I need to bring my Luxembourg organisation into compliance with recital 88 of Whistleblowing (UE 2019/1937). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Recital 88 Whistleblowing — Recital 88

EU frameworkGDPR NIS 2 DORA AI ActWhistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 88

Directive on the protection of persons who report breaches of Union law · UE 2019/1937

(88)

Where retaliation occurs undeterred and unpunished, it has a chilling effect on potential whistleblowers. A clear legal prohibition of retaliation would have an important dissuasive effect, and would be further strengthened by provisions for personal liability and penalties for the perpetrators of retaliation.

Luxembourg specificity

loi luxembourgeoise du 16 mai 2023 relative a la protection des lanceurs d'alerte

In Luxembourg, the law of 16 May 2023 on the protection of whistleblowers translates recital 88 into personal criminal sanctions: perpetrators of retaliation face a fine of EUR 1,250 to 25,000, doubled in case of recidivism, cumulable with civil damages awarded to the whistleblower. The OFRS can be seized directly and investigates with full powers.

Luxgap practice: we configure the Retaliation Sentinel to produce a file directly usable by the OFRS, with timestamped chronology and pre-formulated criminal qualification, which significantly accelerates the sanction procedure and materialises the dissuasive effect sought by recital 88.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Recital 88 clarifies the spirit of the directive: without effective and personal sanctions against the perpetrators of retaliation, the prohibition remains cosmetic. In practice, the OFRS and ITM examine whether the organisation has not only banned retaliation in a policy, but also set up a mechanism for detection, internal investigation and real disciplinary sanction against the managers at fault. The absence of traceability of HR decisions post-report (transfer, denial of promotion, degraded evaluation) is the first sign of a fake system.

Operationalising the legislator's intent

Embed in the internal regulations an explicit prohibition of retaliation qualified as gross misconduct, with personal liability of the manager.
Trace every unfavourable HR decision concerning a whistleblower for at least 24 months after the report, with written justification reviewed by an independent third party.
Reverse the burden of proof in the internal investigation: the manager must demonstrate that the measure is not linked to the report.
Sanction effectively, not just warn: the directive requires a dissuasive effect, which implies visible and communicated sanctions.

How Luxgap automates this risk

Our Luxgap Retaliation Sentinel makes silent retaliation impossible by cross-referencing in real time your HRIS (Sopra Steria HR Suite, Workday LU, Sage BOB 50) with the whistleblowing register, to automatically detect any adverse HR decision targeting a whistleblower within 24 months of their report. The tool does not require the DPO or compliance officer to monitor manually, it pulls HR data via API and triggers an alert as soon as a weak signal appears.

Automatically detects any transfer, change of manager, drop in evaluation, denial of promotion or contract termination affecting a person who has filed a report or assisted a whistleblower.
Calculates a retaliation risk score by cross-referencing the timeline of the report, the nature of the HR decision and the manager involved.
Automatically generates the internal investigation file with reversed burden of proof, pre-filled with factual elements extracted from the HRIS.
Alerts the ethics committee via Teams or encrypted email as soon as a score exceeds the threshold, with an immutable timestamped audit trail.
Produces a cryptographically sealed PDF report, admissible before the OFRS or ITM, demonstrating the organisation's diligence in detecting and sanctioning retaliation.
Tracks the effective execution of disciplinary sanctions pronounced against perpetrators of retaliation, in line with the spirit of recital 88.

Available as a complement to a Luxgap DPO or CISO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your real HR data, with a free 48-hour blind audit to measure your exposure to silent retaliation before any engagement.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 88

They trust us

Before we chat