How to comply with whistleblower regulations in the private sector

Companies have to set up an internal reporting channel so that employees can report breaches related to things like public procurement, environmental protection, privacy, public health and anti-money laundering. As soon as your company has more than 50 employees, you have to set up such a channel. If your organisation has more than 250 employees, then it must also be possible to make such a report in complete anonymity.

What does this mean in practical terms?

• Appointment of a neutral report manager: the report manager is the contact person for whistleblowers and informs them about what the action being taken as a consequence of their report
• Employee training: employees must be informed about the reporting procedure and know how to pass on information without fear of reprisal. Employees who are involved in dealing with reports must also be trained with regard to the purpose of the legislation and the duty of confidentiality that they have to maintain
• Drawing up of internal rules: draw up internal rules where employees are informed about the contents of the legislation and the protection that they receive as well as possible action that they can take (internal report, external report or public disclosure)
• Maintaining a register of reports: every report received must be registered internally
• Organising an internal investigation: whenever someone does blow the whistle on something, you should be able to respond quickly to the reported incident and conduct a thorough investigation to confirm or refute the allegations
• Protection from reprisal: a whistleblower is protected from reprisal, in the form of dismissal, negative performance reviews or other forms of punishment. People reporting infringements are protected on condition that, at the time of making their report, they had reasonable grounds to believe that the report was true. This protection also extend to anyone connected to the reporter.

When does the legislation take effect?

The law comes into force on 15th February 2023. Companies with more than 50 employees and less than 250 employees have a period of grace until 17 December 2023 (unless certain exceptional sectors).

We advise you in any case to prepare your company for the introduction of the reporting channel. This can be done in-house, but it can also be outsourced.

Sanctions in the event of non-compliance

Companies that fail to comply with the above obligations regarding internal reporting, its registration and follow-up may face administrative penalties ranging from € 2,400 to € 24,000. Criminal sanctions are also possible.

Whistleblowers who do fall victim to reprisals are entitled to compensation ranging between 18 and 26 weeks’ pay. This compensation cannot be combined with any compensation for unfair dismissal. If the employee is not salaried, the compensation is set at the actual loss suffered.