How does the EU Whistleblowing Directive protect whistleblowers?

The new EU-wide whistleblowing directive takes action in December 2021. It requires organisations of certain size to offer stakeholders an electronic way to report misconducts without compromising their anonymity. Last time we focused on what the directive means for organisations and in this blog post we'll be looking at the protective measures the new directive offers for whistleblowers as well as what is said about the requirements of being entitled for this protection.

Protective measures and the scope of the directive

The directive lists that whistleblowers shall be protected in the EU from both direct and indirect retaliation. Examples of direct retaliation include dismissal, wage cuts and bullying, whereas protection against indirect retaliation means that the protective measures also cover e.g. the relatives of the whistleblower who are employed by the same company.

The whistleblowers are entitled for the protective measures if they have reasonable grounds to believe that the information they provided was accurate at the time it was reported and falls within the scope of the directive. The scope covers areas such as:

  • Employee and worker treatment and contracts that are in conflict with the union legislation and the law
  • Finance related; e.g. taxes, corruption & potential fraud cases
  • Equal treatment of tenders & prevention of nepotism in selection of new partners for the business
  • Food safety and overall safety of employees and other stakeholders interacting with the company
  • And any other areas of the business that includes people, animals, products/ services

Three tier system for whistleblowing

Besides the content of the report being accurate and in line with the directive, the protection is also conditional on the use of a three-tier notification system:

  • Tier 1: Internal whistleblowing channel
  • Tier 2: External whistleblowing channel offered by authority
  • Tier 3: Going to the public (e.g. via news outlets)

This three-tier system requires that the whistleblowing report is first made to the employer through an internal notification channel, secondly through an external notification channel offered by a competent authority, and finally the information can be made public. The idea of the system is that if appropriate actions have not been taken within a reasonable time (notice of arrival within seven days and feedback within three months) in the previous tier, the whistleblower is entitled to use the next tier of the system. Contrarily, if the whistleblower would report their findings straight to the authority or the public, they might not be entitled for the protective measures as the system wasn't followed.

There are also exceptions to this system. One example of this could be that the whistleblower notices something that is a threat to the physical safety of the public and can't reasonably trust that the necessary actions are taken in Tier 1 or Tier 2 before the risk of something severe happening becomes too high. In that case the whistleblowers would be entitled for the protective measures even though they would jump to Tier 3 of the system and go straight to the public. Another example would be a case where the nature of the report is severe and strictly linked to people in leading roles in the organisation or closely linked to the investigation of whistleblowing cases, so that there would be a high risk of entanglement. In that case the whistleblower could go straight to Tier 2 and report to authority.


New call-to-actionFinal thoughts

The main idea of the new directive is to offer protection to whistleblowers so that critical wrongdoings can be reported without the fear of being penalised for taking action.

The protective measures offer protection from both direct and indirect retaliation, but there are also requirements that need to be followed by the whistleblower in order to be entitled for this protection.

We will continue the whistleblowing topic in our next blog post, where we'll talk more about the anonymity of whistleblowing channels and how one can determine if a whistleblowing channel is confidential.


If you're looking for an electronic whistleblowing channel that is in line with the new directive, ticks all the boxes for anonymity, enables real dialogue, has built-in investigation features and more, have a look at our Whistleblowing module and contact us for more information!

We are building the world's first operational involvement platform. Our mission is to make the process of finding, sharing, fixing and learning from issues and observations as easy as thinking about them and as rewarding as being remembered for them.‍

By doing this, we are making work more meaningful for all parties involved.

More information at

Related posts

What does the EU Whistleblowing directive mean for organisations?

The new EU Whistleblowing directive was entered into action in December 2019, and with it started...

3 min read

How to determine if a Whistleblowing channel is confidential?

“Confidentiality is the essence of being trusted.”- Billy Graham

The new EU-wide whistleblowing...

5 min read

Whistleblower protection: What types of reports are covered?

The European Union’s (EU) Whistleblower Directive welcomes a new chapter for the protection of...

5 min read

Involve your stakeholders to report

At Falcony, we create solutions that multiply the amount of observations and enable our customers to gain greater understanding of what’s going on in their organisations, areas of responsibility and processes.