EU Compliance
EU Whistleblowing Directive 2019/1937: The Complete Compliance Guide
A practical overview of Directive (EU) 2019/1937 — who must comply, what channels are required, statutory deadlines and how to avoid sanctions.
What is Directive (EU) 2019/1937?
Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law establishes minimum standards for whistleblower protection across the European Union. Member States were required to transpose the Directive into national law by 17 December 2021.
The Directive mandates that certain organisations establish internal reporting channels, designate persons to receive and follow up on reports, and protect reporters against retaliation.
Who must implement an internal reporting channel?
The obligation applies broadly to private and public sector entities meeting specific thresholds:
- Private sector legal entities with 50 or more workers
- Public sector bodies as defined by national transposition
- Entities in regulated sectors (financial services, AML, transport safety, etc.) regardless of headcount
- Municipalities with 10,000+ inhabitants or 50+ workers (where transposed)
Statutory deadlines every organisation must track
Two deadlines are central to compliance and frequently cited in regulatory inspections:
- Acknowledgement of receipt within 7 calendar days of receiving a report
- Substantive feedback to the reporter within 3 months (extendable to 6 months with justification)
- Maintenance of an electronic record register documenting all reports and actions taken
Why a dedicated platform beats email
Generic email inboxes cannot guarantee anonymity, strip IP metadata, maintain a structured electronic register or enforce deadline tracking. Dedicated whistleblowing software addresses each of these requirements systematically.
QReportly provides encrypted web reporting, automatic register generation, deadline monitoring and country-adapted legal document templates — enabling rapid deployment without IT overhead.
National transposition by country
Each EU Member State has transposed the Directive with country-specific legislation. Key examples include Romania (Law 361/2022), Germany (HinSchG), Spain (Ley 2/2023), Poland (Act on Protection of Whistleblowers), Italy (Legislative Decree 24/2023), Hungary (Act XXV of 2023) and Bulgaria (Protection of Whistleblowers Act).
Organisations operating across borders should ensure their internal channel meets the strictest applicable national requirements in each jurisdiction where they employ staff.