I need to bring my Luxembourg organisation into compliance with recital 102 of Whistleblowing (UE 2019/1937). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Recital 102 Whistleblowing — Recital 102

EU frameworkGDPR NIS 2 DORA AI ActWhistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 102

Directive on the protection of persons who report breaches of Union law · UE 2019/1937

(102)

Criminal, civil or administrative penalties are necessary to ensure the effectiveness of the rules on whistleblower protection. Penalties against those who take retaliatory or other adverse actions against reporting persons can discourage further such actions. Penalties against persons who report or publicly disclose information on breaches which is demonstrated to be knowingly false are also necessary to deter further malicious reporting and preserve the credibility of the system. The proportionality of such penalties should ensure that they do not have a dissuasive effect on potential whistleblowers.

Luxembourg specificity

loi luxembourgeoise du 16 mai 2023 relative a la protection des lanceurs d'alerte

In Luxembourg, the Law of 16 May 2023 on the protection of whistleblowers implements recital 102 through a precise criminal scale: fines of EUR 1,250 to 25,000 against anyone obstructing a report, exercising retaliation or breaching confidentiality, doubled in case of recidivism (up to EUR 50,000). Knowingly false reports also expose to criminal sanctions and an obligation of full civil compensation for the damage caused. The OFRS, CNPD, CSSF, ITM, CAA and ILR may each refer matters to the public prosecutor according to their sector of competence.

Luxgap practice: systematically log the date and content of each report in a tamper-proof timestamped register, and keep evidence of the whistleblower's good faith (sources consulted, reasonable grounds) for 10 years to neutralise any sanction action for allegedly false reporting.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Recital 102 imposes a dual sanction regime: punish retaliation AND punish bad-faith reporting, without deterring genuine whistleblowers. In practice, the OFRS and ITM sanction employers who have no internal disciplinary regime for retaliation (manager demoting, HR blocking a promotion, colleagues isolating). Conversely, many organisations overreact and threaten any reporter whose alert turns out to be unfounded, which itself constitutes a prohibited indirect retaliation.

The proportionality test: 3 categories your internal policy must distinguish

Good-faith but erroneous reporting: no sanction possible. A whistleblower who is mistaken remains protected as long as they had reasonable grounds to believe the facts were true at the time of reporting.
Knowingly false reporting (proven bad faith): disciplinary and criminal sanctions possible. The burden of proof lies with the employer, who must demonstrate knowledge of falsity at the time of reporting.
Direct or indirect retaliation: civil sanctions (compensation), disciplinary (up to dismissal of the wrongdoing manager) and criminal. Includes subtle measures: exclusion from meetings, removal of files, degraded evaluation without objective justification.

How Luxgap automates this risk

Our Luxgap Retaliation Sentinel turns the abstract non-retaliation promise into automatic detection of weak signals, within the 12 months following each report. The tool cross-references your HR data (Workday, Sopra HR Suite, SD Worx), your Active Directory logs (access revocation, manager change, exit from Teams groups) and your evaluation cycles to spot any statistically abnormal adverse measure targeting an identified whistleblower.

Automatically detects post-report treatment gaps: drop in evaluation rating, salary freeze, removal of responsibilities, unsolicited mobility, within a 24-month window.
Generates a pre-built defence file for the employer, demonstrating the absence of a causal link between report and HR measure, opposable before the ITM and the Labour Court.
Calculates a retaliation probability score based on statistical comparison with a cohort of employees with equivalent profiles who are not whistleblowers.
Alerts the DPO and ethics officer in real time as soon as an adverse HR action affects a protected whistleblower, before the measure is notified.
Produces a timestamped register of characterised bad-faith reports, with proof of prior knowledge of falsity, opposable in disciplinary litigation.
Documents the proportionality of each internal sanction considered, comparing the measure against Luxembourg and European case-law benchmarks.

Available as a complement to a Luxgap DPO or CISO mandate or as a dedicated SaaS brick depending on your scope. Request a personalised quote and our teams will prepare a demonstration on your real HR cycle, with a free 48-hour blind audit to measure your exposure to retaliation litigation before any engagement.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 102

They trust us

Before we chat