All you need to know about whistleblowing.

✅ No gatekeeping or whitepapers where we ask for your email.

Get guided by NorthWhistle’s Knowledge Center along with continuously updated information that focuses on what you need to know about the EU whistleblowing directive and what whistleblowing means for your company.

full guide

What is whistleblowing today?

Get all the insight into what whistleblowing is and what it means for your organisation today and tomorrow.

full guide

What is the EU Whistleblowing directive?

Get to know the background of the EU Whistleblowing directive and how it affects you today, and tomorrow.

well protected

Everything about security at NorthWhistle

Read about our total commitment to security and how we work on keeping your data and people safe and anonymous.

Weekly posts from our experts


The EU Whistleblowing directive

What is the main purpose of the Directive?

Most member nations already have laws that address whistleblowing and protect the person who discloses information. However, these laws often differ from each other in terms of effectiveness, creating challenges for dealing with international businesses and making sure nations continue to work together efficiently. The purpose of the Directive is to protect and enable whistleblowers from all EU nations to raise concerns anonymously without the fear of retaliation. 

What’s new and what does it mean for my company?

As of December 17th, 2021, the Directive has broadened its reach. It now applies to local communities with more than 10,000 residents, all public or private organizations with more than 250 employees, organizations working in finance regardless of size, and organisations subject to AML/TF legislation such as law firms, accountants, notaries, and casinos. As of December 17th, 2023, any organization with more than 50 employees will also be required to implement a whistleblower program. Companies may need to work with local labour councils or unions to develop internal whistleblower procedures to ensure collaboration with external whistleblower channels to ensure they are compliant. 

Why is Whistleblower protection needed at EU level?

Whistleblower protection at the EU level can help identify, prevent, and deter corruption, fraud, and other criminal activities that affect the financial interest of the EU. The protection offered to whistleblowers can be vastly different from country to country. Some EU members have comprehensive laws while others have fewer or less robust rules, which can negatively impact the functioning of other EU policies and undermine the market. For example, while many countries already have whistleblower protection, some states only cover sectors such as corruption and the public sector, making protections across the EU inadequate.  

What sort of wrongdoings can whistleblowers report on?

Whistleblowers are given protection by the Directive when they report wrongdoings in the following areas: public health, food safety, animal health and welfare, consumer protection, transport safety, product safety, environmental protection, nuclear safety, terrorist financing, public procurement, anti-money laundering and financial services, and privacy and personal data. The Directive also applies to breaches of Union competition rules, potential harm to the EU’s financial interests, and arrangements that lead to tax advantages and go against existing corporate tax laws.  

Other channels have become less viable. Using a call centre means speaking to a person who will likely ask in-depth questions, which can reduce the whistleblower’s confidence in disclosing information. Reports made by phone are steadily decreasing and make it difficult to provide support after the disclosure is made. Using an ombudsperson allows you to have a legal expert on hand, but there may be a lack of trust or assurance of anonymity, which can stop potential whistleblowers from disclosing. An anonymous mailbox makes following up with the whistleblower nearly impossible and does not comply with the EU directive.

What is a ‘qualifying’ disclosure?

Some disclosures are known as ‘qualifying disclosures’. Qualifying disclosures are any disclosed wrongdoings where the employee believes that they are acting in the public’s best interest and a failure is currently happening, took place in the past, or is likely to happen if nothing is done. These failures can include damage to the environment, a breach of a legal obligation, a criminal offence a danger to the health or safety of a person or a group of people, or a deliberate cover-up of information which indicates any of these failures. 

What type of protection can whistleblowers receive?

The EU Directive provides protection to whistleblowers during legal proceedings about the disclosure of information. The rules are meant to protect whistleblowers from retaliation and charges when they disclose information that is legally protected. The Directive provides financial assistance such as covering legal fees and costs for whistleblowers who win their cases. Whistleblowers are also given remedial measures against retaliation such as workplace harassment or firing. 

Are the rights of the accused person or organisation protected?

The Directive is intended to protect whistleblowers and safeguard the public interest. Malicious whistleblowing is discouraged, and the person or organisation accused of wrongdoing is presumed innocent until proven otherwise. Accused persons and organisations have the right to receive a fair trial and defend themselves. Some EU members have introduced dissuasive penalties for making malicious or abusive disclosures. 

Are confidentiality clauses protected under the EU Directive?

No. The whistleblower who meets the threshold for protection is no longer bound by a confidentiality clause. You cannot bind employees to confidentiality clauses or legally pursue them for breaching such agreements if they have disclosed wrongdoing through official channels. 

What is the difference between a regulation and a directive?

A regulation applies to each of the EU member states and is carried out the same way across the EU, although there may be some small differences in the way nations interpret the legislation. On the other hand, a directive sets a minimum standard that must be implemented within national laws. There may be significant differences across EU member states in the way these laws are implemented and interpreted. 

What are the economic benefits of whistleblower protection?

A study conducted by the EU commission in 2017 estimated whistleblower protection can save member nations between 5.6 and 9.6 billion euros annually. Results show that the cost of setting up and maintaining whistleblower protection is much lower in comparison with the potential benefits. For example, in the Netherlands for every euro invested there is a potential gain of 22 to 37 euros. Ireland and Romania also have very high favourable ratios. While the economic benefits vary from state to state, all nations see economic benefits when they implement whistleblower protection. That said, stakeholder consultations and more elaborate reporting channels can increase the cost, but also lead to a more effective system. 


What are the consequences of not having a strong whistleblower program in place?

The consequences of having weak whistleblower protection are that private workers become reluctant to report wrongdoing, levels of tax evasion and criminal activity increase, and working conditions begin to decline. In the public sector, workers become reluctant to report wrongdoings, and their well-being is negatively impacted. It can also have a negative impact on public trust as well as the company’s financial interests. Supporting whistleblowing is also key to ensuring your organisation maintains its Environmental, Social, and Governance credentials

What is the best reporting channel for private companies?

The best reporting channel for private companies is using a digital whistleblowing system. If done right these systems have the advantage of ensuring confidentiality and are available at any time of the day, which reduces costs and makes the channel more accessible to employees. In many cases a digital system also allows the whistleblower to share documents or images easily while maintaining anonymity. With NorthWhistle all data is 100% anonymized.

Other channels have become less viable. Using a call centre means speaking to a person who will likely ask in-depth questions, which can reduce the whistleblower’s confidence in disclosing information. Reports made by phone are steadily decreasing and make it difficult to provide support after the disclosure is made. Using an ombudsperson allows you to have a legal expert on hand, but there may be a lack of trust or assurance of anonymity, which can stop potential whistleblowers from disclosing. An anonymous mailbox makes following up with the whistleblower nearly impossible and does not comply with the EU directive.

Does it matter how the disclosed information was obtained?

The way information is disclosed is less important than the way the organisation responds to the disclosure. When internal channels fail to properly respond to disclosures, external channels may be used for bringing attention to misconduct. Whistleblowing should be encouraged internally if the organisation’s actions may lead to serious or considerable harm to others and if the employee has reported their concerns to a direct supervisor and no action has been taken. This can be done through a variety of internal or external channels but acting on disclosures early can help mitigate the risk to the public, financial stakeholders, and the organisation’s reputation. 

Should there be specialized training for employees to teach them how to handle and process reports?

Yes, whistleblowing awareness is important, and specialized training can help you create a ‘speak up’ culture. Compliance training is one of your best instruments for reducing the risk of wrongdoing in your organisation. A specialized training program for employees will allow you to share information about regulations, guidelines, and internal procedures for whistleblowing. It will also make it easier for people to navigate the requirements of the whistleblowing process and understand what they should and shouldn’t be disclosing. This will have a positive impact on your business outcomes and create a safer healthier workplace for employees. 

Who should be receiving whistleblowing reports?

A whistleblowing report should be received by an independent individual within the organisation who is not subject to pressure or influence by management. This may include a member of the auditing firm or financial oversight committee, a person from a dedicated department that handles internal investigations of misconduct, or an independent advice centre. A report should also be made to oversight authorities when a breach is confirmed. 

What type of concerns can be reported through a Whistleblowing channel?

Allegations of fraud, corruption, professional misconduct or unethical behaviour can be reported through your whistleblowing channel. Concerns regarding questionable business practices, as well as any non-compliance regarding company policies or the law observed, should also be reported. 

Should anonymous disclosures be allowed?

Yes. Anonymity can help you ensure the success of your whistleblower policy. When you allow employees to disclose anonymously, this increases confidence in reporting concerns. You may however find that some employees disclose irrelevant issues. These should be re-directed. Your whistleblowing program should insist on employees sharing information about alleged perpetrators, the location of the incident, the names of any other employees who were involved, as well as specific amounts or details involved, and any evidence the employee has collected. When organisations required whistleblowers to disclose their identity, they receive very few complaints or begin to receive anonymous complaints externally since employees no longer use internal channels. 

What happens if my organisation doesn’t have effective reporting channels in place?

Ideally, an employee should have the option to first report information about wrongdoings internally to his/her direct supervisor. If no action is taken or there is no internal channel, the whistleblower can choose to disclose to external authorities. This may also happen when internal channels did not function properly due to a fear of retaliation, concerns about confidentiality, the implication of management in the breach, or concealment or destruction of evidence. The EU Directive provides direction for reporting incidents to national or European authorities. In some circumstances, whistleblowers may choose to report the incident to the media if nothing is done. Acting quickly on complaints is essential.