I need to bring my Luxembourg organisation into compliance with recital 25 of Whistleblowing (UE 2019/1937). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Recital 25 Whistleblowing — Recital 25

EU frameworkGDPR NIS 2 DORA AI ActWhistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 25

Directive on the protection of persons who report breaches of Union law · UE 2019/1937

(25)

This Directive should also be without prejudice to the protection of classified information which Union law or the laws, regulations or administrative provisions in force in the Member State concerned require, for security reasons, to be protected from unauthorised access. Moreover, this Directive should not affect the obligations arising from Council Decision 2013/488/EU (33) or Commission Decision (EU, Euratom) 2015/444 (34).

Luxembourg specificity

loi luxembourgeoise du 16 mai 2023 relative a la protection des personnes qui signalent des violations du droit

In Luxembourg, the law of 16 May 2023 on whistleblower protection requires an internal channel from 50 employees (no threshold for public bodies), acknowledgement within 7 days and reasoned feedback within 3 months. OFRS is the cross-sectoral external authority, but for matters involving national security or classified information, the Luxembourg National Security Authority (ANS) remains competent for the physical and logical protection of classified documents, in parallel with the reporting channel.

Luxgap practice: segregate your internal channel into two distinct flows by design, one for ordinary reports handled by your compliance officer, the other for reports involving classified information, handled only by ANS-cleared personnel and hosted at a Luxembourg sovereign provider.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Recital 25 reminds organisations that whistleblower protection does not override the regime applicable to classified information. In practice, any entity handling EU RESTRICTED, EU CONFIDENTIAL or nationally classified documents (defence, sensitive public procurement, NATO subcontracting, services for sovereign ministries) must design its internal reporting channel with segregation in mind from day one. The Luxembourg OFRS and sectoral authorities (CSSF, CNPD, ITM) sanction both the absence of a channel and the leak of classified data through a poorly segregated channel, and the directors' criminal liability can be triggered on defence secrecy or reinforced business secrecy grounds.

Concrete traps for the internal channel

A good-faith whistleblower attaches a document marked EU RESTRICTED to the web form, which is hosted on a non-cleared SaaS.
The case handler (often the DPO or compliance officer) does not hold the required security clearance to read the content.
The channel logs (who, when, what) may themselves be classified and cannot sit on just any hosting provider.
Export of the file to OFRS or the competent authority must follow Decision 2013/488/EU rules (transport, marking, acknowledgement), not a plain encrypted email.
The whistleblower's right to feedback within 3 months (Luxembourg law of 16 May 2023) must be reconciled with the need not to disclose classified elements in that feedback.

How Luxgap automates this risk

Our Luxgap Whistleblowing Vault is a sovereign reporting channel that automatically detects the presence of classified information in an incoming alert and routes the file to an isolated processing path, before the handler even opens the document. The analysis engine reads markings (EU RESTRICTED, EU CONFIDENTIAL, LIMITED DISTRIBUTION, NATO stamps) via OCR and header detection, cross-checks against the handler clearance database pulled from your AD or Workday LU directory, and instantly redirects to a vault hosted at LuxConnect or eBRC depending on the required level.

Detects European and national classification markings in attachments (PDF, Word, scanned images) at the moment of submission, with no prior human intervention.
Verifies the designated handler's clearance via AD or Workday integration before any access to the file, and blocks opening if clearance is insufficient or expired.
Hosts sensitive reports on Luxembourg sovereign infrastructure (LuxConnect, eBRC) with end-to-end encryption and timestamped, court-admissible logging.
Automatically generates the transmission cover note to OFRS compliant with Decision 2013/488/EU, including marking, registration number and acknowledgement.
Produces a quarterly anonymised report demonstrating compliance with the 7-day (acknowledgement) and 3-month (feedback) deadlines imposed by the Luxembourg law of 16 May 2023, admissible in ITM or OFRS inspections.
Alerts the CISO in real time if a report contains a marking incompatible with the channel's clearance level, with a routing recommendation.

Available as a complement to a Luxgap DPO or CISO mandate or as a dedicated SaaS brick depending on your scope. Request a demonstration and our teams will prepare a free 48h blank audit of your current setup to identify possible leaks of classified information before any engagement.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 25

They trust us

Before we chat