I need to bring my Luxembourg organisation into compliance with recital 91 of Whistleblowing (UE 2019/1937). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Recital 91 Whistleblowing — Recital 91

EU frameworkGDPR NIS 2 DORA AI ActWhistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 91

Directive on the protection of persons who report breaches of Union law · UE 2019/1937

(91)

It should not be possible to rely on individuals' legal or contractual obligations, such as loyalty clauses in contracts or confidentiality or non-disclosure agreements, so as to preclude reporting, to deny protection or to penalise reporting persons for having reported information on breaches or made a public disclosure where providing the information falling within the scope of such clauses and agreements is necessary for revealing the breach. Where those conditions are met, reporting persons should not incur any kind of liability, be it civil, criminal, administrative or employment-related. It is appropriate that there be protection from liability for the reporting or public disclosure under this Directive of information in respect of which the reporting person had reasonable grounds to believe that reporting or public disclosure was necessary to reveal a breach pursuant to this Directive. Such protection should not extend to superfluous information that the person revealed without having such reasonable grounds.

Luxembourg specificity

loi luxembourgeoise du 16 mai 2023 relative a la protection des lanceurs d'alerte

In Luxembourg, Article 25 of the law of 16 May 2023 on whistleblower protection directly transposes the principle of recital 91: the reporting person incurs no civil, criminal, administrative or disciplinary liability for disclosing information covered by a legal or contractual confidentiality obligation, provided they had reasonable grounds to believe the disclosure was necessary to reveal the breach. Any contrary contractual clause is deemed void and an employer invoking it faces the criminal penalties of EUR 1,250 to 25,000 (doubled for repeat offences) provided by the law.

Luxgap practice: systematically audit your employment contract templates, supplier NDAs and ethics charters to insert the explicit carve-out "without prejudice to the law of 16 May 2023", before a report exposes your HR leadership to an ITM or OFRS case.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

The employer pulls out the confidentiality clause in the employment contract, the NDA signed at onboarding or the loyalty clause to neutralise a whistleblower, or even to trigger civil or criminal liability. Recital 91 closes that door: no contractual obligation can be invoked against a report where disclosing the information was necessary to reveal the breach. The OFRS and ITM check in practice that internal policies and HR charters do not contain dissuasive clauses, and the CNPD ensures that NDAs are not weaponised under the banner of data protection to silence alerts.

The necessity test: what is protected and what is not

Protected: revealing a confidential document strictly useful to demonstrate the breach (rigged contract, compromising email, accounting extract).
Protected: citing information covered by an NDA if it is the very subject of the reported breach.
Not protected: disclosing superfluous information unrelated to the breach, or done to harm.
Central criterion: reasonable grounds to believe disclosure was necessary, assessed at the time of reporting, not retrospectively.
Full exoneration: where the conditions are met, no civil, criminal, administrative or employment-related liability.
Contract vigilance: any loyalty clause, NDA or penalty clause purporting to prohibit reporting is deemed unwritten.

How Luxgap automates this risk

Our Luxgap Contract Clause Sentinel eliminates the risk that a dormant clause in your HR or commercial templates is later interpreted as an obstacle to reporting. A specialised LLM agent continuously analyses your contractual library (DocuSign, Odoo Sign, SharePoint, Sage HR, Workday) and automatically detects confidentiality, loyalty, non-disparagement and NDA clauses that lack the mandatory carve-out "without prejudice to the law of 16 May 2023 on whistleblower protection".

Scans the full set of employment contracts, NDAs, commercial agreements and ethics charters stored in SharePoint, Odoo, DocuSign or Sage BOB 50 to identify problematic clauses.
Classifies each clause by severity (quantified penalty clause, ban on external communication, exclusive internal escalation duty) and proposes the compliant rewording.
Generates the corrective addenda with the ready-to-sign whistleblowing carve-out, tailored by contract type: permanent, fixed-term, freelance, supplier, director.
Instantly alerts the DPO and legal team whenever a new contractual template is deployed without the required safeguard clause.
Produces a timestamped PDF report, enforceable before the OFRS and ITM during an inspection, demonstrating that your contractual corpus does not deter reporting.

Available as a complement to a Luxgap DPO or CISO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your real contract templates, with a free 48h blank audit to measure your exposure before any engagement.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 91

They trust us

Before we chat