EU frameworkGDPRNIS 2DORAAI ActWhistleblowing
Recital 59

Recital 59

Directive on the protection of persons who report breaches of Union law · UE 2019/1937

(59)

Persons who are considering reporting breaches of Union law should be able to make an informed decision on whether, how and when to report. Legal entities in the private and public sector that have internal reporting procedures in place should be required to provide information on those procedures as well as on external reporting procedures to relevant competent authorities. It is essential that such information be clear and easily accessible, including, to any extent possible, also to persons other than workers, who come in contact with the entity through their work-related activities, such as service-providers, distributors, suppliers and business partners. For instance, such information could be posted at a visible location accessible to all such persons and on the website of the entity, and could also be included in courses and training seminars on ethics and integrity.

Luxembourg specificity
loi luxembourgeoise du 16 mai 2023 relative a la protection des lanceurs d'alerte

In Luxembourg, the OFRS (Office des rapports de signalement) is the transversal external authority that monitors the quality of public information. The law of 16 May 2023 on the protection of whistleblowers requires entities with 50 or more employees (no threshold for the public sector) to make information accessible to workers AND professional third parties. Criminal penalties range from EUR 1,250 to EUR 25,000, doubled in case of recidivism, where access to information or to the reporting channel is obstructed.

Luxgap practice: publish a /whistleblowing/ page accessible without authentication and explicitly mentioning the OFRS and the relevant sectoral authority (CSSF, CNPD, ITM, CAA, ILR), and embed the information clause in your supplier general terms at the next contractual renewal.