EU frameworkGDPRNIS 2DORAAI ActWhistleblowing
Recital 57

Recital 57

Directive on the protection of persons who report breaches of Union law · UE 2019/1937

(57)

In the context of internal reporting, informing, as far as legally possible and in the most comprehensive way possible, the reporting person about the follow-up to the report is crucial for building trust in the effectiveness of the overall system of whistleblower protection and reduces the likelihood of further unnecessary reports or public disclosures. The reporting person should be informed within a reasonable timeframe about the action envisaged or taken as follow-up to the report and the grounds for the choice of that follow-up. Follow-up could include, for instance, referral to other channels or procedures in the case of reports exclusively affecting individual rights of the reporting person, closure of the procedure based on lack of sufficient evidence or other grounds, launch of an internal enquiry and, possibly, its findings and any measures taken to address the issue raised, referral to a competent authority for further investigation, insofar as such information would not prejudice the internal enquiry or the investigation or affect the rights of the person concerned. In all cases, the reporting person should be informed of the investigation's progress and outcome. It should be possible to ask the reporting person to provide further information, during the course of the investigation, albeit without there being an obligation to provide such information.

Luxembourg specificity
loi luxembourgeoise du 16 mai 2023 relative à la protection des personnes qui signalent des violations du droit

In Luxembourg, the law of 16 May 2023 on the protection of whistleblowers strictly mirrors the Directive's timelines: 7-day acknowledgement and 3-month substantive feedback. The Office des rapports de signalement (OFRS) is the transversal external authority, but the internal feedback must be documented even when the case is escalated to it. Criminal penalties for obstruction or failure to follow up range from 1,250 to 25,000 EUR, doubled in case of repeat offence, without prejudice to civil compensation owed to the reporting person.

Luxgap practice: for 50-249 employee entities sharing a channel, the follow-up log must remain segregated per entity; our Feedback Engine automatically partitions cases and produces an OFRS-ready report per legal entity.