I need to bring my Luxembourg organisation into compliance with recital 43 of Whistleblowing (UE 2019/1937). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Recital 43 Whistleblowing — Recital 43

EU frameworkGDPR NIS 2 DORA AI ActWhistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 43

Directive on the protection of persons who report breaches of Union law · UE 2019/1937

(43)

Effective prevention of breaches of Union law requires that protection is granted to persons who provide information necessary to reveal breaches which have already taken place, breaches which have not yet materialised, but are very likely to take place, acts or omissions which the reporting person has reasonable grounds to consider as breaches, as well as attempts to conceal breaches. For the same reasons, protection is justified also for persons who do not provide positive evidence but raise reasonable concerns or suspicions. At the same time, protection should not apply to persons who report information which is already fully available in the public domain or unsubstantiated rumours and hearsay.

Luxembourg specificity

loi luxembourgeoise du 16 mai 2023 relative a la protection des lanceurs d'alerte

In Luxembourg, the law of 16 May 2023 on whistleblower protection transposes recital 43 by requiring the employer to qualify each report against these five categories, without being able to demand material evidence from the reporter. The internal channel threshold is 50 employees (no threshold for public bodies), and the OFRS is the cross-cutting external authority. Abusive rejection or retaliation triggers criminal fines of EUR 1,250 to 25,000 (doubled on repeat offence) plus civil compensation to the reporter.

Luxgap practice: document in writing the reasoning behind any rejection and keep the trace of the recital 43 qualification used, because the OFRS specifically reviews this point when an external report follows an internal rejection.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Recital 43 extends protection far beyond proven breaches: it also covers likely future breaches, concealment attempts and reasonable suspicions without material evidence. In practice, many Luxembourg organisations reject reports deemed insufficiently substantiated and thereby expose the whistleblower to retaliation. The OFRS and the CNPD specifically sanction this premature filtering, which amounts to denying protected whistleblower status to a person acting in good faith.

The 'reasonable grounds' test: what your internal channel must accept

A breach that has already occurred and is documented (the classic case).
A breach that has not yet occurred but is very likely to take place (preventive alert).
An act or omission that the reporter reasonably considers a breach, even if the final legal qualification turns out differently.
An attempt at concealment (evidence destruction, witness pressure, procedure rewriting).
Reasonable concerns or suspicions, without positive evidence in hand.

By contrast, the following are NOT protected: information already fully in the public domain (press, open registries) and unsubstantiated rumours or hearsay. The line is thin, and compliance plays out at the initial triage stage: a poorly motivated rejection amounts to retaliation within the meaning of the directive.

How Luxgap automates this risk

Our Luxgap Whistleblowing Intake Agent eliminates the risk of premature filtering by qualifying each report against the exact recital 43 grid, before any human decides to reject it. A specialised AI agent reads each incoming report (web form, anonymised voice, scanned mail), checks it against the material scope of the directive and the Luxembourg law of 16 May 2023, and produces an auditable qualification record that the OFRS can review during an inspection.

Automatically classifies each report into one of the five protected categories of recital 43 (past breach, likely future, act/omission, concealment, reasonable suspicion).
Detects reports potentially outside protection (information already public, unsubstantiated rumour) and requires a written, traced justification before any rejection.
Automatically generates the 7-day acknowledgement and the 3-month feedback required by the Luxembourg law of 16 May 2023.
Pseudonymises the reporter's data on intake and encrypts attachments with a key held only by the designated officer.
Produces a cryptographically sealed log of every step (reception, qualification, investigation, closure) opposable to the OFRS and the CNPD during an inspection.
Alerts the officer and DPO in real time on any report touching data protection, money laundering, public health or product safety.

Available as part of a Luxgap DPO or CISO mandate or as a standalone SaaS brick depending on your scope. Request a personalised quote and our teams will prepare a demonstration on anonymised real cases, with a free 48h white audit of your current reporting channel to measure your exposure before any engagement.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 43

They trust us

Before we chat