I need to bring my Luxembourg organisation into compliance with recital 28 of Whistleblowing (UE 2019/1937). What are the concrete requirements, the sanctions, and how can Luxgap support me?

The classic trapRecital 28 draws a fine line: the directive protects the whistleblower who reveals confidential information, but it does not neutralise national criminal procedure rules. In practice, an employer who prosecutes a whistleblower for trade secret violations may see the action fail (limited liability exemption), but a parallel criminal investigation triggered by the public prosecutor on the disclosed facts follows its own course. The common mistake is to believe that whistleblower status is a general immunity: it is a targeted, conditional exemption that does not override the rights of defence of accused persons or the reversal of the burden of proof before labour courts.Operational implications of recital 28Conditional exemption: the whistleblower must have reasonable grounds to believe the disclosure was necessary to reveal a breach, in line with article 21(7) of the directive.Reversed burden of proof: in civil, administrative or labour proceedings (dismissal, transfer, sanction), the employer must prove that the measure is not retaliation, not the other way around.Criminal procedure preserved: rules on investigation integrity (secrecy, rights of defence of persons named in the report) remain untouched.Mandatory traceability: to benefit from the exemption, the whistleblower must demonstrate the chronology, content and reasonable grounds of the report, which requires an internal channel that timestamps and archives in an opposable way.Employer risk: any adverse HR action within 24 months of a report is presumed to be retaliation, unless documented evidence proves otherwise.How Luxgap automates this riskOur Luxgap Whistleblower Evidence Vault turns every report into a cryptographically sealed evidence file, opposable both to the whistleblower (to activate the liability exemption) and to the employer (to rebut the retaliation presumption). The tool anchors every step of the report (submission, acknowledgement within 7 days, feedback within 3 months, subsequent HR decisions) into a tamper-proof timestamped ledger, and automatically cross-references HR flows (Sage BOB 50, Workday LU, Sopra HR Suite) with the report chronology to detect any suspicious measure.Timestamps each report with a cryptographic seal opposable before the OFRS, the ITM and the Luxembourg labour court.Detects in real time any adverse HR decision (transfer, sanction, dismissal, compensation change) taken within 24 months of a report and triggers a presumed-retaliation risk alert.Generates a pre-drafted defence file for the employer, materialising the objective grounds predating the report that justify each HR measure, in line with the reversed burden of proof.Archives the reasonable grounds invoked by the whistleblower to activate the article 21(7) liability exemption in case of criminal or civil prosecution.Produces a timestamped PDF report, opposable to the OFRS and the judge, demonstrating full procedural compliance of the scheme.Isolates personal data of accuse...

Recital 28 Whistleblowing — Recital 28

EU frameworkGDPR NIS 2 DORA AI ActWhistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 28

Directive on the protection of persons who report breaches of Union law · UE 2019/1937

(28)

While this Directive should provide, under certain conditions, for a limited exemption from liability, including criminal liability, in the event of a breach of confidentiality, it should not affect national rules on criminal procedure, particularly those aiming at safeguarding the integrity of the investigations and proceedings or the rights of defence of persons concerned. This should be without prejudice to the introduction of measures of protection into other types of national procedural law, in particular, the reversal of the burden of proof in national administrative, civil or labour proceedings.

Luxembourg specificity

loi luxembourgeoise du 16 mai 2023 relative a la protection des lanceurs d'alerte

In Luxembourg, the law of 16 May 2023 on the protection of whistleblowers transposes recital 28 while fully preserving Luxembourg Criminal Procedure Code rules on investigation integrity and rights of defence. The reversed burden of proof applies before the ITM and the labour court: the employer must prove that an adverse HR measure taken after a report is not retaliation. Criminal sanctions for retaliation range from 1,250 to 25,000 EUR, doubled in case of recidivism, in addition to civil compensation.

Luxgap practice: systematically document objective HR grounds predating any report (annual reviews, performance plans, warning letters) because the retaliation presumption before the Luxembourg labour court is very difficult to rebut without timestamped traceability.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Recital 28 draws a fine line: the directive protects the whistleblower who reveals confidential information, but it does not neutralise national criminal procedure rules. In practice, an employer who prosecutes a whistleblower for trade secret violations may see the action fail (limited liability exemption), but a parallel criminal investigation triggered by the public prosecutor on the disclosed facts follows its own course. The common mistake is to believe that whistleblower status is a general immunity: it is a targeted, conditional exemption that does not override the rights of defence of accused persons or the reversal of the burden of proof before labour courts.

Operational implications of recital 28

Conditional exemption: the whistleblower must have reasonable grounds to believe the disclosure was necessary to reveal a breach, in line with article 21(7) of the directive.
Reversed burden of proof: in civil, administrative or labour proceedings (dismissal, transfer, sanction), the employer must prove that the measure is not retaliation, not the other way around.
Criminal procedure preserved: rules on investigation integrity (secrecy, rights of defence of persons named in the report) remain untouched.
Mandatory traceability: to benefit from the exemption, the whistleblower must demonstrate the chronology, content and reasonable grounds of the report, which requires an internal channel that timestamps and archives in an opposable way.
Employer risk: any adverse HR action within 24 months of a report is presumed to be retaliation, unless documented evidence proves otherwise.

How Luxgap automates this risk

Our Luxgap Whistleblower Evidence Vault turns every report into a cryptographically sealed evidence file, opposable both to the whistleblower (to activate the liability exemption) and to the employer (to rebut the retaliation presumption). The tool anchors every step of the report (submission, acknowledgement within 7 days, feedback within 3 months, subsequent HR decisions) into a tamper-proof timestamped ledger, and automatically cross-references HR flows (Sage BOB 50, Workday LU, Sopra HR Suite) with the report chronology to detect any suspicious measure.

Timestamps each report with a cryptographic seal opposable before the OFRS, the ITM and the Luxembourg labour court.
Detects in real time any adverse HR decision (transfer, sanction, dismissal, compensation change) taken within 24 months of a report and triggers a presumed-retaliation risk alert.
Generates a pre-drafted defence file for the employer, materialising the objective grounds predating the report that justify each HR measure, in line with the reversed burden of proof.
Archives the reasonable grounds invoked by the whistleblower to activate the article 21(7) liability exemption in case of criminal or civil prosecution.
Produces a timestamped PDF report, opposable to the OFRS and the judge, demonstrating full procedural compliance of the scheme.
Isolates personal data of accused persons in line with confidentiality and rights of defence requirements highlighted by recital 28.

Available as a complement to a Luxgap DPO or CISO mandate or as a standalone SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your actual scheme, with a free 48-hour blank audit to measure your exposure to retaliation litigation before any commitment.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 28

They trust us

Before we chat