I need to bring my Luxembourg organisation into compliance with recital 92 of Whistleblowing (UE 2019/1937). What are the concrete requirements, the sanctions, and how can Luxgap support me?

The classic trapRecital 92 draws a fragile line: a whistleblower who copies, photographs or removes documents to which they have lawful access enjoys civil, administrative and labour immunity. But the moment they read a colleague's mailbox, break into a server or enter a restricted area, they potentially fall into criminal territory (Article 509-1 of the Luxembourg Criminal Code on fraudulent access to an automated processing system). In practice, the OFRS and the ITM look at whether the act was necessary and proportionate to the disclosure, while the public prosecutor separately assesses the underlying technical offence.The 'necessary and proportionate' test: grey zones to mapLawful access + external copy: an employee who prints a disputed contract they normally access and takes it home to prepare their report remains protected, even where the IT charter forbids it.Access to files outside the functional scope: consulting an HR or accounting folder that one has no business accessing but which is not technically locked falls under civil / disciplinary liability, therefore covered by immunity.Hacking, authentication bypass, credential theft: criminal liability remains in full, the directive's immunity does NOT neutralise Article 509-1.Photographing premises: covered if necessary for evidence, problematic where it exposes personal data of third parties unrelated to the breach (GDPR caution).Documents under professional secrecy (medical, CSSF banking, lawyer): immunity yields to the protected secrets listed in Article 3 of the law of 16 May 2023.On the employer side, the mirror trap is to multiply disciplinary or judicial actions (criminal complaint for document theft, breach of trust, violation of confidentiality clauses) which will be reclassified as retaliatory measures by the OFRS, with reversal of the burden of proof and compensation as a consequence.How Luxgap automates this riskOur Luxgap Whistleblower Evidence Shield eliminates the grey zone between lawful access and criminal offence by mapping, upfront, who has access to what in your IS and by qualifying each evidence-gathering action performed by a presumed whistleblower. The tool cross-references your Active Directory logs, Microsoft 365 Audit, Defender for Cloud Apps and your DLP policies to reconstruct the reporter's access history over the 12 months preceding the report, and a legal AI agent qualifies each action against the recital 92 grid (lawful / civilly covered / criminally exposed).Automatically reconstructs the reporter's access map to relevant files, emails and premises based on M365, Azure AD, Salto or Kaba badge logs, without questioning the reporter.Classifies each gathering action into three zones (lawful, civilly immunised, criminally exposed) based on Article 509-1 of the Criminal Code and Article 21(7) of the directive.Detects signs of disguised retaliation (disciplinary procedure opened within 90 days of the report, criminal complaint for document theft, sudden access...

Recital 92 Whistleblowing — Recital 92

EU frameworkGDPR NIS 2 DORA AI ActWhistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 92

Directive on the protection of persons who report breaches of Union law · UE 2019/1937

(92)

Where reporting persons lawfully acquire or obtain access to the information on breaches reported or the documents containing that information, they should enjoy immunity from liability. This should apply both in cases where reporting persons reveal the content of documents to which they have lawful access as well as in cases where they make copies of such documents or remove them from the premises of the organisation where they are employed, in breach of contractual or other clauses stipulating that the relevant documents are the property of the organisation. The reporting persons should also enjoy immunity from liability in cases where the acquisition of or access to the relevant information or documents raises an issue of civil, administrative or labour-related liability. Examples would be cases where the reporting persons acquired the information by accessing the emails of a co-worker or files which they normally do not use within the scope of their work, by taking pictures of the premises of the organisation or by accessing locations they do not usually have access to. Where the reporting persons acquired or obtained access to the relevant information or documents by committing a criminal offence, such as physical trespassing or hacking, their criminal liability should remain governed by the applicable national law, without prejudice to the protection granted under Article 21(7) of this Directive. Similarly, any other possible liability of the reporting persons arising from acts or omissions which are unrelated to the reporting or are not necessary for revealing a breach pursuant to this Directive should remain governed by the applicable Union or national law. In those cases, it should be for the national courts to assess the liability of the reporting persons in the light of all relevant factual information and taking into account the individual circumstances of the case, including the necessity and proportionality of the act or omission in relation to the report or public disclosure.

Luxembourg specificity

loi luxembourgeoise du 16 mai 2023 relative a la protection des lanceurs d'alerte

In Luxembourg, Article 18 of the law of 16 May 2023 on whistleblower protection enshrines civil, administrative and professional immunity for the lawful acquisition of information, but Article 509-1 of the Criminal Code continues to apply in full to fraudulent access to a computer system (penalties up to 2 years imprisonment and EUR 25,000 fine). The labour court and the Superior Court of Justice assess the necessary and proportionate nature on a case-by-case basis.

Luxgap practice: systematically document, from receipt of a report, the legitimate access scope of the reporter via a timestamped Azure AD snapshot, to distinguish what falls under Article 18 immunity from what may fall under Article 509-1.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Recital 92 draws a fragile line: a whistleblower who copies, photographs or removes documents to which they have lawful access enjoys civil, administrative and labour immunity. But the moment they read a colleague's mailbox, break into a server or enter a restricted area, they potentially fall into criminal territory (Article 509-1 of the Luxembourg Criminal Code on fraudulent access to an automated processing system). In practice, the OFRS and the ITM look at whether the act was necessary and proportionate to the disclosure, while the public prosecutor separately assesses the underlying technical offence.

The 'necessary and proportionate' test: grey zones to map

Lawful access + external copy: an employee who prints a disputed contract they normally access and takes it home to prepare their report remains protected, even where the IT charter forbids it.
Access to files outside the functional scope: consulting an HR or accounting folder that one has no business accessing but which is not technically locked falls under civil / disciplinary liability, therefore covered by immunity.
Hacking, authentication bypass, credential theft: criminal liability remains in full, the directive's immunity does NOT neutralise Article 509-1.
Photographing premises: covered if necessary for evidence, problematic where it exposes personal data of third parties unrelated to the breach (GDPR caution).
Documents under professional secrecy (medical, CSSF banking, lawyer): immunity yields to the protected secrets listed in Article 3 of the law of 16 May 2023.

On the employer side, the mirror trap is to multiply disciplinary or judicial actions (criminal complaint for document theft, breach of trust, violation of confidentiality clauses) which will be reclassified as retaliatory measures by the OFRS, with reversal of the burden of proof and compensation as a consequence.

How Luxgap automates this risk

Our Luxgap Whistleblower Evidence Shield eliminates the grey zone between lawful access and criminal offence by mapping, upfront, who has access to what in your IS and by qualifying each evidence-gathering action performed by a presumed whistleblower. The tool cross-references your Active Directory logs, Microsoft 365 Audit, Defender for Cloud Apps and your DLP policies to reconstruct the reporter's access history over the 12 months preceding the report, and a legal AI agent qualifies each action against the recital 92 grid (lawful / civilly covered / criminally exposed).

Automatically reconstructs the reporter's access map to relevant files, emails and premises based on M365, Azure AD, Salto or Kaba badge logs, without questioning the reporter.
Classifies each gathering action into three zones (lawful, civilly immunised, criminally exposed) based on Article 509-1 of the Criminal Code and Article 21(7) of the directive.
Detects signs of disguised retaliation (disciplinary procedure opened within 90 days of the report, criminal complaint for document theft, sudden access revocation) and alerts the DPO and legal counsel.
Generates a pre-drafted defence memo for the reporter or the employer, enforceable before the ITM, the OFRS or the labour court, demonstrating the necessary and proportionate nature or, on the contrary, the excess.
Produces a timestamped, cryptographically sealed PDF report that materialises the evidence chain, admissible in civil or criminal litigation.
Synchronises with your internal reporting channel to freeze the IS state at time T of the report and prevent any subsequent rewriting of permissions.

Available as a complement to a Luxgap DPO or CISO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your real environment, with a free blank audit within 48h to measure your exposure before any commitment.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 92

They trust us

Before we chat