EU frameworkGDPRNIS 2DORAAI ActWhistleblowing
Recital 52

Recital 52

Directive on the protection of persons who report breaches of Union law · UE 2019/1937

(52)

In order to ensure, in particular, that the public procurement rules in the public sector are respected, the obligation to put in place internal reporting channels should apply to all contracting authorities and contracting entities, at local, regional and national level, whilst being commensurate with their size.

Luxembourg specificity
loi luxembourgeoise du 16 mai 2023 relative a la protection des lanceurs d'alerte

In Luxembourg, the law of 16 May 2023 on whistleblower protection applies the spirit of recital 52: all public sector bodies are subject to the internal channel obligation without any minimum headcount threshold, including municipalities, intermunicipal syndicates, public establishments and State services. The OFRS is the cross-sector external authority, but public procurement breaches may also be reported to competent sectoral authorities.

Luxgap practice: for small municipalities (under 50 staff), we recommend pooling via a certified external channel rather than a dedicated in-house platform, a solution explicitly validated by the LU law on proportionality grounds.