I need to bring my Luxembourg organisation into compliance with recital 109 of Whistleblowing (UE 2019/1937). What are the concrete requirements, the sanctions, and how can Luxgap support me?

The classic trapRecital 109 reminds organisations that whistleblowing schemes must reconcile freedom of expression, data protection, freedom to conduct a business and the rights of defence of the person concerned. In practice, OFRS and CNPD sanction schemes that favour one right at the expense of the others: blanket confidentiality that prevents the accused person from exercising defence rights, or conversely excessive transparency that exposes the whistleblower. The classic mistake is to copy an Anglo-Saxon hotline without performing the balancing exercise required by the Charter.Concrete trade-offs to document in your schemeFreedom of expression vs defamation: protection covers good-faith reporting, not malicious denunciation; the admissibility analysis must trace this.Rights of defence of the reported person: inform the accused as soon as possible without compromising the investigation (Article 17 of the Luxembourg law of 16 May 2023, aligned with Article 14 GDPR).Data protection: minimisation of collected data, retention limited to the investigation period, Article 6(1)(c) GDPR legal basis for in-scope entities.Freedom to conduct a business: the scheme must not become a tool for competitive smearing or internal blackmail; provide for an admissibility filter.Effective remedy: for both the whistleblower (OFRS, labour courts) and the reported person (access, rectification, contestation).Good administration: controlled deadlines (7-day acknowledgement, 3-month feedback), traceability of decisions.How Luxgap automates this riskOur Luxgap Rights Balancer turns the abstract balancing of fundamental rights into an enforceable decision grid, executed at every stage of a report's lifecycle. The tool analyses each incoming alert via a specialised LLM agent that automatically qualifies the rights in tension (expression, data, defence, business) and proposes the documented balancing exercise required by the Charter and CJEU case law.Classifies each incoming report according to the fundamental rights at stake and generates a timestamped balancing record, ready to produce before OFRS, CNPD or labour courts.Automatically detects passages of a report that require pseudonymisation before being shared with the accused person, without masking the elements essential to the rights of defence.Generates Article 14 GDPR notifications to the reported person, with automatic calculation of the appropriate timing (after evidence is secured, before decision).Alerts in real time when a report shifts from the protected whistleblower regime to the malicious denunciation regime (good-faith filters, cross-checks with known hierarchical conflicts).Produces a cryptographically sealed PDF dossier demonstrating, for each alert, that the six rights of recital 109 have been examined and balanced.Available as a complement to a Luxgap DPO mandate or as a standalone SaaS module depending on your scope. Request a tailored quote and our team will prepare a demonstration on an anonymis...

Recital 109 Whistleblowing — Recital 109

EU frameworkGDPR NIS 2 DORA AI ActWhistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 109

Directive on the protection of persons who report breaches of Union law · UE 2019/1937

(109)

This Directive respects fundamental rights and the principles recognised in particular by the Charter, in particular Article 11 thereof. Accordingly, it is essential that this Directive be implemented in accordance with those rights and principles by ensuring full respect for, inter alia, freedom of expression and information, the right to protection of personal data, the freedom to conduct a business, the right to a high level of consumer protection, the right to a high level of human health protection, the right to a high level of environmental protection, the right to good administration, the right to an effective remedy and the rights of defence.

Luxembourg specificity

loi luxembourgeoise du 16 mai 2023 relative a la protection des lanceurs d'alerte

In Luxembourg, the law of 16 May 2023 on the protection of whistleblowers translates the balance of recital 109 into precise operational obligations: information of the reported person (Article 17), reinforced confidentiality of the whistleblower's identity (Article 18), and the possibility of reporting to OFRS as the transversal external authority, or to sectoral authorities (CSSF, CNPD, ITM, CAA, ILR). The obligation threshold is 50 employees (no threshold for public bodies) and criminal sanctions range from EUR 1,250 to EUR 25,000, doubled in case of recidivism.

Luxgap practice: systematically document the balancing of fundamental rights in your alert register, because during an inspection OFRS and CNPD require written proof that defence rights have been respected on equal footing with whistleblower confidentiality.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Recital 109 reminds organisations that whistleblowing schemes must reconcile freedom of expression, data protection, freedom to conduct a business and the rights of defence of the person concerned. In practice, OFRS and CNPD sanction schemes that favour one right at the expense of the others: blanket confidentiality that prevents the accused person from exercising defence rights, or conversely excessive transparency that exposes the whistleblower. The classic mistake is to copy an Anglo-Saxon hotline without performing the balancing exercise required by the Charter.

Concrete trade-offs to document in your scheme

Freedom of expression vs defamation: protection covers good-faith reporting, not malicious denunciation; the admissibility analysis must trace this.
Rights of defence of the reported person: inform the accused as soon as possible without compromising the investigation (Article 17 of the Luxembourg law of 16 May 2023, aligned with Article 14 GDPR).
Data protection: minimisation of collected data, retention limited to the investigation period, Article 6(1)(c) GDPR legal basis for in-scope entities.
Freedom to conduct a business: the scheme must not become a tool for competitive smearing or internal blackmail; provide for an admissibility filter.
Effective remedy: for both the whistleblower (OFRS, labour courts) and the reported person (access, rectification, contestation).
Good administration: controlled deadlines (7-day acknowledgement, 3-month feedback), traceability of decisions.

How Luxgap automates this risk

Our Luxgap Rights Balancer turns the abstract balancing of fundamental rights into an enforceable decision grid, executed at every stage of a report's lifecycle. The tool analyses each incoming alert via a specialised LLM agent that automatically qualifies the rights in tension (expression, data, defence, business) and proposes the documented balancing exercise required by the Charter and CJEU case law.

Classifies each incoming report according to the fundamental rights at stake and generates a timestamped balancing record, ready to produce before OFRS, CNPD or labour courts.
Automatically detects passages of a report that require pseudonymisation before being shared with the accused person, without masking the elements essential to the rights of defence.
Generates Article 14 GDPR notifications to the reported person, with automatic calculation of the appropriate timing (after evidence is secured, before decision).
Alerts in real time when a report shifts from the protected whistleblower regime to the malicious denunciation regime (good-faith filters, cross-checks with known hierarchical conflicts).
Produces a cryptographically sealed PDF dossier demonstrating, for each alert, that the six rights of recital 109 have been examined and balanced.

Available as a complement to a Luxgap DPO mandate or as a standalone SaaS module depending on your scope. Request a tailored quote and our team will prepare a demonstration on an anonymised real case, with a free 48-hour blind audit of your existing whistleblowing scheme to measure your exposure before any commitment.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 109

They trust us

Before we chat