I need to bring my Luxembourg organisation into compliance with recital 63 of Whistleblowing (UE 2019/1937). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Recital 63 Whistleblowing — Recital 63

EU frameworkGDPR NIS 2 DORA AI ActWhistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 63

Directive on the protection of persons who report breaches of Union law · UE 2019/1937

(63)

Lack of confidence in the effectiveness of reporting is one of the main factors discouraging potential whistleblowers. Accordingly, there is a need to impose a clear obligation on competent authorities to establish appropriate external reporting channels, to diligently follow up on the reports received, and, within a reasonable timeframe, give feedback to reporting persons.

Luxembourg specificity

loi luxembourgeoise du 16 mai 2023 relative a la protection des lanceurs d'alerte

In Luxembourg, the law of 16 May 2023 on whistleblower protection specifies the feedback deadlines: acknowledgment within 7 days and final feedback within 3 months maximum (extendable to 6 months for complex cases by external authorities). The Office des rapports de signalement (OFRS) is the transversal authority, but sector-specific reports fall under CSSF (finance), CNPD (data), ITM (labour), CAA (insurance) or ILR (telecom). Failure to provide feedback exposes to criminal fines of 1,250 to 25,000 EUR, doubled in case of recidivism.

Luxgap practice: we configure the Whistleblowing Trust Engine with the exact Luxembourg deadlines and automatic routing to the competent external authority based on report qualification, with opposable proof of transmission.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Recital 63 illuminates the entire external reporting architecture: if the whistleblower does not trust that the authority will handle the case seriously, they will go straight to the press, exposing the organisation to maximum reputational risk. In practice, the OFRS, CNPD, CSSF or ITM verify not only that your internal channels exist, but above all that they deliver tangible feedback to the reporting person within the legal deadlines (acknowledgment within 7 days, feedback within 3 months). A mailbox that never replies is legally equivalent to no channel at all.

The three trust pillars you must demonstrate

Appropriate channel: accessible, confidential, technically secured (encryption, access segregation, timestamped logging).
Diligent follow-up: immediate registration, legal qualification of the report, traced internal investigation, motivated decision.
Feedback: acknowledgment within 7 days, communication of envisaged or taken measures within 3 months maximum, with proof of transmission.
Opposable evidence: every step must be timestamped and archived, because in case of subsequent retaliation, you will have to prove that the handling was diligent.
Case handler independence: the person or department handling the report must have no conflict of interest with the accused party, otherwise the procedure is void.

How Luxgap automates this risk

Our Luxgap Whistleblowing Trust Engine turns your reporting channel into an opposable trust-producing machine, not a forgotten mailbox. The tool orchestrates the entire lifecycle of an alert, from end-to-end encrypted reception to motivated closure, with a legal deadline counter that enforces recital 63 and the 7-day / 3-month chronogram imposed by the Luxembourg law of 16 May 2023.

Automatically generates the timestamped acknowledgment within 7 days, cryptographically signed and transmitted through the anonymous channel chosen by the reporter (secure mailbox, dedicated phone line, physical meeting).
Triggers Teams or Slack alerts to the designated case handler at D+30, D+60 and D+80 to guarantee feedback within the legal 3-month deadline.
Traces every investigation action in a sealed register, opposable to OFRS, CSSF or CNPD in case of inspection or whistleblower complaint.
Automatically detects conflicts of interest by cross-referencing the M365 org chart with the accused party identity, and reroutes the file to an independent backup handler.
Produces a timestamped, anonymised annual PDF report compliant with OFRS statistical requirements, ready to be transmitted to the authority.
Calculates a trust score based on average handling time, reporter feedback rate and motivated closure rate, to drive continuous improvement.

Available as a complement to a Luxgap DPO or CISO mandate or as a standalone SaaS module depending on your scope. Request a personalised quote and our teams will prepare a demonstration on your current channels, with a free white audit within 48h to measure your actual compliance with recital 63 before any engagement.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 63

They trust us

Before we chat