Recital 86
Directive on the protection of persons who report breaches of Union law · UE 2019/1937
| (86) | Member States should ensure that there is adequate record-keeping as regards all reports of breaches, that every report is retrievable and that information received through reports can be used as evidence in enforcement actions where appropriate. |
In Luxembourg, the law of 16 May 2023 on the protection of whistleblowers does not set a uniform retention period: each report must be kept as long as necessary and proportionate to the purposes (Article 10), with a documented justification under GDPR. The OFRS may request the production of archives as part of its mandate, and Luxembourg courts accept reports as evidence subject to whistleblower confidentiality being preserved.
Luxgap practice: we configure the retention matrix by report type (criminal 10 years, GDPR 5 years, ITM 5 years, internal misconduct 3 years) and document the legal basis in the GDPR Article 30 register, for a scheme that is opposable during an OFRS or CNPD audit.
