Whistleblower channel, the Luxembourg law of 16 May 2023.

Who is concerned?

Any organisation, public or private, headquartered or with an establishment in Luxembourg and employing 50 employees or more. For public bodies, no threshold applies.

Key obligations

• Set up a confidential internal alert channel accessible to employees, former employees, applicants, subcontractors, shareholders, executives, volunteers, interns.
• Designate a responsible person or unit with independence and confidentiality guarantees.
• Acknowledge the report within 7 days, provide feedback within 3 months.
• Protect whistleblowers from retaliation: dismissal, transfer, disciplinary action, harassment, etc.
• Document each report (GDPR-compliant) and retain evidence proportionately.

Deadlines

The law has been in force since 21 May 2023. All concerned organisations must already have their alert channel in place. Inspections are conducted by the Whistleblower Office created by the same law.

Sanctions for non-compliance

Criminal sanctions: fines of €1,250 to €25,000 for lacking a channel, obstruction, or retaliation. Doubled in case of repeat offence. Civil sanctions: compensation of the whistleblower victim of retaliation.

How Luxgap helps

The whistleblower channel is part of the optional scope of our DPO mandate. We handle: alert procedure drafting, internal charter, secure technical channel, partial or full outsourcing of the responsible-person role, manager training, annual reporting.