The classic trap
Recital 67 sets the golden rule on timing: a maximum of 3 months for feedback to the whistleblower, extendable to 6 months for complex cases. In practice, the OFRS and CNPD sanction organisations that let reports sleep in a shared mailbox without acknowledgement, without assignment to an investigator, without documented follow-up. A whistleblower who receives no feedback within 3 months may escalate to public disclosure (press, social media), immediately triggering reputational and legal risk for the organisation.
How to build a defensible timeline
- D+7: acknowledgement of receipt to the whistleblower (mandatory deadline under Article 9 of the directive).
- D+30: initial internal qualification (admissible / inadmissible / out of scope) and assignment to an identified investigator.
- D+60: intermediate status update to the whistleblower, even without final conclusions, to evidence diligence.
- D+90: full feedback OR motivated notification of extension to 6 months with written justification (complexity, external audit, technical expertise).
- D+180: absolute cut-off, beyond which the organisation loses any defence against public disclosure by the whistleblower.
The trap is to believe the clock starts when the investigation closes: it starts the moment the report is received. Every day counts and every step must be timestamped.
How Luxgap automates this risk
Our Luxgap Whistleblowing Clock turns the 3-month obligation into a traced, timestamped, opposable production chain. As soon as a report enters the internal channel, the tool triggers a cryptographically sealed legal countdown and orchestrates milestones D+7, D+30, D+60, D+90 and D+180 via native integrations with Microsoft 365, Teams, Outlook and Azure AD, without any officer having to maintain a parallel Excel file.
- Automatically triggers the D+7 acknowledgement to the whistleblower via encrypted channel, with timestamped proof of delivery.
- Alerts the officer and their backup via Teams as soon as a milestone is 72h away, with automatic hierarchical escalation if no action is taken.
- Generates the pre-drafted 6-month extension notification with justification tailored to the report typology (fraud, harassment, money laundering, GDPR).
- Produces a sealed timestamped event log, opposable to the OFRS, CSSF, ITM or CNPD in case of inspection or whistleblower complaint.
- Detects in real time reports dormant for more than 30 days without documented action and surfaces a public disclosure risk score.
- Automatically anonymises case files before any export or sharing with third parties (lawyers, external auditors, authorities).
Available as a complement to a Luxgap DPO or CISO mandate or as a dedicated SaaS module depending on your scope. Request a personalised quote and our teams will prepare a demonstration on your actual reporting channel, with a free 48-hour blank audit to measure your timeline exposure before any engagement.
