EU frameworkGDPRNIS 2DORAAI ActWhistleblowing
Recital 87

Recital 87

Directive on the protection of persons who report breaches of Union law · UE 2019/1937

(87)

Reporting persons should be protected against any form of retaliation, whether direct or indirect, taken, encouraged or tolerated by their employer or customer or recipient of services and by persons working for or acting on behalf of the latter, including colleagues and managers in the same organisation or in other organisations with which the reporting person is in contact in the context of his or her work-related activities

Luxembourg specificity
loi du 16 mai 2023 relative a la protection des lanceurs d'alerte

In Luxembourg, the law of 16 May 2023 on the protection of whistleblowers transposes this recital by expressly prohibiting any form of direct or indirect retaliation (article 17), with a non-exhaustive list of 15 prohibited measures. The reporting person benefits from a reversed burden of proof before the ITM and labour courts: any unfavourable act occurring after a report is presumed to be retaliation, unless the employer proves otherwise. Criminal penalties range from EUR 1,250 to EUR 25,000, doubled in case of repeat offence, in addition to civil compensation.

Luxgap practice: lock down the HR traceability of the reporting person as soon as the report is registered, because before the ITM, it is the absence of evidence on your side that condemns, not proven malice.