The obligation that organisations implement is the channel. The obligation that decides whether anyone will ever use it is the protection of the person who speaks. This practice works on that second obligation across the European Union: the prohibition of retaliation, the reversal of the burden of proof, the confidentiality of identity, the support measures and the evidence an employer will need on the day a personnel decision is challenged.
A policy is a statement of intention. Protection is a state of affairs, and it is tested in the only place that matters: the personnel decision taken about a reporting person in the months after the report, and whether the organisation can show, from records made at the time, that the decision rested on grounds unconnected with it.
Article 19 prohibits fifteen categories of retaliation. Dismissal is one. Withheld training, a negative reference, a transfer of duties, a change of working hours, ostracism, a non-renewed fixed-term contract and a referral for medical assessment are others, and every one of them can be presented as ordinary management.
It is an obligation with exceptions, and the exceptions are where organisations fail. Identity may be disclosed under a legal duty; a person named in a report has data protection rights of their own; and a single careless sentence in an investigation file can identify the reporting person more effectively than a disclosure ever would.
Identify the people who fall within the personal scope in each Member State: workers, former workers and applicants, self-employed contractors, shareholders and board members, volunteers and trainees, and the facilitators and colleagues who assist them. National transpositions differ on precisely these categories, and the Commission has recorded the difference as a recurring compliance defect.
Convert the fifteen categories of Article 19 into rules that a line manager can apply, and attach them to the decisions that actually carry the risk: performance assessment, promotion, transfer, contract renewal, references and disciplinary action.
Decide in advance who may know the identity, how the file is written so that identity cannot be inferred, what happens when a legal duty to disclose arises, and how a request for access by a person named in the report will be answered.
Once a detriment is alleged, the burden shifts. The defence is not a submission written afterwards; it is the record of the personnel decision made at the time, by people who did not know the identity of the reporting person.
Directive (EU) 2019/1937 of 23 October 2019 is read, in most organisations, as an obligation to install a channel. Read in full, the channel occupies one chapter and the protection of persons occupies another, longer and more demanding one. The provisions that decide whether a European worker will speak are Articles 19 to 23, and they operate on the employment relationship itself rather than on the reporting technology.
Article 2(2) governs everything below it. The Directive is a minimum: Member States may introduce or retain provisions more favourable to the rights of reporting persons and may never reduce the level of protection. For an organisation established in several Member States this has a single practical consequence — protection has to be designed for the strictest national law it touches, because the alternative is a group standard that silently under-protects in the jurisdictions that demand most.
The personal scope is broader than the payroll and is habitually underestimated. It reaches workers in the private and public sectors, the self-employed, shareholders and members of administrative, management and supervisory bodies, volunteers and paid or unpaid trainees, and persons working under the supervision of contractors, subcontractors and suppliers. It reaches persons whose working relationship has ended and persons whose relationship has not yet begun, where the information was acquired during recruitment or pre-contractual negotiations. It reaches, further, the facilitators who assist a report, third persons connected with the reporting person who may suffer retaliation in a work context, and legal entities that the reporting person owns or works for.
Article 19 requires Member States to take the necessary measures to prohibit any form of retaliation, including threats and attempts of retaliation, and then lists fifteen categories. The list is the most useful single instrument in the whole regime, because it converts an abstract prohibition into a checklist that a human resources function can apply to a decision before it is taken.
| Category listed in Article 19 | How it typically presents inside an organisation |
|---|---|
| Suspension, lay-off, dismissal or equivalent measures | The decision the organisation expects to have to justify, and usually the only one it documents |
| Demotion or withholding of promotion | A promotion round in which a name is quietly not advanced, with no record of why |
| Transfer of duties, change of place of work, reduction in wages, change in working hours | A reorganisation announced shortly after a report, or the loss of a shift premium, of overtime or of a variable component, presented as a business decision |
| Withholding of training | Removal from a development programme, rarely minuted and easy to characterise as a priority change |
| Negative performance assessment or employment reference | A rating or a reference that departs from the person's history without contemporaneous justification |
| Disciplinary measure, reprimand or other penalty, including a financial penalty | A disciplinary process opened after the report, on facts that were known before it |
| Coercion, intimidation, harassment or ostracism | Exclusion from meetings and distribution lists; conduct that leaves little documentary trace and much testimony |
| Discrimination, disadvantageous or unfair treatment | Differential treatment in allocation of work, leave or resources |
| Failure to convert a temporary employment contract into a permanent one | A conversion that had been expected and is not made, where the expectation is documented elsewhere |
| Failure to renew, or early termination of, a temporary employment contract | Non-renewal treated as a non-decision, and therefore never justified in writing |
| Harm, including to reputation, particularly on social media | Reputational damage originating inside the organisation and circulating outside it |
| Blacklisting on the basis of a sector or industry-wide informal or formal agreement | The retaliation that operates after the relationship has ended and is the hardest to detect |
| Early termination or cancellation of a contract for goods or services | The category that reaches suppliers, contractors and the self-employed |
| Cancellation of a licence or permit | Relevant to regulated activities and to persons whose livelihood depends on an authorisation |
| Referral for psychiatric or medical treatment | Pathologising the reporting person; expressly listed, and expressly prohibited |
Article 21(2) provides that reporting persons who report or make a public disclosure in accordance with the Directive do not breach any restriction on disclosure of information and incur no liability of any kind in respect of that report or disclosure, provided they had reasonable grounds to believe that reporting was necessary for revealing a breach.
Article 21(7) completes the protection on the litigation front. In proceedings for defamation, infringement of copyright, breach of secrecy, breach of data protection rules or disclosure of trade secrets, and in claims for compensation, a reporting person may rely on having made the report or public disclosure, and may seek dismissal of the case. The practical reading, for an employer, is that litigation is the worst available answer to a report: it will not resolve the report, and it exposes the organisation to a second sanction under Article 23.
Protection is not only a prohibition addressed to employers; it is also a set of measures that Member States must make available to the reporting person. Article 20 requires access to comprehensive and independent information and advice, free of charge and easily accessible to the public, on the procedures and remedies available; effective assistance from competent authorities before any relevant authority involved in the person's protection against retaliation, including, where provided for under national law, certification of the fact that they qualify for protection; and legal aid in cross-border criminal and civil proceedings, in accordance with the applicable Union instruments.
Article 20 also permits, without requiring, Member States to provide financial assistance and support measures, including psychological support, in the course of legal proceedings. The word is may, and the practical consequence is that the level of real-world support available to a reporting person differs sharply between Member States. An organisation that tells its people they will be supported should first establish what support in fact exists where they work.
The confidentiality obligation is not a promise of anonymity. It is a duty to ensure that the identity of the reporting person is not disclosed, without their explicit consent, to anyone beyond the authorised staff competent to receive or follow up reports, and that the duty extends to any other information from which the identity may be directly or indirectly deduced. That second limb is where organisations fail: an investigation file that names the three people who could possibly have known a fact has identified the reporting person without disclosing anything.
Article 22 requires that persons concerned by a report fully enjoy the right to an effective remedy and to a fair trial, the presumption of innocence and the rights of defence, including the right to be heard and the right to access their file. Their identity is protected while investigations are ongoing, on the same terms as that of the reporting person. This is not a counterweight to protection but a component of it: an arrangement that treats a report as a finding produces unsafe outcomes, and unsafe outcomes destroy trust in the arrangement faster than inaction does.
Member States must provide effective, proportionate and dissuasive penalties for natural and legal persons who hinder or attempt to hinder reporting, retaliate against protected persons, bring vexatious proceedings against them, or breach the duty of maintaining the confidentiality of the identity of reporting persons. Three of these four behaviours are not about the channel at all; they are about how the organisation treats a person. The vexatious proceedings limb deserves particular attention, because it sanctions the litigation itself, independently of its merits.
A reporting arrangement processes personal data of the reporting person, of the persons concerned and of third parties mentioned, and in a group it usually transfers that data between establishments and sometimes to a third country. Regulation (EU) 2016/679 applies in full and is not displaced by the Directive. Two tensions recur and neither is resolved by a policy statement.
A person named in a report is a data subject and may exercise the right of access. The identity of the reporting person is protected. The arrangement has to be designed so that the access request can be answered without disclosing, directly or by inference, who reported — which is a question of how the file is structured, before it is a question of how the request is answered.
Data that is manifestly not relevant to the handling of a report should not be collected and, where accidentally collected, should be deleted. At the same time the organisation needs a record capable of discharging the burden under Article 21(5). Resolving that tension is a retention design problem, and it is solved per Member State, because retention periods differ.
The Directive protects public disclosure only under conditions, and the European Court of Human Rights supplies the standard against which a national court will read those conditions. In Halet v. Luxembourg, judgment of the Grand Chamber of 14 February 2023, the Court reformulated the criteria for assessing a public disclosure: the availability of alternative channels, the authenticity of the information disclosed, the good faith of the person disclosing it, the public interest in the disclosed information, the detriment caused, and the severity of the sanction imposed.
Two elements of that judgment matter to an employer. The public interest was assessed broadly, extending to conduct that is lawful but ethically questionable, so an organisation cannot rely on the lawfulness of its own conduct as a complete answer. And the Court found a violation of Article 10 of the Convention, which places the sanction imposed on the person, rather than the disclosure itself, at the centre of the assessment.
Directive (EU) 2024/1069 of 11 April 2024, commonly described as the anti-SLAPP Directive, protects persons engaged in public participation, expressly including whistleblowers, against manifestly unfounded claims and abusive court proceedings. Article 22 sets the transposition deadline at 7 May 2026. Together with Article 21(7) and the vexatious proceedings limb of Article 23, it closes the route by which an organisation could answer a report with the cost of litigation.
COM(2024) 269 final is the authoritative account of how the Directive was transposed, and it is not a comfortable one. Only three Member States transposed by the deadline of 17 December 2021. Eight notified complete transposition during 2022 and thirteen during 2023. The Commission opened infringement proceedings against twenty-four Member States in January 2022 and referred six of them to the Court of Justice in March 2023. On 6 March 2025, in Case C-149/23, Commission v Germany, the Court ordered a lump sum of EUR 34 000 000 for failure to transpose; that figure is confirmed from the official source, and figures reported for other Member States rest on a qualified secondary source and are not reproduced here.
| Defect recorded by the Commission | What it means for the protection of a person |
|---|---|
| Personal scope — trainees, volunteers, subcontractors, facilitators | A person who is protected by the Directive may not be protected by the national law that will actually be applied to them |
| Exceptions to confidentiality | Identity may be disclosed in circumstances wider than the Directive contemplates, and without the prior written notice the Directive requires |
| The reversal of the burden of proof | The single provision on which a retaliation claim turns may be transposed narrowly, leaving the person to prove the employer's motive |
| Remedies | The prohibition may exist without an effective route to reinstatement, compensation or interim relief |
| Treatment of anonymous reports — deficient in roughly half of Member States | The route that most European reporting persons in fact use may have no defined treatment at all |
The Commission announced that the evaluation required by Article 27(3) would be delivered no later than 2026. Until then, the operative instrument in any given establishment is the national transposing law, defects included, and a group standard that meets only the Directive will meet less than the strictest of them.
Portugal is the jurisdiction in which this practice is established. Law no. 93/2021 of 20 December has been in force since 18 June 2022, with no transitional provision. It contains a rebuttable presumption of retaliation covering acts taken within two years of the report, and treats a disciplinary sanction imposed within that period as abusive. Fines reach EUR 250 000 for legal persons in the most serious cases.
The honest qualification, which is rarely made, is that the Portuguese presumption does not reproduce the full Article 19 list. Several categories of retaliation therefore remain prohibited without the benefit of the presumption, and a reporting person invoking one of them carries a heavier evidential load than the headline description of the Portuguese regime suggests. The regime is treated in full, in Portuguese, on protecaodedenunciantes.pt.
The problems that reach this practice are not problems of software. They are the residue of decisions never taken: who may know the identity, what a manager may do about a person who has reported, what the organisation will be able to show if that decision is challenged, and what it will do for a person who is exposed. This page maps each recurring problem to the service that addresses it.
| Problem | How it presents | Answer |
|---|---|---|
| A protection standard that stops at the border | A group policy drafted on one national law, applied in Member States whose law demands more | Group Non-Retaliation Standard |
| A personnel decision that cannot be justified | A promotion, transfer or non-renewal affecting a reporting person, with no contemporaneous record of why | Retaliation Risk and Evidence of Decisions |
| Confidentiality that fails by inference | A file written so that only three people could have reported, and everyone knows which three | Confidentiality and Data Protection Design |
| An access request that would expose the reporting person | A person named in a report exercising their rights under the Regulation, with no prepared answer | Confidentiality and Data Protection Design |
| A channel that exists and is never used | Volumes far below any external benchmark, read internally as evidence that nothing is wrong | Trust Programme and Benchmark |
| A person left alone with the consequences | A reporting person facing a process, a hearing or a reference request without independent advice | Support to the Reporting Person |
The fifteen categories of Article 19 have to become operative rules attached to the specific decisions that carry the risk, in language a line manager can apply without reading the Directive.
Every personnel decision affecting a person within the protected window has to leave a record made at the time, by people able to state what they knew and when — because that record is the whole of the defence under Article 21(5).
Who may know the identity, how the file is written, where it is stored, how long it is kept and how an access request is answered are one design problem, not four.
People do not use a channel they do not trust, and trust is produced by observed outcomes rather than by communication campaigns. What the organisation did last time is the only argument that works.
Training on this site addresses protection, not the channel. Its purpose is that a manager should recognise a prohibited measure before taking it, that a designated person should handle a report without destroying the confidentiality on which everything else depends, and that a worker should know what the law actually gives them. Three programmes are offered, each written for a distinct audience and each usable in any Member State, with the applicable transposing law inserted.
For line managers and human resources business partners. The fifteen categories of Article 19 applied to real personnel decisions; what changes about a decision once a report exists; the reversal of the burden of proof under Article 21(5) and what it means for the record they are expected to keep; and the abstention rule when the manager is implicated by the report.
For the persons designated to receive and follow up reports. Confidentiality of identity and the exceptions to it; writing a file that does not identify the reporting person by inference; the rights of the person concerned under Article 22, including the presumption of innocence; the interaction with Regulation (EU) 2016/679 when an access request arrives; and the four sanctionable behaviours of Article 23.
For the whole workforce, delivered in the working language of each establishment. What protection exists and who benefits from it, including trainees, volunteers, contractors and facilitators; what retaliation looks like beyond dismissal; the difference between anonymity and confidentiality; and what the organisation undertakes to do, expressed as commitments rather than as reassurance.
| Format | Description | Suited to |
|---|---|---|
| In person | Session at the establishment, with printed materials in the local working language | Managers and designated persons in one location |
| Remote | Live session by video conference, in English | Groups spread across several Member States |
| Blended | Live session followed by tutored individual work and a written assessment | Designated persons, where evidence of competence is required |
This site addresses two audiences. They arrive with different questions, and the answer that serves one is of limited use to the other. Both, however, ask the same question in the end: whether a person who reports inside this organisation will actually be protected, and whether the organisation could show it.
Groups that have already implemented reporting channels and now face the second half of the obligation. Their question is whether protection built on one national law holds in the others, and what they will be able to prove about a personnel decision taken while a report was open.
Groups established outside the Union whose home-country whistleblowing policy does not meet European protection standards — typically on the categories of retaliation, on the reversal of the burden of proof and on the confidentiality of identity. Their question is one of translation, and their exposure sits in the EU establishment rather than in the parent.
| Category of protected person | Basis | Why it is missed |
|---|---|---|
| Workers in the private and public sectors | Personal scope of the Directive | Rarely missed, and often the only category the policy addresses |
| Former workers and job applicants | Information acquired in a relationship that has ended or not yet begun | References, non-renewals and blacklisting occur after the relationship, when nobody is watching |
| Self-employed, contractors, subcontractors and suppliers | Personal scope extends beyond the employment contract | Termination of a contract for goods or services is an Article 19 category and reads as commercial |
| Shareholders and members of administrative, management and supervisory bodies | Expressly within the personal scope | Assumed to be on the employer's side of the arrangement |
| Volunteers and paid or unpaid trainees | Expressly within the personal scope | Recorded by the Commission as a recurring national transposition deficiency |
| Facilitators and connected third parties | Protected against retaliation in a work-related context | A colleague or relative suffering consequences is rarely recognised as protected at all |
Two references are commonly cited and are reproduced here with their provenance stated. A private benchmark published by NAVEX on 2024 data reports a European median of 0.70 reports per hundred employees against 1.75 in North America, 59 % of reports made anonymously and a substantiation rate of around 48 % of closed cases. The ACFE Report to the Nations 2026, based on 2 402 cases across 143 countries, reports that 43 % of frauds are detected by tip-off, with a median loss per case of USD 104 000 and a median time to detection of twelve months.
The ACFE data carries a further figure that bears directly on protection. Frauds detected within six months correspond to a median loss of USD 40 000, while those lasting more than five years correspond to a median loss of USD 1 100 000. Detection time is therefore the variable that matters most, and detection time is a function of how quickly someone is willing to speak. Every element of protection — confidentiality, non-retaliation, visible outcomes — operates on that willingness.
The European market for whistleblowing is organised around the channel. Platforms are numerous, comparable and deflating in price, and the compliance conversation follows the supply. Protection of the person is the half of the regime that carries the litigation risk, the sanction risk under Article 23 and the entire question of whether the arrangement will ever be used — and it is the half that almost nobody sells, because it cannot be delivered as software.
The support service answers concrete questions that arise while protection is being applied, in a format that does not require commissioning a project for a single question. It is available to organisations under contract and, separately and under the segregation rule, to reporting persons.
A reasoned answer to a specific question on the protection provisions, identifying the article engaged, the transposing law relied on and the degree of confidence in the conclusion.
Assistance when a personnel decision affecting a reporting person is imminent: whether it falls within a category of Article 19, what has to be recorded, and who should take it.
Immediate assistance when identity has been disclosed or may be inferred, covering containment, the notification obligations engaged and the record to be made.
A first orientation for an individual, subject to the conflict check described on the sheet for service PDD·EU·S5 and declined where a conflict exists.
The question is sent to the address dedicated to this domain, with the context and the relevant documents.
Where the question comes from an individual rather than an organisation, the conflict check is performed before any substantive exchange.
The question is qualified, and it is confirmed whether it can be answered in support or requires a separate engagement.
A written answer is issued, with reasoning and identification of the sources consulted.
Question and answer are recorded, giving the organisation a documented history usable as evidence of diligence.
Protection generates administrative obligations that are invisible until they are needed. Nobody counts the protected window; nobody files the note recording why a promotion round excluded a particular name; nobody checks that the retention rule applied in one establishment is the rule that Member State requires. Technical administration takes those tasks off the compliance function, which is the cheapest available protection against a reversed burden of proof.
Tracking, for each identified reporting person, the period during which a detriment will be presumed retaliatory under the applicable national law, with advance alerts before personnel decisions fall due.
Collection and dated filing of the records of personnel decisions taken within the window, in a form capable of being produced to a court or authority.
Maintenance of the record of who was authorised to know the identity, when authorisation was given and on what basis, together with the register of any disclosure and of the prior notice given to the reporting person.
Drafting of the notices the regime requires, including prior written notice of an obligatory disclosure of identity, for issue by the person who holds the function.
| Item | Rule | Note |
|---|---|---|
| Protected window around a reporting person | Fixed by the applicable national law | In Portugal, acts within two years of the report are covered by a rebuttable presumption |
| Contemporaneous record of a personnel decision | Required in substance by Article 21(5) | No period is prescribed; the record must exist at the time of the decision |
| Authorisation to know the identity | Confidentiality duty of the Directive | The register is the only way to demonstrate that circulation was controlled |
| Prior written notice of an obligatory disclosure | Confidentiality duty of the Directive | Given unless it would jeopardise the investigation or proceedings |
| Retention of records relating to reports | National transposition, read with Regulation (EU) 2016/679 | Periods differ between Member States; a group schedule must be capable of applying several |
| Aggregate reporting statistics | Internal governance, and national reporting duties where they exist | The basis for the benchmark measurement in service PDD·EU·S4 |
This repository links only to official sources of the European Union and of the Council of Europe. Where a national transposing law is relevant to an engagement it is read in its own official publication, but this page does not attempt to maintain twenty-seven such links, because a link that goes stale is worse than no link at all. The official text always prevails over any summary presented here, including the summaries on this site.
The protection of a reporting person is not contained in a single instrument. It is assembled from a Directive that sets a minimum, a second Directive that shields against abusive litigation, a Regulation that governs the data, a Convention that constrains the sanction, and twenty-seven national laws that decide what an authority or a court will actually apply.
| Provision | Content | Why it decides outcomes |
|---|---|---|
| Article 2(2) | Minimum harmonisation | A group standard must satisfy the strictest national law it touches, not the Directive alone |
| Article 19 | Fifteen categories of prohibited retaliation | Converts the prohibition into a checklist that can be applied to a decision before it is taken |
| Article 20 | Support measures: information and advice, assistance from competent authorities including certification of status, and legal aid in cross-border proceedings | Financial and psychological assistance are optional for Member States, so real support differs sharply |
| Article 21(2) | No breach of any restriction on disclosure and no liability of any kind | Removes the confidentiality and contractual arguments an employer would otherwise raise |
| Article 21(5) | Detriment presumed to be retaliation; the person who took the measure must show duly justified grounds | The provision on which every retaliation dispute turns |
| Article 21(7) | The report may be relied upon in proceedings for defamation, copyright infringement, breach of trade secrets or data protection, with a right to seek dismissal | Closes the litigation route against the reporting person |
| Article 22 | Protection of the person concerned, including presumption of innocence and confidentiality of identity | An arrangement that treats a report as a finding produces unsafe outcomes and destroys trust |
| Article 23 | Sanctions for hindering reporting, retaliation, vexatious proceedings and breaches of confidentiality | Three of the four sanctionable behaviours concern the treatment of a person, not the channel |
| Instrument | Content | Status |
|---|---|---|
| Directive (EU) 2024/1069 — anti-SLAPP, of 11 April 2024 | Protects persons engaged in public participation, expressly including whistleblowers, against manifestly unfounded claims and abusive court proceedings | Article 22 sets the transposition deadline at 7 May 2026 |
| Regulation (EU) 2016/679 | Governs the processing of personal data in reporting arrangements, including minimisation, retention, the rights of data subjects and transfers to third countries | Applies in parallel with the Directive and is not displaced by it |
| Opinion 1/2006 of the Article 29 Working Party | The historical European reference on internal reporting schemes, on proportionality, minimisation, information of the person concerned and confidentiality | Not binding; its doctrine remains substantially current, and no later European document specifically on group reporting channels was located |
| Article 10 of the European Convention on Human Rights | Freedom of expression, as applied to public disclosure by the European Court of Human Rights | Halet v. Luxembourg, Grand Chamber, 14 February 2023, found a violation of Article 10 |
The Grand Chamber reformulated the criteria for assessing a public disclosure: the availability of alternative channels, the authenticity of the information, the good faith of the person, the public interest in the information disclosed, the detriment caused and the severity of the sanction imposed. Public interest was assessed broadly, extending to conduct that is lawful but ethically questionable.
Twenty-seven transposing laws apply, and the transposing law is the instrument that will be applied. COM(2024) 269 final records the defects that recur across them: the personal scope, in particular trainees, volunteers, subcontractors and facilitators; the exceptions to confidentiality; the reversal of the burden of proof; remedies; and the treatment of anonymous reports, found deficient in roughly half of the Member States. Each of those five defects diminishes the protection of a person rather than the obligations of an organisation, which is why they are easy to overlook from a compliance perspective and decisive from the perspective of whether anyone will speak.
Portugal is the jurisdiction in which this practice is established. Law no. 93/2021 of 20 December has been in force since 18 June 2022 with no transitional provision. It establishes a rebuttable presumption of retaliation for acts taken within two years of the report and presumes abusive a disciplinary sanction imposed within that period, with fines reaching EUR 250 000 for legal persons in the most serious cases. The presumption does not reproduce the full Article 19 list, so several categories remain prohibited retaliation without the benefit of the presumption — a qualification that matters to any person relying on one of them, and one this practice states rather than glosses over. The regime is treated in full, in Portuguese, on protecaodedenunciantes.pt.
Four categories of authority matter to the protection of a reporting person. Two are European, one belongs to the Council of Europe and one is national — and it is the national one that will receive an external report, certify a person's status where national law provides for it, or open a sanctioning file.
The European Court of Human Rights is not an institution of the Union, and its jurisdiction is separate. It nonetheless determines the outer limit of what a Member State may permit an employer to do to a person who discloses information, because a sanction that is disproportionate engages Article 10 of the Convention. Halet v. Luxembourg is the reference on public disclosure, and it is cited on this site for that reason and no other.
A reporting arrangement processes the personal data of the reporting person, of the persons concerned and of third parties mentioned, and in a group it moves that data between establishments. Data protection supervision therefore runs through this regime rather than beside it, and a supervisory authority may examine a reporting arrangement without any report ever having been made.
Each Member State designates the authorities competent to receive external reports, and it is those authorities that Article 20 charges with providing effective assistance to reporting persons, including, where national law provides for it, certification that a person qualifies for protection. Who they are differs profoundly: some Member States created a single dedicated body, others distributed the competence across sectoral regulators, prosecutors and inspectorates.
For a person deciding whether to speak, the practical consequence is that there is no single European address, and no single European standard of support. Identifying the competent authority for the establishment concerned, and establishing what support in fact exists there, is part of every engagement on this site — and it is the first thing done in the support service for reporting persons.
Portugal is named here because it is the jurisdiction in which this practice is established and in which it works daily. No claim of privileged standing before any other national authority is made or implied.
This page links only to official sources and to the sibling sites of the ecosystem. It carries no directory of vendors, associations or commentary, because a curated list of third parties is an implicit endorsement and none is intended.
Nothing in the Directive makes a reporting person undismissable. What changes is the evidential position. Under Article 21(5), once the person establishes that they reported and suffered a detriment, the detriment is presumed to be retaliation and it falls to the organisation to show that the measure rested on duly justified grounds. The question is therefore not whether you may proceed but whether you can prove, from records made at the time, that the selection criteria were fixed and applied without reference to the report — ideally by people who did not know who had reported. If that record does not exist, it cannot be created afterwards with any credibility.
Article 19 lists fifteen categories. They include suspension and dismissal, demotion or withholding of promotion, transfer of duties or change of workplace, reduction in wages or change of working hours, withholding of training, a negative performance assessment or reference, a disciplinary measure or reprimand, coercion, intimidation, harassment or ostracism, discrimination or unfair treatment, failure to convert a temporary contract, non-renewal or early termination of a temporary contract, harm including to reputation and particularly on social media, blacklisting, early termination or cancellation of a contract for goods or services, cancellation of a licence or permit, and referral for psychiatric or medical treatment. Most of these are ordinary management decisions in any other month, which is precisely why they have to be identified in advance.
Both interests are protected and neither answer is automatic. The person concerned has rights under Regulation (EU) 2016/679 and, under Article 22 of the Directive, the presumption of innocence and the rights of defence. The reporting person's identity is protected, and so is any information from which it can be indirectly deduced. The resolution is structural rather than reactive: the file has to be written and segmented so that the substance of the allegation can be disclosed without the source becoming identifiable. Organisations that have not done that work before the request arrives generally find that they cannot answer it without either breaching one duty or the other.
It is more likely a measurement of silence than of integrity. A private benchmark published by NAVEX on 2024 data reports a European median of 0.70 reports per hundred employees against 1.75 in North America, and 59 % of European reports made anonymously. Against the ACFE Report to the Nations 2026, which finds that 43 % of frauds are detected by tip-off with a median time to detection of twelve months, an unused channel is not an absence of wrongdoing but an absence of detection. The usual causes are identifiable: no anonymous route, a channel reachable only from inside the corporate network, and no visible outcome from anything previously reported.
Usually not, for three reasons. The categories of prohibited retaliation in Article 19 are wider than those in most non-European policies. The reversal of the burden of proof in Article 21(5) has no equivalent in many home-country frameworks, and it is the provision that determines the outcome of a dispute. And Article 2(2) makes the Directive a minimum that Member States may exceed, so a single global standard has to be raised to the strictest national law in the group's European footprint rather than set at the level of the home country. A separate issue arises where the global system transfers the personal data of reporting persons to a third country.
Under the Directive, yes. The personal scope extends to self-employed persons, shareholders and members of administrative, management and supervisory bodies, volunteers and paid or unpaid trainees, and persons working under the supervision of contractors, subcontractors and suppliers, as well as to former workers and to job applicants. It also reaches facilitators and connected third parties. The qualification worth making is that COM(2024) 269 final records the personal scope as a recurring transposition defect, singling out exactly these categories, so the national law applied in a given Member State may be narrower than the Directive. A group standard should follow the Directive rather than the narrowest national law it encounters.
The Directive does not impose that obligation on the employer. Article 20 places the support obligations on Member States: free and publicly accessible independent information and advice, effective assistance from competent authorities including certification of the person's status where national law provides for it, and legal aid in cross-border criminal and civil proceedings. Financial and psychological assistance are matters that Member States may provide, not must. What actually exists therefore differs sharply between Member States, and an organisation that tells its people they will be supported should first establish what support exists where they work.
It is the worst available response. Article 21(2) provides that a person who reports in accordance with the Directive does not breach any restriction on disclosure and incurs no liability of any kind. Article 21(7) allows the report to be relied upon in proceedings for defamation, copyright infringement, breach of trade secrets or breach of data protection rules, with a right to seek dismissal of the case. Article 23 requires Member States to sanction the bringing of vexatious proceedings against reporting persons — that is, the litigation is itself sanctionable, independently of its merits. Directive (EU) 2024/1069, to be transposed by 7 May 2026, adds a further layer of protection against abusive proceedings.
Not by reason of the outcome. Protection depends on whether the person had reasonable grounds to believe that the information reported was true at the time of reporting and that it fell within the scope of the Directive — not on whether the allegation was ultimately substantiated. A private benchmark reports a substantiation rate of around 48 % of closed cases, which means that roughly half of all reports made in good faith do not result in a finding. An organisation that treats non-substantiation as bad faith will receive no further reports, and may find itself sanctioned under Article 23 for the measures it takes.
Public disclosure is protected only under conditions, and those conditions are read against the case law of the European Court of Human Rights. In Halet v. Luxembourg, judgment of the Grand Chamber of 14 February 2023, the Court reformulated the criteria: the availability of alternative channels, the authenticity of the information, the good faith of the person, the public interest in the information, the detriment caused and the severity of the sanction imposed. Public interest was assessed broadly, extending to conduct that is lawful but ethically questionable, and the Court found a violation of Article 10 of the Convention. Two of the six criteria are within the organisation's control before anything happens: whether an internal channel was genuinely available, and how severely it responds afterwards.
The five services below have one object: the protection of the people who report, across the Member States in which an organisation operates. They do not concern the titularity of the whistleblowing function, which is held under contract through whistleblowingofficer.eu, nor the investigation of an individual report, which is a distinct function with its own site. Four of them are delivered to organisations. The fifth is delivered to reporting persons, under a segregation rule that is stated in full on its sheet and applied without exception.
| Service | Reference | Engagement type | Indicative timescale |
|---|---|---|---|
| Group Non-Retaliation Standard | PDD·EU·S1 | Project, with annual review | 25 to 40 working days, depending on the number of Member States |
| Retaliation Risk and Evidence of Decisions | PDD·EU·S2 | Project, with monitoring during the protected window | 15 to 25 working days for the assessment; monitoring for the agreed period |
| Confidentiality and Data Protection Design | PDD·EU·S3 | Project, with review on material change | 20 to 30 working days |
| Trust Programme and Benchmark | PDD·EU·S4 | Programme, with measurement at the start and after twelve months | Initial diagnosis in 15 to 20 working days; programme over twelve months |
| Support to the Reporting Person | PDD·EU·S5 | Engagement with the individual, with an express segregation rule | First response within two working days; duration according to the matter |
One protection standard that holds in every Member State where the group operates.
Most group policies on whistleblower protection are written on one national law — usually that of the parent — and then translated. Because Article 2(2) makes the Directive a minimum that Member States may exceed, a standard built that way is not uniform protection; it is the protection of one jurisdiction imposed on others, adequate where the national law demands less and deficient where it demands more. This service builds the standard in the opposite direction: from the fifteen categories of Article 19 outwards, raised to the strictest requirement encountered in the group's actual footprint, and expressed as rules attached to the decisions that carry the risk.
The deliverable is not a statement of values. It is an instrument that tells a line manager in each Member State what they may and may not do about a person who has reported, what has to be recorded when they do it, and who decides when they are unsure.
Establish every establishment, its Member State, its headcount and its sector, and identify the categories of protected persons present in each.
Read the applicable transposing laws on the provisions that determine protection, and identify the strictest requirement for each element of the standard.
Produce the standard and its national annexes, expressed as operative rules rather than as principles.
Attach the rules to the existing personnel processes and to the instruments that govern them, so that the standard operates where decisions are actually taken.
Review with the compliance, human resources and legal functions, and record the points on which local qualified advice was obtained or is required.
Assessment of exposure, and the contemporaneous record the burden of proof will require.
Article 21(5) means that an organisation's defence exists, or does not exist, before any dispute begins. Once the reporting person shows a report and a detriment, the detriment is presumed to be retaliation and the organisation must prove that the measure rested on duly justified grounds. A justification produced after the allegation has very little weight, because it was written by people who knew what they needed to prove.
This service does two things. It assesses, around each identified reporting person, which decisions are pending or foreseeable and which of them fall within the categories of Article 19. And it installs the discipline by which those decisions are recorded at the time, by decision-makers who can state what they knew and when — which, properly designed, means decision-makers who did not know the identity of the reporting person at all.
Identify the protected persons in scope, including facilitators and connected third parties, and the period during which each is exposed.
Map pending and foreseeable decisions against the categories of Article 19 and assess the exposure of each.
Establish who knows the identity, restrict that knowledge, and separate it from the people who take personnel decisions.
Install the recording protocol and test it against decisions actually taken.
Review at agreed intervals during the window, recording what was decided and what evidence exists.
The identity of the reporting person, designed against the exceptions that defeat it.
Confidentiality fails in three ways, and none of them is a disclosure. It fails by inference, when a file is written so that the reporting person can be deduced from its contents. It fails by circulation, when the information reaches people who were never authorised. And it fails by collision, when a person named in a report exercises the right of access under Regulation (EU) 2016/679 and the organisation has no prepared way of answering without exposing who reported.
This service designs the reporting arrangement so that those three failures are structurally difficult rather than merely prohibited: who may know, how the file is written and segmented, where data sits and moves within the group, how long each element is retained under which national rule, and how a data subject request is answered before one arrives.
Establish what data the arrangement collects, who touches it, where it is stored and where it moves, including group and vendor access.
Assess the arrangement against the Regulation on lawful basis, minimisation, retention, roles and transfers, and against the confidentiality duty of the Directive.
Fix the authorisation model, the file structure and the drafting conventions, and resolve the access-against-identity collision in advance.
Produce the retention schedule, the request response model and the disclosure procedure.
Test the design against a simulated access request and a simulated disclosure obligation.
The channel that exists and is never used, measured against an external reference.
A reporting arrangement with no reports is usually presented internally as a good sign. It is more often a measurement of silence. The available external reference — a private benchmark published by NAVEX on 2024 data — reports a European median of 0.70 reports per hundred employees against 1.75 in North America, with 59 % of reports made anonymously. Measured against it, a great many European arrangements are receiving a fraction of what comparable organisations receive, and the difference is a matter of design rather than of national temperament.
This programme establishes where the organisation stands against that reference, identifies the specific reasons its people do not speak — fear of identification, absence of an anonymous route, no visible outcome from previous reports, a channel reachable only from inside the corporate network — and works on those reasons over twelve months, with a second measurement at the end.
Measure reporting activity per establishment and per hundred employees, and place it against the external reference.
Examine the arrangement for the barriers that suppress reporting, and run an anonymous perception survey of the workforce.
Fix the actions that address the barriers actually found, including anonymous routes, external accessibility and feedback discipline.
Support the programme over twelve months, with the organisation retaining ownership of each action.
Repeat the baseline measurement and report the variation with an honest account of what can and cannot be attributed to the programme.
Independent support to the individual, under a strict conflict-of-interest refusal rule.
Article 20 requires Member States to make available comprehensive and independent information and advice, free of charge and easily accessible, effective assistance from competent authorities including, where national law provides for it, certification that the person qualifies for protection, and legal aid in cross-border criminal and civil proceedings. Member States may, but need not, add financial and psychological assistance. What actually exists therefore differs sharply between Member States, and a person who has reported frequently discovers that at the worst possible moment.
This service supports the individual: understanding what protection applies where they work, what the applicable transposing law provides, what Article 21 will require them to establish and what the organisation will have to prove, how to preserve evidence, and where the public support required by Article 20 is actually located in their Member State.
Before anything else, verify that no engagement exists, or has existed, with the employer concerned or any entity of its group. If one does, the matter is declined.
Establish the facts, the timeline, what was reported, through which route, and what has happened since.
Determine which protections apply under the transposing law of the Member State concerned, and which do not.
Work through what the person holds, what should be preserved and what should be requested while it still exists.
Identify the public support available under Article 20 and the point at which legal representation is required.
Audiqcer, Lda. is the entity responsible for this website and for the services presented on it. You may write to the address dedicated to this domain, which routes directly to the team assigned to this practice, or use the general institutional contacts.
Parque Tecnológico de Moura, Apartado 45, 7860-909 Moura, Portugal
Moura · Lisboa
A short description of the entity, its headcount, the Member States concerned and the service required. The reply sets out scope, timescales and terms.
Technical clarification on the Directive, on national transposition in a given Member State, or on the content of this website.
Access to the support service for entities under contract, routed to the assigned engagement manager.
This page summarises the processing of personal data associated with the use of protecaodedenunciantes.eu. The full policy, containing the information required by Articles 13 and 14 of the General Data Protection Regulation, is available on the compliance platform of the responsible entity.
Audiqcer — Auditing, Quality & Certification Services, Lda., VAT identification number PT515234583, with registered office at Parque Tecnológico de Moura, Apartado 45, 7860-909 Moura, Portugal. Contact for data protection matters: info@audiqcer.com.
| Category | Purpose | Lawful basis |
|---|---|---|
| Contact data submitted voluntarily | Responding to requests for information, proposals or support | Steps prior to entering into a contract, and performance of a contract |
| Strictly necessary browsing data | Operation and security of the website | Legitimate interest in information security |
| Aggregate audience measurement | Assessing the performance of the website | Consent, where applicable |
Contact data is retained for as long as necessary to reply and, where a contractual relationship exists, for the applicable statutory retention periods. Browsing data is retained only for the technically necessary period.
This website follows a minimal-cookie policy. No behavioural advertising or profiling cookies are used, and no non-essential cookie is set before the visitor has expressed a choice.
| Category | Purpose | Consent required |
|---|---|---|
| Strictly necessary | Operation, security and session preferences | No |
| Aggregate audience measurement | Visit counting without individual identification | Yes |
| Advertising and profiling | Not used on this website | Not applicable |
Preferences may be changed at any time through browser settings, including blocking and deleting cookies already set. Blocking strictly necessary cookies may affect how the website works.
This legal notice identifies the entity responsible for the website and discharges the information duties applicable to information society service providers.
| Item | Information |
|---|---|
| Corporate name | Audiqcer — Auditing, Quality & Certification Services, Lda. |
| VAT identification number | PT515234583 |
| Registered office | Parque Tecnológico de Moura, Apartado 45, 7860-909 Moura, Portugal |
| Offices | Moura · Lisboa |
| Telephone | (+351) 285 107 010 |
| Institutional e-mail | info@audiqcer.com |
| E-mail for this website | secretariado@protecaodedenunciantes.eu |
| Institutional website | www.audiqcer.com |
| Domain | protecaodedenunciantes.eu |
| Associated extensions | protecaodedenunciantes.eu |
| Nature of the website | Informational website presenting professional services |
| Publishing technology | Static website, deployed on Cloudflare Pages |
| Version | 1.0 |
| Version date | 27 August 2026 |
The regulatory information on this website is provided for information purposes and does not constitute legal advice. References to legislation point to official sources, which prevail over any summary presented here. Applying a regime to a specific case requires individual assessment, and national transposition differs between Member States.
Original content on this website belongs to Audiqcer, Lda.. Legislative texts cited are in the public domain and reproduction refers to the respective official source.
This page brings together the visual identity elements of the website, for consistent use across digital and communication materials. Every element is vector-based and designed to work in light and dark themes, as well as in monochrome reproduction.
Solid-ground mark for the vector favicon; the 🛡️ emoji serves as tab identifier in preview builds.
| Role | Typeface | Use |
|---|---|---|
| Display | Instrument Serif | Page titles, section headings and featured figures |
| Body | Public Sans | Running text, lists, tables and navigation |
| Labels and codes | IBM Plex Mono | Eyebrows, service codes, references and metadata |
This website is version 1.0 and is ready to publish as it stands. This page records, transparently, what the current version covers and what has been identified for version 2.0, so that the site evolves by plan rather than by improvisation.
A structured page per Member State recording the personal scope as transposed, any presumption of retaliation and its duration, the remedies available including interim relief, and the sanctions for retaliation and for breach of confidentiality. Each entry requires verification against the official national publication, which is why nothing partial appears in version 1.0.
Article 20 requires information and advice, assistance from competent authorities and legal aid, and permits but does not require financial and psychological assistance. A register of what each Member State in fact provides, with the body responsible, would be the single most useful thing this site could publish for an individual, and it requires a standing commitment to keep it current.
The operative rules produced under service PDD·EU·S1, generalised into publishable models with adaptation notes and with the choices that belong to the organisation identified. It requires a prior decision on how much of the methodology is published.
A documented response model for an access request by a person named in a report, with the file structure that makes such a response possible. It is the most frequently asked question on this site's subject matter and the least well answered anywhere.
Directive (EU) 2024/1069 must be transposed by 7 May 2026 into twenty-seven procedural systems. A tracker recording each transposition and the remedies it creates for whistleblowers would have direct practical value, and cannot be written before the transpositions exist.
German, French, Spanish and Italian versions of the core pages. Translation must be legal-technical rather than literal, because the terminology of each transposing law differs from that of the Directive, and protection is exactly the area where an approximate translation misleads.
The services on this site are priced in proposal. Publishing a named price, in particular for the support service to individuals, would remove a barrier for the people least able to negotiate one. It requires a prior decision by the principal on positioning.
Client references, anonymised engagement summaries and activity indicators, each subject to express authorisation and to verification. No element of this nature has been assumed in version 1.0, and none may be assumed in a practice whose subject matter is confidentiality.
Contact and proposal forms routing to the address dedicated to this domain, and a distinct route for reporting persons that performs the conflict check before any substantive exchange and carries the processing information required by Articles 13 and 14 of the Regulation.
The lump sum imposed on Germany in Case C-149/23 is confirmed from the official source. Figures reported for other Member States rest on a qualified secondary source and are deliberately not reproduced here. They should be verified against the official judgments before any use.