How to comply with article 16 of Whistleblowing?

Question

I need to bring my Luxembourg organisation into compliance with article 16 of Whistleblowing (UE 2019/1937). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Accepted Answer

The classic trapThe duty of confidentiality under Article 16 is the hardest obligation to uphold in practice, because identity leaks are rarely intentional: they come from a poorly partitioned channel, a shared Excel file, a forwarded email or an overly broad HR access. In Luxembourg, both the Office for Reception of Reports (OFRS) and the CNPD (for the personal data aspect) sanction the absence of real partitioning: if an unauthorised person can deduce, even indirectly, the identity of the reporting person, the organisation is at fault. Criminal fines can reach 25,000 EUR (doubled on repeat offence), on top of civil compensation owed to a retaliated reporting person.The confidentiality breaches authorities trackA reporting channel hosted on a generic mailbox readable by several unauthorised staff members.Revealing metadata: timestamps, IP addresses, access badges, logs cross-referencing report date and physical presence.A disclosure under the paragraph 2 derogation (investigation, judicial proceeding) without prior written notice to the reporting person nor explanation of the reasons.Reuse of trade secrets received in a report for purposes unrelated to follow-up, breaching paragraph 4.A vague, untracked list of authorised staff, never reviewed when internal moves occur.The absence of proof that only authorised persons accessed the file.How Luxgap automates this riskOur Luxgap Whistleblower Vault makes accidental identity disclosure technically impossible by isolating each report in an end-to-end encrypted vault, where only named authorised staff hold a key. The tool integrates with your Active Directory, M365 and your HRIS (Sopra Steria HR Suite, Workday LU) to enforce strict partitioning and log every access in an unalterable manner.Encrypts each report file and makes it unreadable to any account outside the authorised list synchronised from Active Directory.Detects and neutralises revealing metadata (IP, precise timestamps, technical identifiers) before any internal sharing.Logs every consultation in a timestamped, tamper-proof manner and alerts on Teams in real time whenever an unauthorised access is attempted.Automatically generates the prior written notice to the reporting person required by Article 16(3) in case of a derogatory disclosure, with the explanation of reasons.Tags and traces trade secrets received to prevent any reuse beyond follow-up, in line with Article 16(4).Produces a timestamped, sealed PDF report, enforceable before the OFRS and the CNPD, proving the confidentiality chain was never broken.Available as a complement to a Luxgap DPO or CISO mandate or as a dedicated SaaS brick depending on your scope. Request a tailored quote and our teams prepare a demonstration on your real setup, with a free blank audit within 48h to measure your exposure before any commitment.

Duty of confidentiality

They trust us

Before we chat