I need to bring my Luxembourg organisation into compliance with recital 45 of Whistleblowing (UE 2019/1937). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Recital 45 Whistleblowing — Recital 45

EU frameworkGDPR NIS 2 DORA AI ActWhistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 45

Directive on the protection of persons who report breaches of Union law · UE 2019/1937

(45)

Protection against retaliation as a means of safeguarding freedom of expression and the freedom and pluralism of the media should be provided both to persons who report information about acts or omissions within an organisation (‘internal reporting’) or to an outside authority (‘external reporting’) and to persons who make such information available in the public domain, for instance, directly to the public through online platforms or social media, or to the media, elected officials, civil society organisations, trade unions, or professional and business organisations.

Luxembourg specificity

loi luxembourgeoise du 16 mai 2023 relative a la protection des lanceurs d'alerte

In Luxembourg, the law of 16 May 2023 on whistleblower protection expressly confirms protection for public disclosures and establishes the Office des rapports de signalement (OFRS) as the cross-sector authority. Retaliation exposes the employer to criminal fines of EUR 1,250 to 25,000 (doubled on repeat offence) and full civil compensation including moral damages and reinstatement.

Luxgap practice: we map your channels (internal, OFRS, CSSF, CNPD, ITM, press) and configure the Retaliation Radar to fire an automatic alert whenever an adverse HR decision is taken within 24 months of a report, with a defence file ready for the Labour Court.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

This recital explicitly extends protection to public disclosures: media, social networks, NGOs, trade unions, elected officials. The trap for organisations is to assume only internal channels or the OFRS trigger protection, and to sanction an employee who spoke to the press. That is exactly what the CNPD, the ITM and Luxembourg labour courts re-qualify as retaliation, with reinstatement and damages. Recital 45 confirms that freedom of expression and media pluralism are the ultimate purpose of the framework.

What this recital concretely changes in your scheme

Your internal whistleblowing policy cannot impose exclusivity of the internal channel nor forbid referral to the OFRS, the media or trade unions.
Confidentiality clauses, NDAs and codes of conduct must contain an explicit carve-out for protected disclosures, otherwise they are void.
Any HR measure (transfer, non-renewal, degraded review, salary freeze) taken after an employee speaks publicly is presumed retaliation: the burden of proof is reversed.
Communications and press teams must be briefed: a press release attacking a whistleblower's credibility is itself retaliation under the law of 16 May 2023.
Protection also covers facilitators: journalist, lawyer, colleague, union representative assisting the whistleblower.

How Luxgap automates this risk

Our Luxgap Retaliation Radar turns whistleblower protection into continuous, evidence-grade monitoring rather than a paper policy sleeping in a binder. The tool connects an AI agent to your HR systems (Sopra Steria HR Suite, Workday LU, Sage BOB 50), Active Directory, ITSM tickets and M365 mailbox to detect in real time any adverse decision taken within 24 months of a logged report, whether internal, OFRS, press or union.

Automatically detects suspicious correlations between a report (internal, OFRS, press mention, LinkedIn post) and an adverse HR decision affecting the reporter or an identified facilitator.
Scans your contract templates, NDAs, internal rules and ethics charters for clauses incompatible with the law of 16 May 2023 and proposes a compliant rewording.
Alerts the DPO, ethics committee and legal direction via Teams the moment a manager triggers a disciplinary procedure against a person flagged as reporter or facilitator.
Generates a timestamped, cryptographically sealed defence file, admissible before the Labour Court, documenting all decisions and their objective justification independent from the report.
Monitors public mentions (Luxembourg media, social networks, press releases) naming your organisation to identify potential external protected disclosures before they escalate.
Produces the annual report required by the OFRS, aggregated by report typology and retaliation follow-up, ready to file.

Available as an add-on to a Luxgap DPO or CISO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our team prepares a demonstration on your real perimeter, with a free 48-hour blind audit mapping your retaliation exposure before any commitment.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 45

They trust us

Before we chat