 273, Article 13.3 requires companies operating in the country to implement anti-corruption compliance programmes containing specific anti-corruption measures. Only whistleblowers in the civil service are protected against retaliation under Russian law.

Last updated: 13/08/2020

Switzerland

In Switzerland there is no obligation for companies and organisations to implement whistleblowing systems. The National Council discussed whistleblower protection as part of the current process to revise the Code of Obligation, but it was rejected on 5th March 2020 for the second time.

Last updated: 13/08/2020

Ukraine

Amendments to the Ukrainian law On Prevention of Corruption came into force on 1st January 2020 which state that law enforcement authorities which fight corruption, public law organisations, state enterprises, private companies of which more than 50% is owned by the state and companies participating in state tenders exceeding UAH 20 million (approx. EUR 750,000) must establish protected anonymous channels for whistleblower reports. Any reports received through these channels must be reviewed and processed within certain time periods, and the whistleblowers must be informed of the status of their reports. The law also provides for a financial reward to incentivise whistleblower reports. Whistleblowers are protected under the law and they must not face negative consequences. Whistleblowers can choose to report anonymously either internally or externally to the media or to the authorities.

Last updated: 13/08/2020

UK

In the UK only organisations regulated by the Financial Conduct Authority or within the National Health Service are obliged to establish whistleblowing channels. So far the Public Interest Disclosure Act 1998 (PIDA) protects whistleblowers from detrimental treatment by their employer. Apart from that, a bill was presented to Parliament in late January 2020 which should entitle workers to further protection against protects workers from detriment and dismissal (including being selected for redundancy). Detriment is not defined in the legislation, but it might include threats, disciplinary action, loss of work or pay, damage to career prospects or suspension.

In Northern Ireland, whistleblowers are only protected from victimisation if they are a worker (employees, agency workers and trainees), they reveal information of the right type by making what is known as a ‘qualifying disclosure’ (in the public interest and concerning past, current or future malpractice) and they reveal it to the right person, and in the right way making it a ‘protected disclosure’.

Last updated: 13/08/2020

Disclaimer: This blog article is for non-binding general information purposes only and does not constitute legal advice. All offered information is without guarantee or liability for correctness and completeness.

Whistleblowing Report

A comprehensive study on whistleblowing in European companies

Share this blog post on

Share on linkedin
Share on xing
Share on twitter
Share on facebook
Lorenzo Trevisiol contact image | integrityline.com

Lorenzo Trevisiol

Market Specialist for Compliance | EQS Group
Lorenzo advises clients on how best to implement and operate whistleblowing systems. He regularly participates as a Panellist at compliance events and webinars on whistleblowing and as an expert on global regulations and trends on the topic. Prior to joining EQS Group he focused on anti-corruption projects in the commodity sector and worked as a consultant for NGOs and public organisations on governance and diplomacy related issues.Lorenzo holds a master’s degree in Political Science from the University of Pisa as well and in International Affairs from PSIA – Sciences Po Paris. He speaks English, French, German and his mother tongue is Italian.