Short answer
Directive (EU) 2019/1937 protects a natural person who obtained information in a work-related context and had reasonable grounds to believe, when reporting, that the information was true and concerned a breach within the Directive's scope. Conclusive proof and a correct legal classification are not required. Knowingly false reporting is not protected.
A qualifying person may report internally, report directly to a competent external authority, or use both routes. Internal reporting is encouraged where the problem can be addressed effectively and retaliation is not feared, but it is not a mandatory first step for EU protection. Public disclosure has stricter conditions: normally an earlier report must have produced no appropriate action within the applicable period, unless the person reasonably believes there is an imminent or manifest public-interest danger, a retaliation risk, or little prospect of effective external action for reasons such as evidence concealment or official collusion.
Protection extends where relevant to a confidential facilitator, connected colleagues or relatives who may suffer work-related retaliation, and legal entities that the reporting person owns, works for or is otherwise connected with. Retaliation includes any direct or indirect work-related act or omission prompted by reporting or disclosure that causes or may cause unjustified detriment—not only dismissal.
The Directive sets minimum standards. National law may cover additional subjects and people, prescribe procedures and remedies, require anonymous reporting, or provide stronger protection.
The reported subject must fall within scope
The Directive does not cover every workplace grievance merely because it is serious. Article 2 and the Annex identify areas including public procurement, financial services and anti-money laundering, product and transport safety, environmental protection, food and animal rules, public health, consumer protection, privacy, data protection and network security. It also covers breaches affecting EU financial interests and certain internal-market rules, including competition, State aid and corporate-tax arrangements that defeat applicable rules' object or purpose.
The current Annex matters because later legislation added covered instruments. Listed sector-specific whistleblowing rules take precedence where they provide specific rules; the Directive fills gaps. Member States may extend protection to national-law breaches, but that coverage comes from domestic law.
Information on breaches includes reasonable suspicions about actual or potential breaches that occurred or are very likely to occur, and attempts to conceal them. The information must relate to an organisation with which the person had contact through work. A purely private observation unrelated to work activities does not become protected simply because the observer is employed somewhere.
Who is a reporting person?
Article 4 deliberately reaches beyond employees. It includes workers and civil servants, self-employed people, shareholders, members of administrative, management or supervisory bodies, non-executive directors, volunteers, paid or unpaid trainees, and people working under the supervision and direction of contractors, subcontractors and suppliers.
The relationship can be current, ended or not yet started. Former employees and candidates can qualify for information learned through employment, recruitment or pre-contractual negotiations. The decisive connection is the work-related context and retaliation risk.
The “reporting person” is always a natural person. A company cannot itself be a reporting person under the Directive, but a company owned by or connected with the human reporter may receive relevant protection against retaliation under Article 4(4).
Good-faith motive is not the test
Article 6 asks whether the reporter had reasonable grounds to believe both that the information was true at the time and that it fell within scope. The assessment uses the information then available, not hindsight after an inquiry finds no breach. Protection is not lost merely because the reporter was mistaken or the investigation closes without action.
Personal motive is generally irrelevant. A parallel employment dispute does not defeat Article 6, but deliberate fabrication does. Member States must penalise knowing falsehoods and provide measures to compensate resulting damage.
“they had reasonable grounds to believe that the information on breaches reported was true at the time of reporting” —
Internal and external reports
Internal channels must preserve confidentiality and enable reports in writing or orally. Covered entities must acknowledge receipt within seven days and normally provide feedback within a reasonable period not exceeding three months. The authorised function must follow up diligently and communicate clear information about external routes.
Private entities generally need channels from 50 workers, subject to sector rules and national risk assessments. Public entities are covered, with limited small-entity exemptions. Shared group resources do not remove each entity's obligations.
Article 10 permits a person to report directly through competent external channels, whether or not an internal report was made first. A company policy that says employees “must always report internally first” cannot reduce this EU-derived route. Article 24 also prohibits waiver or limitation of Directive rights through an agreement, policy, employment term or pre-dispute arbitration clause.
Reporting to a relevant EU institution, body, office or agency can attract the same protection. The proper recipient depends on the subject; an unrelated public mailbox may not satisfy channel rules.
Anonymous reporting is treated separately. The Directive lets Member States decide, unless another EU rule requires it, whether entities and authorities must accept and follow up anonymous reports. A person who reported anonymously, is later identified and suffers retaliation qualifies if the ordinary Article 6 conditions are met.
Public disclosure has an additional gateway
Making allegations available to the public—through a website, social media, public meeting or similar means—is not identical to reporting through a designated channel. Under Article 15, protection normally follows where the person reported internally and externally, or directly externally, but no appropriate action occurred within the required period.
The prior-report condition is unnecessary where the person reasonably believes either that the breach presents an imminent or manifest danger to the public interest, such as an emergency or risk of irreversible harm, or that external reporting creates a retaliation risk or has little prospect of effective action. Evidence may be concealed or destroyed, or the authority may be colluding with or involved in the breach.
This is not a licence to publish an unlimited file. Personal data, privileged communications, trade secrets and unrelated material should be limited to what is reasonably necessary. Article 15 does not govern direct press disclosures under specific national freedom-of-expression protections.
Facilitators and connected persons
A facilitator is a natural person who confidentially assists the reporter in the reporting process in a work-related context. This could include a colleague or representative who helps organise information or navigate a channel. General public advocacy after publication is not automatically facilitation within the definition.
Protection also reaches third persons connected with the reporter who could suffer retaliation at work, such as colleagues or relatives, and connected legal entities. Each claimant must show the relevant connection and detriment. They need not pretend to be the original reporter.
Confidentiality is central. The reporter's identity and information from which it may be deduced may be disclosed beyond authorised staff only with explicit consent or where disclosure is a necessary and proportionate obligation under law for an investigation or judicial proceeding, including defence rights. The reporter normally must receive advance written reasons unless notice would jeopardise the proceeding.
What counts as retaliation?
Article 19 prohibits retaliation, threats and attempts. Its non-exhaustive examples include dismissal, suspension, demotion, withheld promotion or training, transfer, reduced pay or hours, negative assessments, discipline, coercion, intimidation, harassment, ostracism, discrimination, non-renewal, reputational harm including on social media, financial loss, blacklisting, contract cancellation, licence withdrawal and psychiatric or medical referral.
The link to reporting is essential. Employers and counterparties may still take duly justified measures unrelated to a report. But once a protected person shows that they reported or publicly disclosed and then suffered detriment, Article 21(5) presumes retaliation. The person who took the measure must prove that it rested on duly justified grounds. Contemporaneous records and consistent treatment therefore matter.
“‘retaliation’ means any direct or indirect act or omission which occurs in a work-related context, is prompted by internal or external reporting or by public disclosure, and which causes or may cause unjustified detriment to the reporting person” —
Protection includes access to information and advice, authority assistance, legal aid in specified proceedings, interim relief, remedies and full compensation under national law. A qualifying reporter generally incurs no liability for necessary disclosure restrictions or for acquiring or accessing reported information, unless the acquisition or access was itself a separate criminal offence. Unrelated misconduct remains governed by ordinary law.
The accused person retains Charter rights to a remedy, fair trial, presumption of innocence and defence. Confidential reporting is not a finding of guilt.
The Court of Justice has enforced Member States' transposition duty, including in . That judgment concerned failure to transpose, not the substantive protection tests above.
Practical assessment
For each claim, record the covered EU or extended national rule, work-related source of information, facts supporting reasonable belief, chosen channel, dates and acknowledgements, feedback deadline, people or entities claiming connected protection, confidentiality decisions and every threatened or actual detriment. Preserve the employer's stated reasons and comparable treatment evidence. Public disclosure requires a separate written assessment of Article 15's gateway and the necessity of the material disclosed.
Conclusion
EU whistleblower protection is broad in personal reach but conditional in subject matter and route. A reasonable work-related report within scope can go internally or directly to a competent authority; public disclosure needs an additional justification. Facilitators and connected people or entities can be protected, and retaliation covers subtle contractual and reputational harm as well as dismissal. National implementing law supplies the operational channel, remedy and any broader coverage, so the Directive and domestic rules must be read together.
Sources
This article provides general legal information, not advice for a specific matter. Laws, facts and procedural deadlines may change the result. Follow the linked primary sources and obtain local advice before acting.