The classic trap
Recital 55 extends the scope of the internal channel well beyond employees: it covers subsidiaries, affiliates, agents and suppliers of the group. In practice, most Luxembourg companies deploy a whistleblower channel limited to permanent staff and forget about temporary workers, interns, Odoo contractors, external consultants and suppliers. The OFRS and the ITM specifically audit this channel openness during inspections, and an overly narrow restriction is enough to invalidate the whole scheme and expose the organisation to the criminal penalties of 1,250 to 25,000 EUR under the law of 16 May 2023.
Who must be able to report through your internal channel
- Direct employees of the entity (permanent, fixed-term, temporary, apprentices, interns)
- Employees of subsidiaries and affiliates of the group (consolidated scope)
- Commercial agents and representatives acting on behalf of the group
- Suppliers and subcontractors as well as their own staff working on your premises
- Former employees who obtained the information during their activity
- Job applicants who became aware during the recruitment process
- Shareholders, members of management and supervisory bodies
- Volunteers, posted workers and anyone in a work-related relationship with the entity
The group perimeter trap
Luxembourg groups (SOPARFI holdings with operational subsidiaries, banking groups with EU branches, industrial groups with logistics entities) often fall into the trap of a siloed channel per legal entity. Recital 55 imposes instead a group logic: a group supplier must be able to report through any group channel. But beware, EDPB case law and OFRS guidance require that the handling and investigation remain close to the entity concerned to preserve GDPR confidentiality.
How Luxgap automates this risk
Our Luxgap Whistleblower Reach Mapper guarantees that your internal channel covers the full scope required by recital 55, leaving no supplier or agent in a blind spot. The tool automatically cross-references your commercial register (RCS), your ERP (Odoo, SAP, Sage BOB 50), your Active Directory and your supplier register to reconstruct the complete map of persons who must be able to report a concern to you.
- Automatically detects each new subsidiary, branch or affiliate via a connection to the Luxembourg RCS and equivalent EU registers, and extends the channel scope without manual intervention.
- Classifies each eligible population (direct staff, temporary workers via ITM, Odoo suppliers, commercial agents, former employees via HR system) and generates the exhaustive list of communication channels to activate.
- Automatically generates multilingual notices in FR/EN/DE/PT/LU adapted to each population, ready to be embedded in supplier contracts, HR onboarding flows and extranet portals.
- Publishes a single secure reporting portal (end-to-end encryption, hosted on eBRC or LuxConnect Tier IV) accessible to both employees and third parties, with access segregation per legal entity to preserve intra-group confidentiality.
- Instantly alerts the designated officer via Teams or Outlook as soon as a report is received, with cryptographic timestamping that is enforceable against the OFRS.
- Produces a sealed PDF report demonstrating the completeness of the coverage required by recital 55, enforceable during an ITM or OFRS inspection.
Available as a complement to a Luxgap DPO or CISO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your real scope, with a free 48-hour blank audit to measure the blind spots of your current channel before any commitment.
