I need to bring my Luxembourg organisation into compliance with recital 99 of Whistleblowing (UE 2019/1937). What are the concrete requirements, the sanctions, and how can Luxgap support me?

The classic trapA whistleblower who has been dismissed, sidelined or informally blacklisted in their sector (common in Luxembourg finance and Big Four firms) finds themselves without income at the very moment they must advance EUR 5,000 to 30,000 in legal fees to challenge retaliation before the Labour Court. Without rapid financial support, they abandon the proceedings and the protection mechanism set out in the law of 16 May 2023 becomes a dead letter. The OFRS and ITM observe in their reports that most retaliation cases are never litigated for this economic reason, not a legal one.What this recital concretely requires from organisationsEven though recital 99 is primarily addressed to Member States to organise legal aid, it directly shapes the operational obligations of companies and their internal channels:Explicitly inform the whistleblower, from the acknowledgement of receipt of the report, of the existence of Luxembourg legal aid and the eligibility conditions.Document this information in the written internal procedure required by article 6 of the law of 16 May 2023, otherwise the employer's defence will be weakened in subsequent litigation.Never make internal support (mediation, return to assignment, settlement) conditional on waiving legal remedies, which would constitute disguised retaliation.Anticipate that any dismissal or sanction following a report will be read by the judge in light of the financial asymmetry between the parties, with a reversed burden of proof on the employer.How Luxgap automates this riskOur Luxgap Whistleblower Shield turns your reporting channel into a platform that automatically materialises, for each report received, the full protection journey of the whistleblower including information on legal aid and available remedies. The tool integrates natively with your M365 mailbox, your HR suite (Sopra HR, Workday LU, SD Worx) and your external counsel to produce a cryptographically sealed trace of each step, enforceable before OFRS, ITM and the Labour Court.Automatically generates, upon the 7-day acknowledgement of receipt, a personalised letter to the whistleblower detailing their rights, the contact details of the Service d'accueil et d'information juridique and the conditions for Luxembourg legal aid.Detects weak signals of post-report retaliation (transfer, access revocation, bonus reduction, downgraded performance review) by cross-referencing HR flows, Active Directory and expense notes over the 24 months following the report.Calculates a litigation risk score per case, based on the actual timeline between the report and any adverse measure, and alerts the DPO and legal counsel as soon as a critical threshold is reached.Produces a timestamped PDF case file, enforceable before the Labour Court, demonstrating the absence of causation between report and HR decision.Archives all exchanges in an eIDAS-qualified digital vault, accessible only to the integrity officer and the DPO, with an immutable access log.Availa...

Recital 99 Whistleblowing — Recital 99

EU frameworkGDPR NIS 2 DORA AI ActWhistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 99

Directive on the protection of persons who report breaches of Union law · UE 2019/1937

(99)

A significant cost for reporting persons contesting retaliation measures taken against them in legal proceedings can be the relevant legal fees. Although they could recover such fees at the end of the proceedings, they might not be able to pay those fees if charged at the outset of proceedings, especially if they are unemployed and blacklisted. Assistance for criminal legal proceedings, particularly where the reporting persons meet the conditions of Directive (EU) 2016/1919 of the European Parliament and of the Council (47), and, more generally, support to those who are in serious financial need might be key, in certain cases, for the effective enforcement of their rights to protection.

Luxembourg specificity

loi du 16 mai 2023 relative a la protection des lanceurs d'alerte

In Luxembourg, the law of 16 May 2023 on the protection of whistleblowers does not create a dedicated financial support fund for whistleblowers, but refers to the general legal aid scheme governed by the amended law of 10 August 1991 on the legal profession. The OFRS (Office des rapports de signalement) also plays an information role on available remedies and refers whistleblowers to the Service d'accueil et d'information juridique of the Public Prosecutor. Article 19 of the law of 16 May 2023 further provides for full compensation of damages suffered as a result of retaliation, including legal fees incurred.

Luxgap practice: systematically include in the acknowledgement of receipt of the report a standardised section referring to the OFRS and the Service d'accueil et d'information juridique, and keep the timestamped proof of sending, this is the first question the ITM inspector will ask in case of dispute.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

A whistleblower who has been dismissed, sidelined or informally blacklisted in their sector (common in Luxembourg finance and Big Four firms) finds themselves without income at the very moment they must advance EUR 5,000 to 30,000 in legal fees to challenge retaliation before the Labour Court. Without rapid financial support, they abandon the proceedings and the protection mechanism set out in the law of 16 May 2023 becomes a dead letter. The OFRS and ITM observe in their reports that most retaliation cases are never litigated for this economic reason, not a legal one.

What this recital concretely requires from organisations

Even though recital 99 is primarily addressed to Member States to organise legal aid, it directly shapes the operational obligations of companies and their internal channels:

Explicitly inform the whistleblower, from the acknowledgement of receipt of the report, of the existence of Luxembourg legal aid and the eligibility conditions.
Document this information in the written internal procedure required by article 6 of the law of 16 May 2023, otherwise the employer's defence will be weakened in subsequent litigation.
Never make internal support (mediation, return to assignment, settlement) conditional on waiving legal remedies, which would constitute disguised retaliation.
Anticipate that any dismissal or sanction following a report will be read by the judge in light of the financial asymmetry between the parties, with a reversed burden of proof on the employer.

How Luxgap automates this risk

Our Luxgap Whistleblower Shield turns your reporting channel into a platform that automatically materialises, for each report received, the full protection journey of the whistleblower including information on legal aid and available remedies. The tool integrates natively with your M365 mailbox, your HR suite (Sopra HR, Workday LU, SD Worx) and your external counsel to produce a cryptographically sealed trace of each step, enforceable before OFRS, ITM and the Labour Court.

Automatically generates, upon the 7-day acknowledgement of receipt, a personalised letter to the whistleblower detailing their rights, the contact details of the Service d'accueil et d'information juridique and the conditions for Luxembourg legal aid.
Detects weak signals of post-report retaliation (transfer, access revocation, bonus reduction, downgraded performance review) by cross-referencing HR flows, Active Directory and expense notes over the 24 months following the report.
Calculates a litigation risk score per case, based on the actual timeline between the report and any adverse measure, and alerts the DPO and legal counsel as soon as a critical threshold is reached.
Produces a timestamped PDF case file, enforceable before the Labour Court, demonstrating the absence of causation between report and HR decision.
Archives all exchanges in an eIDAS-qualified digital vault, accessible only to the integrity officer and the DPO, with an immutable access log.

Available as an add-on to a Luxgap DPO or CISO mandate or as a standalone SaaS module depending on your perimeter. Request a tailored quote and our teams will prepare a demonstration on your existing channel, with a free 48-hour blank audit to measure your litigation exposure before any commitment.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 99

They trust us

Before we chat