How to comply with article 7 of Whistleblowing?

Question

I need to bring my Luxembourg organisation into compliance with article 7 of Whistleblowing (UE 2019/1937). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Accepted Answer

The classic trapArticle 7 looks simple: favour the internal channel. The trap is not there but in paragraph 3, which requires entities to provide appropriate information about the existence and use of internal channels. In practice, many Luxembourg organisations open an inbox or a form, then forget to communicate it clearly to staff, contractors, trainees and candidates. The result: the whistleblower goes straight to the OFRS or the press, the entity loses internal control of the case and exposes itself to a finding of non-compliance. The OFRS and sector authorities (CSSF, CNPD, ITM) precisely check that the information is accessible, readable and up to date.Why a poorly communicated internal channel backfiresThe logic of Article 7(2) is clear: internal reporting is encouraged only when the breach can be addressed effectively internally and without risk of retaliation. If you cannot prove that the channel was known and functional, you cannot blame the whistleblower for bypassing it. Recurring control points:Is the information on the internal channel published and easily accessible (intranet, contract, posting, website)?Does it describe the exact procedure, the 7-day acknowledgement deadline and the 3-month feedback deadline?Does it also mention the external OFRS and sector channel, as required by Article 7(3)?Is it available to non-employees (contractors, suppliers, candidates, former employees)?Does it guarantee confidentiality of the whistleblower's identity from first contact?Is it dated and versioned to demonstrate regular updates?How Luxgap automates this riskOur Luxgap Whistleblowing Channel Guard makes the phantom internal channel scenario impossible: it deploys an encrypted, traceable and compliant reporting channel, and above all it continuously proves that the Article 7(3) information is effectively distributed. The tool connects to your M365 / SharePoint intranet, your public website and your Sage BOB 50 or Workday HR to verify that every affected population (employees, contractors, candidates) actually has access to the up-to-date procedure.Automatically scans your M365 intranet and public website to confirm the presence of an accessible and current reporting page.Generates the Article 7(3) information notice prefilled, broken down by audience: employees, Odoo contractors, candidates, former employees.Timestamps each acknowledgement within 7 days and each feedback within 3 months, with automatic reminders before deadlines.Alerts in real time on Teams whenever a report comes in, while preserving the confidentiality of the whistleblower's identity.Detects communication breaks (deleted page, broken link, obsolete version) through continuous hourly checks.Produces a timestamped PDF report enforceable before the OFRS, demonstrating that the internal channel was known, accessible and functional.Available as a complement to a Luxgap DPO or CISO mandate or as a dedicated SaaS module depending on your scope. Request a personalised quote and...

Reporting through internal reporting channels

They trust us

Before we chat