I need to bring my Luxembourg organisation into compliance with recital 54 of Whistleblowing (UE 2019/1937). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Recital 54 Whistleblowing — Recital 54

EU frameworkGDPR NIS 2 DORA AI ActWhistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 54

Directive on the protection of persons who report breaches of Union law · UE 2019/1937

(54)

Third parties could also be authorised to receive reports of breaches on behalf of legal entities in the private and public sector, provided they offer appropriate guarantees of respect for independence, confidentiality, data protection and secrecy. Such third parties could be external reporting platform providers, external counsel, auditors, trade union representatives or employees' representatives.

Luxembourg specificity

loi luxembourgeoise du 16 mai 2023 relative a la protection des lanceurs d'alerte

In Luxembourg, the law of 16 May 2023 on the protection of whistleblowers expressly allows the use of a third party to operate the internal channel, while keeping full liability on the legal entity. The threshold is 50 employees in both private and public sectors, with no threshold for public bodies. Criminal sanctions range from 1 250 to 25 000 EUR, doubled in case of repeat offence, on top of civil indemnification.

Luxgap practice: require from the external provider a named independence attestation, Luxembourg-based hosting (eBRC, LuxConnect, POST) and a signed article 28 GDPR contract before go-live, enforceable before the OFRS and the CNPD.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Recital 54 allows outsourcing the internal reporting channel, but organisations often confuse operational outsourcing with transfer of liability. The legal entity remains the data controller under GDPR and the responsible party under the Luxembourg law of 16 May 2023. The CNPD and the OFRS sanction setups where the external provider does not present documented independence guarantees, or where the GDPR article 28 contract is missing or weak on whistleblower confidentiality.

Contractual guarantees to require from the third party

Independence : no capital, hierarchical or conflicting commercial link with the client's management, with an enforceable anti-conflict clause.
Reinforced confidentiality : named commitment from each person authorised to handle reports, individual NDAs, and prohibition of disclosure even inside the provider.
Data protection : signed article 28 GDPR DPA, TIA if hosting outside the EU, end-to-end encryption, access logging, retention period aligned with the law.
Professional secrecy : for auditors, lawyers and union representatives, written formalisation of the applicable secrecy regime.
Reversibility : full return of the reporting register at contract termination, with no retention by the provider.
Acknowledgement traceability : 7-day acknowledgement and 3-month feedback aligned with the law of 16 May 2023, demonstrable through timestamping.

How Luxgap automates this risk

Our Luxgap Whistleblowing Vault turns your reporting channel into a cryptographic safe operated by an independent third party, with evidence enforceable before the OFRS and the CNPD. The platform combines an anonymous web portal hosted in Luxembourg (eBRC or LuxConnect), end-to-end encryption where even Luxgap cannot read reports without a two-person quorum on the client side, and an AI agent that automatically qualifies the admissibility of each report under the material scope of directive 2019/1937 and the law of 16 May 2023.

Receives reports via web form, phone with encrypted transcription, or physical meeting, with eIDAS qualified timestamping on every acknowledgement.
Automatically generates the 7-day acknowledgement and the 3-month feedback, with reminders and escalations if the authorised handlers miss the deadlines.
Classifies each report by domain (CSSF finance, CNPD data, ITM labour, CAA insurance, ILR telecom) and suggests the relevant external channel if the reporter wishes to escalate.
Generates the preloaded article 28 GDPR contract, the TIA if applicable, and the provider's independence sheet, enforceable during an audit.
Publishes an anonymised yearly report for the board and the designated follow-up officer, with delay and closure rate metrics.
Cryptographically seals the reporting register, enforceable before the OFRS and the CNPD in case of audit or employment litigation.

Available as part of a Luxgap DPO or CISO mandate or as a standalone SaaS module depending on your perimeter. Request a tailored quote and our teams will prepare a demonstration on your actual organisation, with a free 48h blank audit to measure the compliance of your current setup before any engagement.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 54

They trust us

Before we chat