How to comply with article 13 of Whistleblowing?

Question

I need to bring my Luxembourg organisation into compliance with article 13 of Whistleblowing (UE 2019/1937). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Accepted Answer

The classic trapArticle 13 primarily targets external authorities (in Luxembourg the OFRS, the CSSF, the CNPD, the ITM), but it sets the transparency standard every reporting channel must display. The trap for companies subject to the internal channel obligation: copy-pasting a generic policy that fails to state the feedback timeframe, the confidentiality regime, or the link with the GDPR (Articles 5 and 13). During an ITM inspection or a retaliation dispute, incomplete or hard-to-find information on the intranet is enough to break the good-faith presumption of the scheme and to expose the employer to Luxembourg criminal penalties.The information your reporting channel must publish without errorThe conditions for qualifying for protection (status of the reporting person, scope of covered breaches).The exact channel contact details, indicating whether phone conversations are recorded.The feedback timeframe (acknowledgement within 7 days, feedback within a reasonable period not exceeding 3 months).The confidentiality regime and personal data processing, linked to GDPR Articles 5 and 13 and Article 17 of the Directive.The nature of the follow-up provided and the remedies against retaliation.The statement on non-liability for a breach of confidentiality covered by Article 21(2).How Luxgap automates this riskOur Luxgap Whistleblowing Notice Builder makes it impossible to publish an incomplete reporting policy: it generates and keeps the dedicated section up to date, article by article, and synchronises it between your M365 SharePoint intranet and your public website. The tool cross-references your processing register, your actual handling timeframes and the applicable legal references to produce an enforceable text, never a frozen template that goes stale.Generates the full reporting page covering the eight points of Article 13, split between the internal channel and referral to the OFRS, CSSF, CNPD or ITM depending on the domain.Continuously checks the presence of the confidentiality regime and the GDPR Articles 5 and 13 notice, and alerts on Teams whenever a mandatory section is missing.Calculates and displays the actual timeframes (acknowledgement within 7 days, feedback within 3 months) by syncing with your case management tool.Automatically publishes the dedicated section on SharePoint and your public website, and archives every modified version.Produces a time-stamped PDF report, enforceable before the ITM or OFRS during an inspection, proving the scheme's transparency at a given date.Available as a complement to a Luxgap DPO or CISO mandate or as a dedicated SaaS module depending on your scope. Request a personalised quote and our teams will prepare a demonstration on your actual scheme, with a free blind audit within 48h to measure your exposure before any commitment.

Information regarding the receipt of reports and their follow-up

They trust us

Before we chat