Whistleblower Channels at 50+ Employees: What the EU Directive Requires

Who must have a whistleblowing channel?

The EU Whistleblower Directive (2019/1937) requires all private employers with 50 or more employees to establish an internal reporting channel. Every member state has transposed it into national law — in Denmark, for example, as the Whistleblower Act of 2021 — and the obligation has been fully phased in since 17 December 2023, when companies with 50-249 employees also had to be ready.

When counting employees, include everyone regardless of hours — part-time and fixed-term staff count too. Companies in financial services can be covered by sector rules regardless of size, and some member states have extended the duty below 50 employees, so check your local implementation.

Companies with 50-249 employees may share resources, for example a group-wide channel or an external provider handling intake and screening. Legal responsibility for compliance, however, stays with each individual company.

What can be reported?

The channel must accept reports about breaches of EU law in the areas the directive lists — public procurement, money laundering, product safety, environment, data protection and more. Most member states have widened the scope to include serious breaches of national law, such as bribery, fraud, serious data protection violations and sexual harassment. Ordinary HR grievances — dissatisfaction with pay, cooperation problems, a harsh tone — generally fall outside the scheme and belong in normal management channels.

The concrete requirements

A compliant internal whistleblowing scheme must provide:

• A secure channel: Reporting must be possible in writing, orally or both, and the channel must protect the confidentiality of the reporter's identity.
• An impartial case handler: A designated person or function that receives and follows up on reports — for example HR, compliance or an external law firm — able to act without conflicts of interest.
• Acknowledgement within 7 days: The whistleblower must receive confirmation of receipt no later than 7 days after reporting.
• Feedback within 3 months: No later than 3 months after the acknowledgement, the whistleblower must be told what action has been taken or is planned — for example that an internal investigation has been opened or closed.
• Confidentiality: Only the people needed to handle the case may know the reporter's identity; disclosure beyond that generally requires consent.
• Documentation: You must keep records of reports for as long as necessary, and have a written procedure for the whole process.
• Information for employees: Staff must get clear, easily accessible information about how to report internally, and about the external channel run by the national authority.

Does the channel have to accept anonymous reports?

The directive leaves it to member states and companies whether anonymous reporting must be accepted — in most countries, including Denmark, it is your choice. In practice most companies allow it, because anonymity dramatically increases the chance that employees dare to use the channel at all.

If you allow anonymity, your channel must technically support it: the reporter needs to receive the acknowledgement, feedback and follow-up questions without revealing who they are. A plain email inbox cannot do that — you need a solution with anonymous two-way communication. And note: a whistleblower who reports anonymously but is later identified enjoys full protection.

Protection against retaliation — and sanctions

The core of the regime is the ban on retaliation: a person who reports in good faith may not face dismissal, demotion, harassment, worse assignments or any other detriment. If they do, the burden of proof shifts — the employer must show that the measure was unrelated to the report — and the whistleblower can claim compensation.

Sanctions cut both ways:

• Companies can be fined for failing to establish a channel, for obstructing reports or for retaliating.
• Knowingly false reports are punishable too, and get no protection.

And beyond the fines: issues that could have been resolved internally end up with regulators, the press or the courts instead.

Getting started: a practical checklist

1. Decide who handles cases — internal, external or a combination.
2. Choose a secure channel that supports anonymous two-way communication.
3. Write a short whistleblowing policy: what can be reported, how, and what happens next.
4. Inform employees — in the staff handbook and on the intranet.
5. Set up processes for the 7-day acknowledgement and 3-month feedback, so deadlines do not depend on one person's memory.

How Verkta helps

Verkta's whistleblower portal gives you a ready-made, secure reporting channel with anonymous two-way communication, automatic reminders for the 7-day and 3-month deadlines, access control for case handlers, and a policy template you can adapt. The channel is live the same day you sign up, with a free 14-day trial.