Whistleblower channel, the Luxembourg law of 16 May 2023.
The Luxembourg law of 16 May 2023 transposes EU directive 2019/1937 and requires any Luxembourg organisation (public or private) with more than 50 employées to set up a confidential internal alert channel, separate from regular HR channels.
Law contents
All 29 articles, in the order of the official text. Each one is analysed separately, with the official text and Luxgap practical guidance.
- 1. Purpose
- 2. Material scope
- 3. Relationship with other Union acts and national provisions
- 4. Personal scope
- 5. Definitions
- 6. Conditions for protection of reporting persons
- 7. Reporting through internal reporting channels
- 8. Obligation to establish internal reporting channels
- 9. Procedures for internal reporting and follow-up
- 10. Reporting through external reporting channels
- 11. Obligation to establish external reporting channels and to follow up on reports
- 12. Design of external reporting channels
- 13. Information regarding the receipt of reports and their follow-up
- 14. Review of the procedures by competent authorities
- 19. Prohibition of retaliation
- 20. Measures of support
- 21. Measures for protection against retaliation
- 22. Measures for the protection of persons concerned
- 23. Penalties
- 24. No waiver of rights and remedies
Annexes
Who is concerned?
Any organisation, public or private, headquartered or with an establishment in Luxembourg and employing 50 employées or more. For public bodies, no threshold applies.
Key obligations
- Set up a confidential internal alert channel accessible to employées, former employées, applicants, subcontractors, shareholders, executives, volunteers, interns.
- Designate a responsible person or unit with independence and confidentiality guarantees.
- Acknowledge the report within 7 days, provide feedback within 3 months.
- Protect whistleblowers from retaliation: dismissal, transfer, disciplinary action, harassment, etc.
- Document each report (GDPR-compliant) and retain evidence proportionately.
Deadlines
The law has been in force since 21 May 2023. All concerned organisations must already have their alert channel in place. Inspections are conducted by the Whistleblower Office created by the same law.
Sanctions for non-compliance
Criminal sanctions: fines of €1,250 to €25,000 for lacking a channel, obstruction, or retaliation. Doubled in case of repeat offence. Civil sanctions: compensation of the whistleblower victim of retaliation.
How Luxgap helps
The whistleblower channel is part of the optional scope of our DPO mandate. We handle: alert procédure drafting, internal charter, secure technical channel, partial or full outsourcing of the responsible-person rôle, manager training, annual reporting.
Let's discuss your situation.
This topic is handled case by case. Get in touch to discuss it: reply within one business day, no commitment.
Contact us →
