How to comply with article 22 of Whistleblowing?

Question

I need to bring my Luxembourg organisation into compliance with article 22 of Whistleblowing (UE 2019/1937). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Accepted Answer

The classic trapArticle 22 protects the person concerned by the report, not just the whistleblower. This is the blind spot of most internal schemes: organisations carefully protect the whistleblower's confidentiality but forget that the accused person enjoys the presumption of innocence, the rights of defence and protection of their identity for as long as the investigation is ongoing. In Luxembourg, the OFRS and sectoral authorities (CSSF, CNPD, ITM) sanction precisely identity leaks and one-sided investigations conducted without a fair audit trail, and the CNPD remains competent on the personal data protection of the person concerned.The compliance gaps that trigger sanctionsDisclosing the identity of the accused person beyond the strict circle of authorised investigators, in breach of Article 22(2).Failing to notify the person concerned and to hear them before closing the internal investigation (right to be heard).Keeping non-pseudonymised data in the reporting register accessible to unauthorised persons.Neglecting the presumption of innocence by recording unsubstantiated incriminating conclusions.Failing to log who accessed the file, when, and on what basis, making it impossible to prove fair treatment.Confusing the protection period for the whistleblower's identity with that of the person concerned, whereas Article 22(3) extends the same guarantees to both.How Luxgap automates this riskOur Luxgap Whistleblowing Shield makes it impossible to leak the identity of the person concerned and turns every internal investigation into a fair, defensible file. The tool integrates natively with your reporting platform, your M365 and your Active Directory to automatically pseudonymise any identity from the moment it is entered, and logs every access to the file in a sealed register.Automatically pseudonymises the identity of the whistleblower AND the person concerned from the moment the report is created, applying the same guarantees as Articles 12, 17 and 18.Restricts file access to the sole circle of authorised investigators via Active Directory groups, and blocks any sharing outside the permitted M365 perimeter.Generates and timestamps the right-to-be-heard notification sent to the person concerned, with acknowledgement of receipt kept as evidence.Detects in real time any undocumented incriminating conclusion and alerts the DPO on Teams to safeguard the presumption of innocence.Calculates the identity protection period indexed on the investigation status and lifts pseudonymisation only upon its compliant closure.Produces a timestamped, cryptographically sealed PDF report, enforceable before the OFRS, the CSSF or the CNPD, demonstrating respect for the rights of defence.Available as a complement to a Luxgap DPO or CISO mandate or as a dedicated SaaS module depending on your scope. Request a personalised quote and our teams will prepare a demonstration on your real perimeter, with a free blank audit within 48h to measure your exposure before any comm...

Measures for the protection of persons concerned

They trust us

Before we chat