I need to bring my Luxembourg organisation into compliance with recital 104 of Whistleblowing (UE 2019/1937). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Recital 104 Whistleblowing — Recital 104

EU frameworkGDPR NIS 2 DORA AI ActWhistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 104

Directive on the protection of persons who report breaches of Union law · UE 2019/1937

(104)

This Directive introduces minimum standards and it should be possible for Member States to introduce or maintain provisions which are more favourable to the reporting person, provided that such provisions do not interfere with the measures for the protection of persons concerned. The transposition of this Directive should, under no circumstances, provide grounds for reducing the level of protection already granted to reporting persons under national law in the areas to which it applies.

Luxembourg specificity

loi luxembourgeoise du 16 mai 2023 relative a la protection des lanceurs d'alerte

In Luxembourg, the law of 16 May 2023 on the protection of whistleblowers strictly applies the non-regression principle of recital 104: it removes no prior sectoral protection (CSSF circular 12/552 for PFS, specific CAA regime, labour code protections against unfair dismissal). The 50-employee threshold triggers the internal channel obligation, with no threshold for public bodies, and criminal sanctions range from 1 250 to 25 000 EUR (doubled in case of recidivism) cumulative with civil indemnification.

Luxgap practice: systematically audit your scheme against the three overlapping layers (LU law 16 May 2023 + applicable sectoral regime + collective agreement) before any go-live, because the most favourable layer prevails before the labour court.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Many Luxembourg organisations transpose Directive 2019/1937 by sticking strictly to the EU text, forgetting that the law of 16 May 2023 and certain sector-specific rules (CSSF, CAA, CNPD) already offer a higher level of protection. Recital 104 explicitly prohibits any levelling down: an internal policy that restricts rights already recognised under Luxembourg law or a collective bargaining agreement would be unenforceable and would expose the employer to civil indemnification claims before labour courts, not to mention the risk of an OFRS report.

Concrete pitfalls to audit in your procedures

Internal policy narrower than LU law on the scope of protected persons (subcontractors, interns, former employees, candidates: all covered by the 16 May 2023 law).
Processing deadlines longer than those set by national law or the applicable collective bargaining agreement.
Pre-existing confidentiality or NDA clauses that restrict the ability to report, even though article 21 of the LU law neutralises them.
Removal of historically available reporting channels (HR mailbox, internal mediator) on the pretext of having set up the formal directive channel.
Internal disciplinary procedures more severe against the reporting person than those applicable before transposition.
Lack of articulation with CSSF (circular 12/552), CAA or labour code sector regimes that already offer specific protections.

How Luxgap automates this risk

Our Luxgap Whistleblowing Floor Guard ensures that your internal scheme never lowers the protection floor already acquired by your employees under Luxembourg law, sectoral collective bargaining agreements and the specialised CSSF/CAA/CNPD regimes. The tool continuously maps your effective protection baseline by cross-referencing your Odoo HR internal regulations, your signed collective agreements, your SharePoint HR policies and the LU legal repositories updated monthly, without asking the DPO or compliance officer to maintain a manual matrix.

Automatically detects any clause in a new internal policy, ethics charter or code of conduct that would be less protective than the 16 May 2023 law or the applicable collective agreement.
Compares your scheme in real time to overlapping sectoral regimes (CSSF circular 12/552 for PFS, CAA regime for insurers, Luxembourg labour code) and flags regression zones.
Instantly alerts the DPO and compliance officer via Teams or Slack whenever an internal policy update risks breaching the non-regression clause of recital 104.
Generates a timestamped compliance report, enforceable before OFRS and ITM during an inspection, demonstrating that your scheme respects the national floor.
Tracks LU and European legislative developments and automatically notifies the adjustments to integrate into your internal procedures.
Produces an annual comparison directive 2019/1937 vs LU law 16 May 2023 vs your policy ready to present to the audit committee or board of directors.

Available as a complement to a Luxgap DPO or CISO mandate or as a dedicated SaaS module depending on your scope. Request a personalised quote and our teams will prepare a demonstration on your actual scheme, with a free 48-hour blank audit to measure your exposure before any engagement.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 104

They trust us

Before we chat