I need to bring my Luxembourg organisation into compliance with recital 32 of Whistleblowing (UE 2019/1937). What are the concrete requirements, the sanctions, and how can Luxgap support me?

The classic trapMany employers believe they can strip a whistleblower of protection by showing that the reported facts turned out to be inaccurate, or by attacking the reporter's personal motives (conflict with a manager, ongoing disciplinary procedure, grudge). Recital 32 shuts that door: only the reasonable belief at the time of reporting matters, not the objective truth revealed by investigation, nor the reporter's private motives. The Luxembourg OFRS and ITM apply this standard strictly, and the burden of proving bad faith lies on the organisation, not on the whistleblower.The 'reasonable grounds' test: what your internal procedure must reflectBody of evidence standard: a good-faith reporter who is mistaken on the legal interpretation of a fact remains protected; only information deliberately and knowingly false excludes protection.Motive neutrality: your reporting form must NEVER ask why the person is reporting, nor whether they have an ongoing dispute with the organisation. That question is legally irrelevant and constitutes evidence of retaliation.Reversed burden of proof: the employer must demonstrate clear bad faith, not the whistleblower their good faith.Honest mistake protected: an accountant reporting a money-laundering suspicion that ultimately proves unfounded remains fully protected if the indicators were credible at the time of reporting.Extended scope: protection also covers a reporter who mistakenly but in good faith believed the facts fell within the directive's scope.How Luxgap automates this riskOur Luxgap Good Faith Shield turns the assessment of a whistleblower's good faith, a subjective and risky exercise, into a structured investigation file opposable to the OFRS. The tool automatically captures the reporting context (information available to the reporter, seniority, access rights to relevant data, compliance trainings completed) and reconstructs the reasonable person standard placed in the same circumstances, without ever probing the reporter's personal motives.Generates a reporting form compliant with recital 32, stripped of any question on motives or internal conflicts, legally validated before deployment.Cryptographically timestamps the information available to the whistleblower at time T of the report (file accesses, emails, Active Directory logs consulted) to freeze the reasonable belief standard.Computes a plausibility score from the factual indicators reported, cross-referenced with sectoral standards (CSSF, CNPD, ITM) without ever evaluating the reporter's intentions.Automatically alerts the DPO and the investigation committee whenever a question about motives appears in a Teams conversation or a meeting minute, blocking the bias before it contaminates the file.Produces an investigation memorandum opposable to the OFRS demonstrating that the case handling respected the motive neutrality imposed by recital 32.Available as a complement to a Luxgap DPO or CISO mandate or as a dedicated SaaS module depending on yo...

Recital 32 Whistleblowing — Recital 32

EU frameworkGDPR NIS 2 DORA AI ActWhistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 32

Directive on the protection of persons who report breaches of Union law · UE 2019/1937

(32)

To enjoy protection under this Directive, reporting persons should have reasonable grounds to believe, in light of the circumstances and the information available to them at the time of reporting, that the matters reported by them are true. That requirement is an essential safeguard against malicious and frivolous or abusive reports as it ensures that those who, at the time of the reporting, deliberately and knowingly reported wrong or misleading information do not enjoy protection. At the same time, the requirement ensures that protection is not lost where the reporting person reported inaccurate information on breaches by honest mistake. Similarly, reporting persons should be entitled to protection under this Directive if they have reasonable grounds to believe that the information reported falls within its scope. The motives of the reporting persons in reporting should be irrelevant in deciding whether they should receive protection.

Luxembourg specificity

loi luxembourgeoise du 16 mai 2023 relative a la protection des lanceurs d'alerte

In Luxembourg, the law of 16 May 2023 on whistleblower protection faithfully transposes the recital 32 standard in its article 2, requiring the reporter to have had reasonable grounds to believe in the truth of the information at the time of reporting. The OFRS and Luxembourg labour courts severely sanction retaliation based on the employee's presumed motives: criminal fines of 1,250 to 25,000 EUR (doubled in case of recurrence) plus full civil compensation of the harm.

Luxgap practice: audit your reporting form and internal charter to remove any reference to the reporter's motives, and train your investigation committee to document only factual plausibility, never presumed sincerity.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Many employers believe they can strip a whistleblower of protection by showing that the reported facts turned out to be inaccurate, or by attacking the reporter's personal motives (conflict with a manager, ongoing disciplinary procedure, grudge). Recital 32 shuts that door: only the reasonable belief at the time of reporting matters, not the objective truth revealed by investigation, nor the reporter's private motives. The Luxembourg OFRS and ITM apply this standard strictly, and the burden of proving bad faith lies on the organisation, not on the whistleblower.

The 'reasonable grounds' test: what your internal procedure must reflect

Body of evidence standard: a good-faith reporter who is mistaken on the legal interpretation of a fact remains protected; only information deliberately and knowingly false excludes protection.
Motive neutrality: your reporting form must NEVER ask why the person is reporting, nor whether they have an ongoing dispute with the organisation. That question is legally irrelevant and constitutes evidence of retaliation.
Reversed burden of proof: the employer must demonstrate clear bad faith, not the whistleblower their good faith.
Honest mistake protected: an accountant reporting a money-laundering suspicion that ultimately proves unfounded remains fully protected if the indicators were credible at the time of reporting.
Extended scope: protection also covers a reporter who mistakenly but in good faith believed the facts fell within the directive's scope.

How Luxgap automates this risk

Our Luxgap Good Faith Shield turns the assessment of a whistleblower's good faith, a subjective and risky exercise, into a structured investigation file opposable to the OFRS. The tool automatically captures the reporting context (information available to the reporter, seniority, access rights to relevant data, compliance trainings completed) and reconstructs the reasonable person standard placed in the same circumstances, without ever probing the reporter's personal motives.

Generates a reporting form compliant with recital 32, stripped of any question on motives or internal conflicts, legally validated before deployment.
Cryptographically timestamps the information available to the whistleblower at time T of the report (file accesses, emails, Active Directory logs consulted) to freeze the reasonable belief standard.
Computes a plausibility score from the factual indicators reported, cross-referenced with sectoral standards (CSSF, CNPD, ITM) without ever evaluating the reporter's intentions.
Automatically alerts the DPO and the investigation committee whenever a question about motives appears in a Teams conversation or a meeting minute, blocking the bias before it contaminates the file.
Produces an investigation memorandum opposable to the OFRS demonstrating that the case handling respected the motive neutrality imposed by recital 32.

Available as a complement to a Luxgap DPO or CISO mandate or as a dedicated SaaS module depending on your perimeter. Request a tailored quote and our teams will prepare a demonstration on your actual internal procedure, with a free 48h blind audit to detect the loaded questions in your current form before any engagement.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 32

They trust us

Before we chat