I need to bring my Luxembourg organisation into compliance with recital 58 of Whistleblowing (UE 2019/1937). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Recital 58 Whistleblowing — Recital 58

EU frameworkGDPR NIS 2 DORA AI ActWhistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 58

Directive on the protection of persons who report breaches of Union law · UE 2019/1937

(58)	A reasonable timeframe for informing a reporting person should not exceed three months. Where the appropriate follow-up is still being determined, the reporting person should be informed about this and about any further feedback to expect.

Luxembourg specificity

loi luxembourgeoise du 16 mai 2023 relative a la protection des lanceurs d'alerte

In Luxembourg, the law of 16 May 2023 on the protection of whistleblowers strictly mirrors the three-month feedback deadline (article 13), with a mandatory acknowledgement within 7 days. The OFRS (Office des rapports de signalement) is the cross-sectoral authority overseeing the diligence of internal channels, and an unjustified breach of the deadline triggers criminal fines of 1,250 to 25,000 EUR (doubled in case of repeat offence), together with civil compensation of the whistleblower.

Luxgap practice: we systematically configure the Whistleblower Clock against the Luxembourg dual threshold (D+7 acknowledgement + D+90 feedback) with automatic escalation to the alert officer and to the OFRS in case of internal blockage, evidencing opposable diligence during an inspection.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Recital 58 sets a hard operational rule: three months maximum to provide feedback to the reporting person. The OFRS and CNPD sanction whistleblowing schemes that remain silent beyond that deadline, because silence is interpreted as the absence of an effective internal channel, which then entitles the whistleblower to escalate to external reporting or public disclosure. Most organisations that believe they are compliant fail here: they have a mailbox, but no automatic reminder mechanism and no traceability of the feedback sent.

What 'feedback' really means under recital 58

Acknowledge receipt within 7 days (article 9.1.b of the directive, transposed by the Luxembourg law of 16 May 2023).
Provide an interim feedback within 3 months even if the investigation is still ongoing.
Explicitly state when the appropriate follow-up is still being determined, and clarify what further feedback the reporting person should expect.
Log every communication with a timestamp and an opposable trail, since the burden of proof lies on the organisation.
Maintain the confidentiality of the whistleblower's identity throughout the exchanges.

The trap: a case opened internally with no automatic reminder drifts into the fourth month unnoticed. This is precisely the situation that authorities look for during a reactive audit triggered by an external complaint.

How Luxgap automates this risk

Our Luxgap Whistleblower Clock eliminates the risk of breaching the three-month deadline by running each report as an opposable countdown. The tool orchestrates the regulatory milestones (acknowledgement at D+7, interim feedback at D+90) through native connectors with M365, Teams, Slack and Jira Service Management, and automatically generates the encrypted, timestamped, cryptographically signed feedback, without the alert officer having to draft a single email.

Triggers an end-to-end encrypted automatic acknowledgement as soon as a report enters the channel, with pseudonymisation of the reporting person.
Computes the D+90 countdown in real time and notifies the alert officer through Teams at D+60, D+75 and D+85 as long as the case is open.
Generates a pre-drafted interim feedback aligned with recital 58 when the investigation is not yet complete, explaining that the follow-up is still being determined and what further feedback to expect.
Produces a sealed timestamped audit log, opposable to the OFRS, CNPD or CSSF during an inspection, evidencing compliance with the deadline for each case over the past 5 years.
Detects risk patterns (cases approaching D+85, officers on leave, multiple reports on the same subject) and escalates to the compliance leadership.

Available as part of a Luxgap DPO or CISO mandate or as a standalone SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your real channels, with a free 48-hour blank audit to measure your exposure before any engagement.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 58

They trust us

Before we chat