I need to bring my Luxembourg organisation into compliance with recital 73 of Whistleblowing (UE 2019/1937). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Recital 73 Whistleblowing — Recital 73

EU frameworkGDPR NIS 2 DORA AI ActWhistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 73

Directive on the protection of persons who report breaches of Union law · UE 2019/1937

(73)

In order to enable effective communication with staff members who are responsible for handling reports, it is necessary that the competent authorities have in place channels that are user-friendly, secure, ensure confidentiality for receiving and handling information provided by the reporting person on breaches, and that enable the durable storage of information to allow for further investigations. This could require that such channels are separated from the general channels through which the competent authorities communicate with the public, such as normal public complaints systems or channels through which the competent authority communicates internally and with third parties in its ordinary course of business.

Luxembourg specificity

loi luxembourgeoise du 16 mai 2023 relative a la protection des lanceurs d'alerte

In Luxembourg, the law of 16 May 2023 on whistleblower protection entrusts the OFRS (Office des rapports de signalement) with the role of cross-sector external authority, with sectoral routing to CSSF, CNPD, ITM, CAA or ILR. The internal threshold is 50 employees for the private sector and no threshold for the public sector. Breach of channel confidentiality triggers criminal fines from 1 250 to 25 000 EUR, doubled in case of recidivism, on top of civil damages.

Luxgap practice: we host the reporting vault in Luxembourg (eBRC or LuxConnect) and configure automatic routing rules to the correct sectoral authority based on the nature of the reported breach.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Recital 73 requires competent authorities (OFRS, CSSF, CNPD, ITM, CAA, ILR in Luxembourg) to maintain dedicated, secure channels separated from their general communication tools. The same requirement cascades onto private companies above 50 employees: a report received on info@ or through a shared Jira ticket breaks confidentiality, and the employer immediately loses the legal protection of the internal procedure. The CNPD sanctions confidentiality failures under GDPR article 32, and OFRS may requalify the internal channel as non-compliant, opening the door to direct external reporting.

The implicit technical requirements of recital 73

Channel separated from ordinary communication tools (no shared mailbox, no mutualized helpdesk, no commercial CRM).
End-to-end encryption between the reporting person and the designated handler, with strict access rights management.
Durable, timestamped storage of evidence, allowing investigations to be reopened years later within legal retention limits.
Access traceability (who read what, when, from which IP) to demonstrate confidentiality in case of a leak.
Strong authentication of designated handlers and immutable action logs, enforceable in disciplinary or criminal proceedings.
Support for anonymous reporting preserved over time, with a return channel to the reporter without revealing their identity.

How Luxgap automates this risk

Our Luxgap Whistleblowing Vault eliminates leak risk by physically isolating the reporting channel from the rest of your IT: no M365 integration, no CRM connector, no indexation in your internal search engine. The platform is hosted in a separate encrypted enclave in Luxembourg (eBRC or LuxConnect), with decryption keys held exclusively by the handlers you designate, and a cryptographically sealed access log enforceable before OFRS.

Generates a branded reporting portal accessible through a dedicated URL and QR code, with zero dependency on your Active Directory or M365 tenant.
Encrypts every report and every attachment with a per-case key derived from a secret held only by the handlers listed in your internal register.
Enables anonymous two-way dialogue with the reporter through a cryptographic mailbox, never revealing IP, email or device metadata.
Retains evidence for the legal duration in a WORM vault (write once, read many), with eIDAS-qualified timestamps enforceable during OFRS audits or criminal proceedings.
Produces a quarterly electronically signed report demonstrating channel separation, access confidentiality and compliance with the deadlines of articles 9 and 11 of the directive.
Detects unauthorized access attempts and alerts the DPO and handler in real time through an out-of-band channel (SMS, Signal).

Available as a complement to a Luxgap DPO or CISO mandate or as a standalone SaaS module depending on your perimeter. Request your demonstration and our teams prepare a proof of value within 48h on your real perimeter, with a free white audit of your current setup before any engagement.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 73

They trust us

Before we chat