How to comply with article 15 of Whistleblowing?

Question

I need to bring my Luxembourg organisation into compliance with article 15 of Whistleblowing (UE 2019/1937). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Accepted Answer

The classic trapArticle 15 is the most misunderstood link in the framework. Many organisations believe that any leak to the press strips the whistleblower of protection. That is wrong: if the company takes no appropriate action within the deadlines (3 months after an internal report, or the external authority timeframe), the public disclosure becomes protected. What the OFRS and courts sanction is not the disclosure itself, but the employer inaction that made it legitimate, plus any subsequent retaliation. The lack of traceability of internal handling is the number one aggravating factor.The three doors that make a public disclosure protectedA whistleblower keeps protection as soon as a single condition is met. Your defence is to close the first door, because it is the only one you control.Door 1, inaction: an internal or external report was already made but no appropriate action was taken within the legal timeframe (3 months internally). If you acknowledge receipt within 7 days and provide reasoned feedback within 3 months, this door stays shut.Door 2, imminent danger: an emergency situation or risk of irreversible damage to the public interest. You cannot prevent it, but fast remediation reduces its materiality.Door 3, risk of retaliation or concealment: evidence that may be destroyed, an authority in collusion. A credible and impartial internal channel reduces the perception of this risk.Beware of paragraph 2: direct disclosure to the press under freedom of expression rules falls entirely outside this article. You can neither condition it nor sanction it.How Luxgap automates this riskOur Luxgap Whistleblower Deadline Sentinel makes crossing Door 1 impossible by managing every report down to the day and timestamping every action. The tool connects to your internal channel, your M365 mailbox and your ticketing system (Jira, ServiceNow, Odoo Helpdesk) to rebuild the full handling timeline, without any officer having to maintain a spreadsheet.Automatically launches the legal countdowns as soon as a report enters: acknowledgement within 7 days, reasoned feedback within 3 months in line with Article 9.Alerts the officer and management on Teams or Slack at D-15, D-7 and D-1 before each deadline, so no appropriate measure is forgotten.Qualifies each case against the three doors of Article 15 and flags those tipping towards a risk of protected public disclosure.Generates an encrypted and timestamped handling log, demonstrating that appropriate measures were taken within deadlines, enforceable before the OFRS during an inspection.Detects signs of potential retaliation (role change, downgraded appraisal, revoked access) by cross-referencing your HRIS and Active Directory after a report.Available as a complement to a Luxgap DPO or CISO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your real reporting channel, with a free blank audit within 48h to measure your exposu...

Public disclosures

They trust us

Before we chat