I need to bring my Luxembourg organisation into compliance with recital 82 of Whistleblowing (UE 2019/1937). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Recital 82 Whistleblowing — Recital 82

EU frameworkGDPR NIS 2 DORA AI ActWhistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 82

Directive on the protection of persons who report breaches of Union law · UE 2019/1937

(82)

Safeguarding the confidentiality of the identity of the reporting person during the reporting process and investigations triggered by the report is an essential ex-ante measure to prevent retaliation. It should only be possible to disclose the identity of the reporting person where that is a necessary and proportionate obligation under Union or national law in the context of investigations by authorities or judicial proceedings, in particular to safeguard the rights of defence of persons concerned. Such an obligation could derive, in particular, from Directive 2012/13/EU of the European Parliament and of the Council (42). The protection of confidentiality should not apply where the reporting person has intentionally revealed his or her identity in the context of a public disclosure.

Luxembourg specificity

loi luxembourgeoise du 16 mai 2023 relative a la protection des lanceurs d'alerte

In Luxembourg, article 16 of the law of 16 May 2023 on whistleblower protection strictly transposes recital 82: confidentiality of identity can only be lifted with prior written notification to the reporter stating the reasons for disclosure, unless such notification would compromise the investigation or judicial proceedings. Breach of this confidentiality is punished by a fine of EUR 1,250 to 25,000 (doubled in case of recidivism), independently from civil compensation owed to the reporter.

Luxgap practice: ensure your internal channel automatically generates the prior notification to the reporter and retains timestamped proof of delivery, enforceable against the OFRS in case of complaint.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Confidentiality of the reporting person's identity is not optional: it is the n°1 ex-ante measure against retaliation. The Luxembourg OFRS and the CNPD systematically sanction organisations that leak identity through a misrouted email, a channel shared with HR, or a ticketing tool without proper segregation. Recital 82 strictly limits disclosure cases: only under a legal, proportionate obligation, in the context of an authority investigation or judicial proceedings.

Operational pitfalls to anticipate

Generic mailbox alert@company.lu hosted on standard M365, readable by IT, HR or an executive assistant.
Ticketing tool (Jira, ServiceNow, Zendesk) where administrators see the reporter's metadata (IP, AD account, timestamp).
Oral transmission of the reporter's name to the manager during the internal investigation, with no traceability or proportionality justification.
Absence of written procedure defining who can lift confidentiality, on what legal basis (Directive 2012/13/EU, LU criminal procedure code), and with what prior notice to the reporter.
Confusion between voluntary public disclosure (press, social media) and internal report: only the former extinguishes confidentiality protection.

How Luxgap automates this risk

Our Luxgap Whistleblower Vault makes it technically impossible to leak the reporter's identity, even against a malicious internal IT administrator. The tool relies on end-to-end encryption with cryptographic separation of metadata: only the designated whistleblowing officers (typically 2 individuals listed in the OFRS register) hold the decryption key, outside the organisation's M365 or Google Workspace infrastructure.

Provides web and phone reporting channels anonymised by default, with a pseudonymous identifier allowing the reporter to dialogue without revealing identity.
Cryptographically segregates each case file: Azure AD administrators, HR and internal IT see neither content nor metadata, even with root access to the tenant.
Logs every access to the case file in a sealed RFC 3161 timestamped journal, enforceable against the OFRS and CNPD during an audit or reporter complaint.
Triggers a controlled confidentiality lifting workflow: any disclosure request is documented in writing, validated by the DPO, and notified to the reporter before transmission to the judicial authority pursuant to article 16 of the law of 16 May 2023.
Automatically detects voluntary public disclosure signals (press mention, LinkedIn post) to adjust the protection scope without manual intervention.
Produces an annual confidentiality integrity report, enforceable during an OFRS audit or ITM inspection.

Available as a complement to a Luxgap DPO or CISO mandate or as a standalone SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your real configuration, with a free 48h white audit to measure potential leaks in your current channels before any engagement.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 82

They trust us

Before we chat