I need to bring my Luxembourg organisation into compliance with recital 47 of Whistleblowing (UE 2019/1937). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Recital 47 Whistleblowing — Recital 47

EU frameworkGDPR NIS 2 DORA AI ActWhistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 47

Directive on the protection of persons who report breaches of Union law · UE 2019/1937

(47)

For the effective detection and prevention of breaches of Union law, it is vital that the relevant information reaches swiftly those closest to the source of the problem, most able to investigate and with powers to remedy it, where possible. As a principle, therefore, reporting persons should be encouraged to first use internal reporting channels and report to their employer, if such channels are available to them and can reasonably be expected to work. That is the case, in particular, where reporting persons believe that the breach can be effectively addressed within the relevant organisation, and that there is no risk of retaliation. As a consequence, legal entities in the private and public sector should establish appropriate internal procedures for receiving and following up on reports. Such encouragement also concerns cases where such channels were established without it being required by Union or national law. This principle should help foster a culture of good communication and corporate social responsibility in organisations, whereby reporting persons are considered to significantly contribute to self-correction and excellence within the organisation.

Luxembourg specificity

loi du 16 mai 2023 relative a la protection des lanceurs d'alerte

In Luxembourg, the law of 16 May 2023 makes the internal channel mandatory from 50 employees (no threshold for public entities) and entrusts the OFRS (Office des rapports de signalement) with cross-sectoral oversight. An internal channel deemed not credible by the employee justifies a direct report to OFRS, CSSF, CNPD, ITM, CAA or ILR depending on the area, without the organisation being able to hold it against the whistleblower. Criminal sanctions range from EUR 1,250 to 25,000 (doubled in case of recidivism), plus full civil compensation of the reporter's damage.

Luxgap practice: we recommend auditing the perceived credibility of the internal channel before the first OFRS inspection, since the directive and Luxembourg law assess a channel on its real functioning, not its formal existence.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Recital 47 sets an operational principle that is widely misunderstood: the internal channel must be credible, otherwise the whistleblower will go straight to the OFRS, CSSF or CNPD, and the organisation loses any chance of internal remediation. In practice, Luxembourg authorities find that internal channels often exist on paper (a generic mailbox, a forgotten SharePoint form) but are unknown to employees, untreated within deadlines, and unprotected against retaliation. The result: the signal leaves the company, the scandal goes public, and the sanction covers both the initial breach and the failure to organise the channel.

What recital 47 actually requires from your internal channel

Real accessibility: the channel must be known by every employee, intermediary, intern and supplier, not buried in an HR intranet.
Operational credibility: a designated, trained recipient, independent from the hierarchy involved, able to investigate within 3 months (art. 9 directive).
Demonstrable absence of retaliation: traceability of file access, segregation from the reporter's line manager, timestamped logging.
Feedback loop: acknowledgement within 7 days, feedback within 3 months, otherwise the reporter legitimately escalates to the external channel.
Culture: recurring communication, manager training, integration into the code of conduct and onboarding.

The recital reminds us that the internal channel is a strategic asset for the company: it enables self-correction before public escalation. But only if the reporter believes the channel works. That belief is built, not decreed.

How Luxgap automates this risk

Our Luxgap Whistleblowing Trust Index continuously measures the actual credibility of your internal channel, not just its formal existence. The tool combines data from Microsoft 365, Active Directory, HRIS (Sopra HR, Workday LU, SD Worx) and reporting module logs to produce a trust score that authorities can rely on during an OFRS audit, and that your audit committee uses to steer the ethical culture of the organisation.

Automatically scans each month the visibility of the internal channel on the intranet, standard employment contracts and public pages, and alerts if the mention disappears after a redesign.
Measures the share of employees having completed whistleblower training via LMS integration (TalentSoft, Cornerstone, Moodle) and identifies departments in the red zone.
Detects actual processing times for incoming reports (7-day acknowledgement, 3-month feedback) and triggers a Teams alert if a case drifts, before the reporter escalates to OFRS.
Calculates a retaliation risk score per case by cross-referencing access to the reporter's data, suspicious HR moves (transfer, downgraded review, end of trial period) and manager communications in the 12 months following the report.
Produces a timestamped annual PDF report, enforceable before OFRS, demonstrating that the internal channel meets articles 7 to 9 of the directive and the law of 16 May 2023.

Available as a complement to a Luxgap DPO or CISO mandate or as a dedicated SaaS brick depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your actual setup, with a free 48-hour blind audit to measure the real credibility of your internal channel before any engagement.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 47

They trust us

Before we chat