I need to bring my Luxembourg organisation into compliance with recital 110 of Whistleblowing (UE 2019/1937). What are the concrete requirements, the sanctions, and how can Luxgap support me?

The classic trapThis recital recalls that the European Data Protection Supervisor was consulted before the directive was adopted. In practice, it signals to organisations that the whistleblowing scheme is inseparable from GDPR: any reporting channel processes ultra-sensitive personal data (whistleblower identity, identity of accused persons, alleged facts). The Luxembourg CNPD and OFRS regularly sanction schemes that forget the prior DPIA, the Article 30 record, the information of data subjects or the legal basis of processing.The GDPR reflexes to embed in any reporting channelCarry out a mandatory DPIA before going live (high-risk processing on the CNPD list).Document the legal basis: legal obligation (Art. 6.1.c GDPR) for the internal channel imposed by the law of 16 May 2023, legitimate interest for optional features.Define distinct retention periods: report with no follow-up (2 months after closure), report leading to investigation (up to 5 years after the last action), judicial proceedings (until prescription).Frame the rights of accused persons: deferred information as long as it would compromise the investigation (Art. 14.5.b GDPR), without ever disclosing the whistleblower's identity.Check data localisation: a SaaS channel hosted in the US without post-Schrems II standard contractual clauses and TIA is an immediate flaw.Restrict access to the designated reporting officer only, with cryptographic logging of every consultation.How Luxgap automates this riskOur Luxgap Whistleblowing Privacy Shield ensures that no reporting channel deployed in your organisation becomes a GDPR time bomb. The tool connects your reporting platform (Whispli, EQS, Signalex, internal form) to your Article 30 record, your DPIA mapping and your Active Directory to materialise in real time the cross-compliance of directive 2019/1937 and GDPR.Automatically generates the Article 35 DPIA pre-filled according to the CNPD template, integrating the specific risks of whistleblowing (re-identification, retaliation, leak).Detects abnormal access to a report file (off-hours consultation, non-corporate IP, mass download) and alerts the DPO via Teams within 5 minutes.Classifies each piece of collected data according to its sensitivity and automatically applies the regulatory retention period with cryptographic purge at expiry.Verifies the actual location of the SaaS provider's servers and produces the TIA enforceable in case of transfer outside the EU.Produces a timestamped and signed PDF report, enforceable before the CNPD and OFRS, demonstrating cross-compliance with GDPR and the law of 16 May 2023.Available as a complement to a Luxgap DPO mandate or as a dedicated SaaS brick depending on your scope. Request your demonstration and our teams will carry out a free blank audit of your current reporting channel within 48h to measure your GDPR exposure before any engagement.

Recital 110 Whistleblowing — Recital 110

EU frameworkGDPR NIS 2 DORA AI ActWhistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 110

Directive on the protection of persons who report breaches of Union law · UE 2019/1937

(110)

The European Data Protection Supervisor was consulted in accordance with Article 28(2) of Regulation (EC) No 45/2001,

Luxembourg specificity

loi luxembourgeoise du 16 mai 2023 relative a la protection des lanceurs d'alerte, combinee a la loi du 1er aout 2018

In Luxembourg, the law of 1 August 2018 on the protection of natural persons with regard to the processing of personal data and the GDPR apply in full to the whistleblowing processing framed by the law of 16 May 2023. The CNPD has published a specific position requiring a prior DPIA for any reporting channel, and coordinates its inspections with the OFRS when the report involves a personal data leak.

Luxgap practice: set up a written coordination protocol between the reporting officer, the DPO and the CISO, formalising who notifies the CNPD within 72h if a data breach occurs in the reporting channel itself.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

This recital recalls that the European Data Protection Supervisor was consulted before the directive was adopted. In practice, it signals to organisations that the whistleblowing scheme is inseparable from GDPR: any reporting channel processes ultra-sensitive personal data (whistleblower identity, identity of accused persons, alleged facts). The Luxembourg CNPD and OFRS regularly sanction schemes that forget the prior DPIA, the Article 30 record, the information of data subjects or the legal basis of processing.

The GDPR reflexes to embed in any reporting channel

Carry out a mandatory DPIA before going live (high-risk processing on the CNPD list).
Document the legal basis: legal obligation (Art. 6.1.c GDPR) for the internal channel imposed by the law of 16 May 2023, legitimate interest for optional features.
Define distinct retention periods: report with no follow-up (2 months after closure), report leading to investigation (up to 5 years after the last action), judicial proceedings (until prescription).
Frame the rights of accused persons: deferred information as long as it would compromise the investigation (Art. 14.5.b GDPR), without ever disclosing the whistleblower's identity.
Check data localisation: a SaaS channel hosted in the US without post-Schrems II standard contractual clauses and TIA is an immediate flaw.
Restrict access to the designated reporting officer only, with cryptographic logging of every consultation.

How Luxgap automates this risk

Our Luxgap Whistleblowing Privacy Shield ensures that no reporting channel deployed in your organisation becomes a GDPR time bomb. The tool connects your reporting platform (Whispli, EQS, Signalex, internal form) to your Article 30 record, your DPIA mapping and your Active Directory to materialise in real time the cross-compliance of directive 2019/1937 and GDPR.

Automatically generates the Article 35 DPIA pre-filled according to the CNPD template, integrating the specific risks of whistleblowing (re-identification, retaliation, leak).
Detects abnormal access to a report file (off-hours consultation, non-corporate IP, mass download) and alerts the DPO via Teams within 5 minutes.
Classifies each piece of collected data according to its sensitivity and automatically applies the regulatory retention period with cryptographic purge at expiry.
Verifies the actual location of the SaaS provider's servers and produces the TIA enforceable in case of transfer outside the EU.
Produces a timestamped and signed PDF report, enforceable before the CNPD and OFRS, demonstrating cross-compliance with GDPR and the law of 16 May 2023.

Available as a complement to a Luxgap DPO mandate or as a dedicated SaaS brick depending on your scope. Request your demonstration and our teams will carry out a free blank audit of your current reporting channel within 48h to measure your GDPR exposure before any engagement.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 110

They trust us

Before we chat