I need to bring my Luxembourg organisation into compliance with recital 74 of Whistleblowing (UE 2019/1937). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Recital 74 Whistleblowing — Recital 74

EU frameworkGDPR NIS 2 DORA AI ActWhistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 74

Directive on the protection of persons who report breaches of Union law · UE 2019/1937

(74)

Staff members of the competent authorities who are responsible for handling reports should be professionally trained, including on applicable data protection rules, in order to handle reports and to ensure communication with the reporting person, as well as to follow up on the report in a suitable manner.

Luxembourg specificity

loi luxembourgeoise du 16 mai 2023 relative à la protection des personnes qui signalent des violations du droit

In Luxembourg, the Act of 16 May 2023 on the protection of whistleblowers requires entities with 50+ employees, and all public entities without threshold, to designate persons or services in charge of report follow-up with appropriate training. OFRS, the transversal external authority, may audit the reality of that training, and breach of confidentiality is criminally punished with fines from 1,250 to 25,000 EUR, doubled in case of recidivism.

Luxgap practice: for each referent named in your internal procedure, keep the timestamped training certificate and run a short annual refresher targeting OFRS and CNPD evolutions, to neutralise the personal criminal exposure of the referent.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Recital 74 looks harmless but governs the entire reporting chain. In practice, OFRS, CNPD and CSSF check during an inspection that designated handlers have documented, up-to-date training covering both the whistleblowing procedure and GDPR. The common mistake is to appoint the DPO or an HR officer as referent without ever documenting their specific training on whistleblower handling, which weakens confidentiality and exposes the organisation to civil damages when a reporter is identified through carelessness.

What professional training must concretely cover

Legal qualification of a report (Article 2 alert vs. HR grievance vs. malicious denunciation).
Reinforced confidentiality duties under Article 16 of the 16 May 2023 Act and the criminal penalties for breach.
GDPR articulation: legal basis, minimisation, rights of the accused, Article 30 register.
Dialogue management with the reporter (acknowledgement within 7 days, feedback within 3 months).
Referral to the competent external authority by domain (OFRS, CSSF, CNPD, ITM, CAA, ILR).
Traceability of dismissal decisions, to evidence suitable follow-up during an audit.

How Luxgap automates this risk

Our Luxgap Whistleblowing Competency Tracker turns a diffuse training obligation into opposable evidence. The tool connects to your LMS (Moodle, TalentLMS, Cornerstone, SAP SuccessFactors) and Microsoft Entra ID to automatically identify everyone with access to the reporting channel, then continuously verify that their training is valid, dated and covers the modules required by Recital 74.

Automatically detects users with read or write access to the alert mailbox, the dedicated SharePoint or the third-party tool (EQS, NAVEX, WhistleB).
Verifies for each referent the presence of active training certificates on the four mandatory modules (procedure, GDPR, confidentiality, follow-up).
Sends a Teams or Slack alert as soon as an access right is granted to an untrained person, before any real report is handled.
Generates the annual training plan per referent, with automatic reminders before expiry.
Produces a timestamped sealed PDF report, opposable to OFRS during an inspection, evidencing that every report was handled by a trained person on the date of the facts.
Maintains an immutable audit log of channel access cross-referenced with training status, usable in litigation.

Available as a complement to a Luxgap DPO or CISO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your real referent population, with a free 48-hour blind audit to measure the gap between your declared referents and those actually trained.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 74

They trust us

Before we chat