I need to bring my Luxembourg organisation into compliance with recital 60 of Whistleblowing (UE 2019/1937). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Recital 60 Whistleblowing — Recital 60

EU frameworkGDPR NIS 2 DORA AI ActWhistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 60

Directive on the protection of persons who report breaches of Union law · UE 2019/1937

(60)

Effective detection and prevention of breaches of Union law require ensuring that potential whistleblowers can easily and in full confidentiality bring the information they possess to the attention of the relevant competent authorities that are able to investigate and to remedy the problem, where possible.

Luxembourg specificity

loi luxembourgeoise du 16 mai 2023 relative a la protection des lanceurs d'alerte

In Luxembourg, the law of 16 May 2023 on the protection of whistleblowers implements recital 60 by imposing an internal channel from 50 employees (no threshold for public bodies) and designating the Office des rapports de signalement (OFRS) as the cross-sectoral external authority, alongside sector regulators (CSSF, CNPD, ITM, CAA, ILR). Breach of confidentiality obligations triggers criminal fines of EUR 1,250 to 25,000, doubled in case of repeat offence, plus civil compensation to the whistleblower.

Luxgap practice: the gateway is preconfigured with automatic routing to the OFRS or the competent sectoral authority based on the report's domain, plus a cryptographic proof module of the 7-day and 3-month deadlines, enforceable during an OFRS audit.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Recital 60 sets a simple but demanding principle: if the external channel is complicated, hard to find, or opaque about confidentiality, the report never reaches the competent authorities. The OFRS, CSSF, CNPD or ITM sanction organisations that display a deterrent internal channel (form requiring prior identification, HR personal email, no written confidentiality guarantee). The concrete consequence: the whistleblower bypasses the internal route and goes straight to the press, maximising reputational damage.

The concrete criteria of an 'easy and confidential' channel

Accessible in less than 3 clicks from the homepage and from the employee intranet.
Multi-channel: written (encrypted web form), oral (dedicated phone line), physical (meeting on request).
Explicit mention of the possibility of anonymous reporting, even where Luxembourg law does not mandate systematic processing.
Clear information on the competent external authorities (OFRS, CSSF, CNPD, ITM, CAA, ILR) with their direct contact details.
Acknowledgement of receipt within 7 days and feedback within 3 months, no exception.
Written guarantee that the whistleblower's identity is known only to the dedicated case handler, separated from the HR hierarchy.
Available in the working languages of the organisation (FR, DE, EN, LU, PT at minimum in Luxembourg).

How Luxgap automates this risk

Our Luxgap Whistleblowing Gateway removes the 'channel too complicated' excuse by deploying within 48h an end-to-end encrypted reporting portal, multilingual, accessible from your public website and your M365 or Google Workspace intranet. The tool cryptographically isolates the whistleblower's identity from the content of the report, so that even the Luxgap administrator cannot link them without the key held by the designated case handler.

Generates a white-label reporting portal in your organisation's branding, accessible via web form, phone line with automatic transcription, and physical meeting booking.
Encrypts each report with a key specific to the designated case handler, ensuring that HR and senior management can never access the content without audit trail.
Automatically triggers the 7-day acknowledgements and the 3-month feedback reminders required by the law of 16 May 2023.
Displays in real time the up-to-date contact details of the competent external authorities (OFRS, CSSF, CNPD, ITM, CAA, ILR) based on the domain declared by the whistleblower.
Produces a timestamped and cryptographically sealed register of reports, enforceable against the OFRS in case of a compliance audit of the scheme.
Alerts the case handler instantly via secure outbound channel (Teams, Signal) without exposing the content of the report in the notification.

Available as a complement to a Luxgap DPO or CISO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your real environment, with a free 48h blank audit of your current scheme to measure your exposure before any engagement.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 60

They trust us

Before we chat