I need to bring my Luxembourg organisation into compliance with recital 84 of Whistleblowing (UE 2019/1937). What are the concrete requirements, the sanctions, and how can Luxgap support me?

The classic trapRecital 84 is the legal foundation that allows organisations to restrict GDPR rights of the person concerned (right of access, right to information, right to rectification) during an internal whistleblowing investigation. The CNPD sanctions two opposite drifts: either the organisation reveals the whistleblower's identity by naively answering an article 15 access request from the accused person, or it abuses article 23 GDPR to block any right indefinitely, without legislative basis or proportionality. In Luxembourg, the articulation between the law of 16 May 2023 and the GDPR must be traced at every request.The concrete trade-offs to documentGDPR access request from the accused during the investigation: motivated refusal based on article 23(1)(e) and (i) GDPR plus the Luxembourg law of 16 May 2023, with planned lifting date.Right to information of the accused (article 14 GDPR): deferred until the end of the investigation to avoid compromising evidence.Whistleblower's identity: never disclosed, even under cover of an access request, unless explicit consent or judicial obligation.Duration of the restriction: strictly limited to the investigation phase, with re-evaluation at each step.Restriction register: every partial or total refusal of GDPR right must be logged with legal basis, purpose, duration and proportionality test.Deferred information: once the restriction is lifted, the data subject must be informed of the restriction and its general motive.How Luxgap automates this riskOur Luxgap Whistleblowing Rights Shield turns the delicate trade-off between the accused person's GDPR rights and the whistleblower's confidentiality into a traced, motivated and opposable decision. The tool intercepts every GDPR rights request received while a whistleblowing investigation is open, automatically cross-references the requester's identity with the active reports register, and offers the DPO a pre-drafted response that invokes the right article 23 GDPR restriction basis without ever exposing the whistleblower's identity.Automatically detects conflicts between an article 15 GDPR access request and an ongoing whistleblowing investigation, by cross-referencing the GDPR CRM with the reporting platform.Generates a motivated response invoking article 23(1)(e) and (i) GDPR coupled with the Luxembourg law of 16 May 2023, with a documented proportionality test.Calculates the maximum admissible restriction duration and triggers a Teams or Outlook alert at the mandatory re-evaluation date.Logs each restriction in a cryptographically sealed register, opposable to the CNPD in case of complaint from the accused.Automatically triggers deferred information to the data subject at the closing of the investigation, in line with article 23(2) GDPR.Produces a timestamped PDF report per case, demonstrating that the organisation has respected both the whistleblower's confidentiality and the accused person's residual rights.Available as a complement to a Luxgap DP...

Recital 84 Whistleblowing — Recital 84

EU frameworkGDPR NIS 2 DORA AI ActWhistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 84

Directive on the protection of persons who report breaches of Union law · UE 2019/1937

(84)

The procedures provided for in this Directive and related to follow-up on reports of breaches of Union law in the areas falling within its scope serve an important objective of general public interest of the Union and of the Member States, within the meaning of point (e) of Article 23(1) of Regulation (EU) 2016/679, as they aim to enhance the enforcement of Union law and policies in specific areas where breaches can cause serious harm to the public interest. The effective protection of the confidentiality of the identity of reporting persons is necessary for the protection of the rights and freedoms of others, in particular those of the reporting persons, provided for under point (i) of Article 23(1) of Regulation (EU) 2016/679. Member States should ensure that this Directive is effective, including, where necessary, by restricting, by legislative measures, the exercise of certain data protection rights of persons concerned in line with points (e) and (i) of Article 23(1) and Article 23(2) of Regulation (EU) 2016/679 to the extent, and as long as, necessary to prevent and address attempts to hinder reporting or to impede, frustrate or slow down follow-up, in particular investigations, or attempts to find out the identity of the reporting persons.

Luxembourg specificity

loi luxembourgeoise du 16 mai 2023 relative a la protection des lanceurs d'alerte

In Luxembourg, the law of 16 May 2023 on the protection of whistleblowers (articles 9 and 16) expressly enshrines the confidentiality of the whistleblower's identity as an absolute obligation, the breach of which is criminally sanctioned (fine of 1,250 to 25,000 EUR, doubled in case of repeat offence). The CNPD remains competent for article 23 GDPR arbitrations, and the OFRS for the whistleblowing dimension: both can be seized in parallel by the accused and by the whistleblower.

Luxgap practice: trace each GDPR right restriction in a dedicated register, with dual legal basis (article 23 GDPR + law of 16 May 2023), ready to be produced simultaneously before the CNPD and the OFRS.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Recital 84 is the legal foundation that allows organisations to restrict GDPR rights of the person concerned (right of access, right to information, right to rectification) during an internal whistleblowing investigation. The CNPD sanctions two opposite drifts: either the organisation reveals the whistleblower's identity by naively answering an article 15 access request from the accused person, or it abuses article 23 GDPR to block any right indefinitely, without legislative basis or proportionality. In Luxembourg, the articulation between the law of 16 May 2023 and the GDPR must be traced at every request.

The concrete trade-offs to document

GDPR access request from the accused during the investigation: motivated refusal based on article 23(1)(e) and (i) GDPR plus the Luxembourg law of 16 May 2023, with planned lifting date.
Right to information of the accused (article 14 GDPR): deferred until the end of the investigation to avoid compromising evidence.
Whistleblower's identity: never disclosed, even under cover of an access request, unless explicit consent or judicial obligation.
Duration of the restriction: strictly limited to the investigation phase, with re-evaluation at each step.
Restriction register: every partial or total refusal of GDPR right must be logged with legal basis, purpose, duration and proportionality test.
Deferred information: once the restriction is lifted, the data subject must be informed of the restriction and its general motive.

How Luxgap automates this risk

Our Luxgap Whistleblowing Rights Shield turns the delicate trade-off between the accused person's GDPR rights and the whistleblower's confidentiality into a traced, motivated and opposable decision. The tool intercepts every GDPR rights request received while a whistleblowing investigation is open, automatically cross-references the requester's identity with the active reports register, and offers the DPO a pre-drafted response that invokes the right article 23 GDPR restriction basis without ever exposing the whistleblower's identity.

Automatically detects conflicts between an article 15 GDPR access request and an ongoing whistleblowing investigation, by cross-referencing the GDPR CRM with the reporting platform.
Generates a motivated response invoking article 23(1)(e) and (i) GDPR coupled with the Luxembourg law of 16 May 2023, with a documented proportionality test.
Calculates the maximum admissible restriction duration and triggers a Teams or Outlook alert at the mandatory re-evaluation date.
Logs each restriction in a cryptographically sealed register, opposable to the CNPD in case of complaint from the accused.
Automatically triggers deferred information to the data subject at the closing of the investigation, in line with article 23(2) GDPR.
Produces a timestamped PDF report per case, demonstrating that the organisation has respected both the whistleblower's confidentiality and the accused person's residual rights.

Available as a complement to a Luxgap DPO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your real cases, with a free 48h audit to measure your exposure before any engagement.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 84

They trust us

Before we chat