EU frameworkGDPRNIS 2DORAAI ActWhistleblowing
Recital 80

Recital 80

Directive on the protection of persons who report breaches of Union law · UE 2019/1937

(80)

Persons making a public disclosure directly should also qualify for protection in cases where they have reasonable grounds to believe that there is an imminent or manifest danger to the public interest, or a risk of irreversible damage, including harm to a person's physical integrity.

Luxembourg specificity
loi luxembourgeoise du 16 mai 2023 relative a la protection des lanceurs d'alerte

In Luxembourg, the law of 16 May 2023 on the protection of whistleblowers transposes Recital 80 without additional restriction: direct public disclosure is protected as soon as the urgency criteria are met, including for reports falling under the CSSF, the CNPD or the ITM. The OFRS (Office des rapports de signalement) can be seised retrospectively to recognise whistleblower status and activate support measures. Retaliation exposes the employer to criminal fines of EUR 1,250 to 25,000 (doubled in case of recidivism) and to a civil obligation of full compensation.

Luxgap practice: configure the triage engine to recognise typical Luxembourg patterns (CSSF reports on AML, CNPD reports on GDPR, ITM reports on health and safety) and systematically retain the sealed timestamp, the only evidence admissible before the OFRS to qualify urgency at the time of disclosure.