I need to bring my Luxembourg organisation into compliance with recital 70 of Whistleblowing (UE 2019/1937). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Recital 70 Whistleblowing — Recital 70

EU frameworkGDPR NIS 2 DORA AI ActWhistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 70

Directive on the protection of persons who report breaches of Union law · UE 2019/1937

(70)

To ensure the effectiveness of the procedures for following up on reports and addressing breaches of the Union rules concerned, Member States should be able to take measures to alleviate burdens for competent authorities resulting from reports of minor breaches of provisions falling within the scope of this Directive, repetitive reports or reports of breaches of ancillary provisions, for instance provisions on documentation or notification obligations. Such measures could consist in allowing competent authorities, after due assessment of the matter, to decide that a reported breach is clearly minor and does not require further follow-up pursuant to this Directive, other than closure of the procedure. It should also be possible for Member States to allow competent authorities to close the procedure regarding repetitive reports which do not contain any meaningful new information adding to a past report in respect of which the relevant procedures were concluded, unless new legal or factual circumstances justify a different form of follow-up. Furthermore, Member States should be able to allow competent authorities to prioritise the treatment of reports of serious breaches or breaches of essential provisions falling within the scope of this Directive in the event of high inflows of reports.

Luxembourg specificity

loi luxembourgeoise du 16 mai 2023 relative a la protection des lanceurs d'alerte

In Luxembourg, the law of 16 May 2023 on the protection of whistleblowers transposed this recital 70 option by entrusting the Office des rapports de signalement (OFRS) with the power to close reports that are manifestly minor, repetitive or out of scope after a reasoned assessment. The OFRS publishes its prioritisation criteria in its annual report and may refer the report to the relevant sectoral authority (CSSF, CNPD, ITM, CAA, ILR) where the matter warrants it.

Luxgap practice: align your internal triage grid with the criteria published by the OFRS and retain the written reasoning for each closure for 5 years, the retention period recommended by the CNPD for whistleblowing registers.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Recital 70 allows competent authorities (OFRS, CSSF, CNPD, ITM) to quickly close reports of minor, repetitive or ancillary breaches. In practice, many organisations misread this filter and apply it internally to their article 8 channel, leading them to dismiss alerts that the OFRS would have deemed admissible. The trap: prioritisation is a legal option for authorities, not an excuse for the employer, who must still acknowledge receipt within 7 days and provide a reasoned feedback within 3 months.

Operationalising prioritisation without creating a grey zone

Document a written triage grid separating serious breach, minor breach, repetitive report and out-of-scope report: the grid must be enforceable and versioned.
For repetitive reports, keep the link with the initial closed report and verify the absence of new legal or factual circumstances before closure.
Never label a report as minor without a documented assessment: closure without follow-up requires written reasoning communicated to the reporting person.
Distinguish internal prioritisation (article 8 channel manager) from external prioritisation (authority): only the latter can close within the meaning of recital 70.
Verify that the seriousness criterion is aligned with the material scope of the law of 16 May 2023 (GDPR, anti-money laundering, public procurement, product safety, public health, etc.).

How Luxgap automates this risk

Our Luxgap Whistleblowing Triage Engine eliminates the grey zone between minor report and report to investigate thanks to a specialised LLM agent that reads each alert, cross-checks it against the material scope of directive 2019/1937 and the Luxembourg law of 16 May 2023, and delivers a reasoned triage recommendation in under 60 seconds. The tool connects natively to your internal channel (encrypted web form, hotline, dedicated mailbox) and matches each new report against the historical database to automatically detect duplicates and repetitive reports.

Classifies every incoming report against the EDPB grid, the OFRS taxonomy and the material categories of article 2 of the directive, with a seriousness score from 1 to 5.
Detects repetitive reports by semantically comparing the content with closed cases, and triggers an alert only if new legal or factual circumstances appear.
Automatically generates the 7-day acknowledgement and the 3-month reasoned feedback, pre-filled with the follow-up decision and its justification.
Produces for each closure a timestamped reasoning sheet, enforceable before the OFRS in case of inspection or external escalation by the reporting person.
Instantly alerts the DPO and the ethics officer via Teams or Slack as soon as a report is qualified as a serious breach or involves personal data.
Maintains an encrypted and pseudonymised register of reports, compliant with article 18 of the directive and the applicable CNPD deliberation.

Available as a complement to a Luxgap DPO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on an anonymised set of reports representative of your sector, with a free 48-hour blind audit of your existing internal channel.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 70

They trust us

Before we chat