I need to bring my Luxembourg organisation into compliance with recital 83 of Whistleblowing (UE 2019/1937). What are the concrete requirements, the sanctions, and how can Luxgap support me?

The classic trapRecital 83 reminds us that the whistleblowing channel is also a personal data processing operation fully subject to GDPR, the law-enforcement directive and Regulation 2018/1725 for EU institutions. In practice, the CNPD sanctions two recurring failures: alert channels deployed without a documented legal basis (often a Google Form or a shared mailbox) and the absence of privacy by design on the platform (logs accessible to the entire IT department, no pseudonymisation of the reporter, unlimited retention). Article 5 GDPR and Article 25 GDPR are the two systematic checkpoints.The 'privacy by design' test applied to a whistleblowing channelMinimisation: the form must not request the reporter's identity if it is not essential to the investigation (Article 5(1)(c)).Purpose limitation: data collected to handle a report cannot feed an HR or disciplinary file unrelated to the alert.Security by default: end-to-end encryption, strict access partitioning (only the referent and the DPO), access logging.Retention: duration defined by purpose (investigation, judicial follow-up), automated purge thereafter.Data subjects' rights: information to the accused person may be deferred (Article 14(5)(b) GDPR) but not suppressed, with a documented rights-exercise procedure.Mandatory DPIA: a whistleblowing channel systematically meets Article 35 GDPR criteria (sensitive data, monitoring, reporter vulnerability).Transfers: if the platform is hosted outside the EU (frequent US vendor case), a TIA and standard contractual clauses are mandatory.How Luxgap automates this riskOur Luxgap Whistleblowing Privacy Shield turns your reporting platform into a privacy by design channel auditable at any time by the CNPD and the OFRS. The tool connects to your alert solution (EQS, WhistleB, NAVEX, or custom-built internal channel), continuously scans the real GDPR configuration and produces cryptographically sealed Article 5(2) accountability evidence, without manual re-entry by the DPO.Automatically detects every form field that collects data not strictly necessary and proposes removal or making it optional.Verifies in real time the partitioning of access (who can read which alert) and triggers a Teams alert as soon as a new user is added to the investigation group.Generates the Article 35 GDPR DPIA ready to file with the CNPD, tailored specifically to Directive 2019/1937 and the LU law of 16 May 2023.Calculates retention duration by alert typology (closed without action, forwarded to the prosecutor, disciplinary sanction) and triggers automated purge with timestamping.Performs the TIA if the platform is hosted outside the EU and produces standard contractual clauses ready for signature.Produces a signed timestamped PDF report, enforceable before the CNPD and the OFRS during an inspection, demonstrating combined Directive 2019/1937 + GDPR compliance.Available as a complement to a Luxgap DPO mandate or as a dedicated SaaS module depending on your scope. Request a tail...

Recital 83 Whistleblowing — Recital 83

EU frameworkGDPR NIS 2 DORA AI ActWhistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 83

Directive on the protection of persons who report breaches of Union law · UE 2019/1937

(83)

Any processing of personal data carried out pursuant to this Directive, including the exchange or transmission of personal data by the competent authorities, should be undertaken in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (43) and with Directive (EU) 2016/680 of the European Parliament and of the Council (44). Any exchange or transmission of information by Union institutions, bodies, offices or agencies should be undertaken in accordance with Regulation (EU) 2018/1725 of the European Parliament and of the Council (45). Particular regard should be had to the principles relating to processing of personal data set out in Article 5 of Regulation (EU) 2016/679, Article 4 of Directive (EU) 2016/680 and Article 4 of Regulation (EU) 2018/1725, and to the principle of data protection by design and by default laid down in Article 25 of Regulation (EU) 2016/679, Article 20 of Directive (EU) 2016/680 and Articles 27 and 85 of Regulation (EU) 2018/1725.

Luxembourg specificity

loi luxembourgeoise du 16 mai 2023 relative a la protection des lanceurs d'alerte

In Luxembourg, the law of 16 May 2023 on whistleblower protection explicitly articulates the internal channel with the GDPR: the OFRS requires a prior DPIA and the CNPD considers the alert channel a high-risk processing by nature. The reporter's identity benefits from reinforced confidentiality enforceable even against Article 15 GDPR access requests by the accused person, save by court order.

Luxgap practice: document the DPIA consistently with CNPD guidelines on HR processing and implement strict technical partitioning between the reporter's identity and the alert content, demonstrable during a joint CNPD-OFRS inspection.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Recital 83 reminds us that the whistleblowing channel is also a personal data processing operation fully subject to GDPR, the law-enforcement directive and Regulation 2018/1725 for EU institutions. In practice, the CNPD sanctions two recurring failures: alert channels deployed without a documented legal basis (often a Google Form or a shared mailbox) and the absence of privacy by design on the platform (logs accessible to the entire IT department, no pseudonymisation of the reporter, unlimited retention). Article 5 GDPR and Article 25 GDPR are the two systematic checkpoints.

The 'privacy by design' test applied to a whistleblowing channel

Minimisation: the form must not request the reporter's identity if it is not essential to the investigation (Article 5(1)(c)).
Purpose limitation: data collected to handle a report cannot feed an HR or disciplinary file unrelated to the alert.
Security by default: end-to-end encryption, strict access partitioning (only the referent and the DPO), access logging.
Retention: duration defined by purpose (investigation, judicial follow-up), automated purge thereafter.
Data subjects' rights: information to the accused person may be deferred (Article 14(5)(b) GDPR) but not suppressed, with a documented rights-exercise procedure.
Mandatory DPIA: a whistleblowing channel systematically meets Article 35 GDPR criteria (sensitive data, monitoring, reporter vulnerability).
Transfers: if the platform is hosted outside the EU (frequent US vendor case), a TIA and standard contractual clauses are mandatory.

How Luxgap automates this risk

Our Luxgap Whistleblowing Privacy Shield turns your reporting platform into a privacy by design channel auditable at any time by the CNPD and the OFRS. The tool connects to your alert solution (EQS, WhistleB, NAVEX, or custom-built internal channel), continuously scans the real GDPR configuration and produces cryptographically sealed Article 5(2) accountability evidence, without manual re-entry by the DPO.

Automatically detects every form field that collects data not strictly necessary and proposes removal or making it optional.
Verifies in real time the partitioning of access (who can read which alert) and triggers a Teams alert as soon as a new user is added to the investigation group.
Generates the Article 35 GDPR DPIA ready to file with the CNPD, tailored specifically to Directive 2019/1937 and the LU law of 16 May 2023.
Calculates retention duration by alert typology (closed without action, forwarded to the prosecutor, disciplinary sanction) and triggers automated purge with timestamping.
Performs the TIA if the platform is hosted outside the EU and produces standard contractual clauses ready for signature.
Produces a signed timestamped PDF report, enforceable before the CNPD and the OFRS during an inspection, demonstrating combined Directive 2019/1937 + GDPR compliance.

Available as a complement to a Luxgap DPO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your real alert channel, with a free 48-hour blank audit to measure your exposure before any commitment.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 83

They trust us

Before we chat