The classic trap
Recital 27 extends protection to professionals bound by professional secrecy (chartered accountants, statutory auditors, tax advisors, notaries, engineers, architects, consultants) when they report a breach. In practice, many Luxembourg firms argue that the disclosure violates their professional rules and trigger a disciplinary procedure or a dismissal for gross misconduct. This is exactly what the OFRS and the ITM scrutinise first: a disciplinary sanction disguised as retaliation is presumed unlawful when the reporting was necessary to reveal the breach.
The necessity test: what the OFRS will check
Protection is not automatic. It requires that the disclosure of information covered by professional secrecy was necessary to reveal the breach. Concretely, the whistleblower (and the employer) must be able to demonstrate:
- That the disclosed information is directly linked to the reported breach, and not an ancillary piece of information covered by the secrecy.
- That the disclosure scope is proportionate: only the necessary documents are transmitted to the internal channel, to the OFRS or to the sectoral authority (CSSF, CNPD, ITM, CAA, ILR).
- That information covered by lawyer-client privilege and medical secrecy remains excluded: these do not benefit from this extension.
- That the chosen channel respects the hierarchy: internal reporting, then external to the OFRS, then public disclosure only if the conditions of article 15 of the 16 May 2023 law are met.
For the employer, the challenge is to handle the report without triggering a parallel disciplinary investigation that would be reclassified as retaliation before the labour court.
How Luxgap automates this risk
Our Luxgap Whistleblower Shield secures the necessity test before the report becomes a disciplinary case. The tool intercepts each alert filed on your internal channel, automatically classifies the sensitive information it contains (professional secrecy, personal data, trade secrets) using a specialised LLM agent and the EDPB framework, and produces a proportionality note enforceable before the OFRS, the ITM and the labour court.
- Classifies each item of the report according to its nature (professional secrecy, article 9 GDPR personal data, sensitive commercial information) and computes a necessity score against the alleged breach.
- Detects information potentially protected by lawyer-client privilege or medical secrecy and alerts the DPO in real time for automatic exclusion from the case file.
- Generates a timestamped proportionality note documenting, piece by piece, why the disclosure was necessary to reveal the breach.
- Tracks any HR or disciplinary action initiated within the 24 months following a report and alerts management on the presumption-of-retaliation risk.
- Produces a cryptographically sealed report, enforceable before the OFRS and the ITM during an inspection, demonstrating compliance with articles 9 to 15 of the 16 May 2023 law.
- Integrates natively with existing internal channels (M365, Teams, ServiceNow, Jira) and with your HRIS (Sage, Workday LU, Sopra Steria HR Suite) to detect report-sanction correlations.
Available as a complement to a Luxgap DPO or CISO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your actual internal channel, with a free 48-hour blank audit to measure your exposure before any engagement.
