I need to bring my Luxembourg organisation into compliance with recital 76 of Whistleblowing (UE 2019/1937). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Recital 76 Whistleblowing — Recital 76

EU frameworkGDPR NIS 2 DORA AI ActWhistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 76

Directive on the protection of persons who report breaches of Union law · UE 2019/1937

(76)

Member States should ensure that competent authorities have in place adequate protection procedures for the processing of reports and for the protection of the personal data of the persons referred to in the report. Such procedures should ensure that the identity of every reporting person, person concerned, and third persons referred to in the report, for example witnesses or colleagues, is protected at all stages of the procedure.

Luxembourg specificity

loi luxembourgeoise du 16 mai 2023 relative a la protection des lanceurs d'alerte

In Luxembourg, the law of 16 May 2023 on the protection of whistleblowers turns this recital into operational duties directly enforceable by the OFRS and the CNPD. Breach of identity confidentiality exposes the organisation to a criminal fine of EUR 1,250 to 25,000 (doubled on recidivism), cumulative with a CNPD GDPR sanction and civil damages owed to the person whose identity was leaked.

Luxgap practice: we recommend a joint OFRS / CNPD audit of the internal channel, since both authorities can investigate the same incident with different frameworks, and documentation must satisfy both simultaneously.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Recital 76 requires competent authorities (OFRS, CSSF, CNPD, ITM, CAA, ILR in Luxembourg) to protect the identity of every person mentioned in a report: the reporting person, the person concerned, witnesses, colleagues incidentally named. The trap is to assume this obligation only binds the external authority. In reality, internal channels of organisations with 50+ employees must meet the same standard, and the CNPD systematically sanctions identity leaks via the GDPR route (Article 32 and Article 5) in parallel with any criminal proceedings under the Luxembourg law of 16 May 2023.

What this recital concretely changes in your procedures

Strict compartmentalisation: only the designated case handler accesses the named report, not line management, not HR, not IT support.
Pseudonymisation of witnesses and colleagues incidentally mentioned: their names must never appear in exports, tickets or minutes circulated beyond the case handler.
Access traceability: every consultation must be logged immutably to respond to a CNPD request or a judicial inquiry.
End-to-end encryption of intake channels (web form, phone, post), including backups and PDF exports sent to authorities.
Purge policy: technical metadata (IP, user-agent, precise timestamps) must be dissociated from the report content as soon as no longer needed.
Documented training of case handlers: the CNPD checks the training register during an audit.

How Luxgap automates this risk

Our Luxgap Whistleblower Identity Vault makes it cryptographically impossible to leak the identity of a whistleblower, a witness or a person concerned, even if the admin account is compromised. The tool encrypts each report with a per-case derived key, stores identities in a dedicated HSM vault hosted at LuxConnect or eBRC, and integrates natively with Odoo, M365, ServiceNow channels and public web forms via a lightweight cookie-free snippet.

Automatically pseudonymises every proper name detected in the report body and attachments, via an AI agent trained on FR, EN, DE and LU grammar.
Compartmentalises access per case with role separation handler / investigator / lawyer, and blocks any cross-access attempt even by a global administrator.
Logs every consultation in a cryptographically sealed journal, timestamped by an eIDAS qualified trust provider.
Detects exfiltration attempts in real time (screenshot, CSV export, Teams sharing) and alerts the DPO within 5 minutes.
Produces an audit report opposable to the CNPD and OFRS, demonstrating compliance with GDPR Article 32 and recital 76 of the directive.
Automatically generates anonymised versions of case files to be transmitted to the relevant external authority (CSSF, ITM, CAA, ILR).

Available as a complement to a Luxgap DPO or CISO mandate or as a dedicated SaaS module depending on your perimeter. Request a tailored quote and our teams will prepare a demonstration on your actual internal channel, with a free 48h blind audit to measure your exposure before any engagement.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 76

They trust us

Before we chat