# EU whistleblower directive
> Source: https://legalcode.md/skills/legalcode-eu-whistleblower-directive | [HTML version](https://legalcode.md/skills/legalcode-eu-whistleblower-directive)

Implement and audit compliance with EU Whistleblower Directive 2019/1937.

Implement and audit compliance with EU Whistleblower Directive 2019/1937. Covers internal reporting channel design, protected persons scope, reportable breach categories, 7-day acknowledgment and 3-month feedback obligations, investigator independence, confidentiality requirements, anti-retaliation framework (Article 19 burden-of-proof reversal), external reporting authorities, public disclosure conditions (Article 15), GDPR interaction, and national transposition variations across all EU Member States. Use when building a whistleblower program from scratch, auditing an existing program, conducting a gap analysis against the Directive, advising on national implementation differences (Hinweisgeberschutzgesetz, Loi Sapin II, Wet Bescherming Klokkenluiders, Protected Disclosures Act, etc.), drafting internal reporting policies, handling retaliation allegations, designing intake/triage workflows, or assessing interaction with sector-specific rules (MAR, MiFID II, CRD V). Jurisdiction: European Union (Directive 2019/1937/EU), with member-state-specific notes.

This skill supports comprehensive compliance work under Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law (the "Whistleblower Directive" or "Directive"). It functions in three modes: **Mode A — Build**: Design and implement a compliant whistleblower program from scratch. **Mode B — Audit**: Assess an existing program against Directive requirements and produce a gap analysis with prioritized remediation recommendations. **Mode C — Advise**: Answer targeted compliance questions about specific provisions, national transpositions, or particular implementation challenges (e.g., multinational shared channels, GDPR interaction, retaliation allegations). **Covers:** - Entity threshold assessment (50-employee rule, group structures) - Internal reporting channel design (written + oral, acknowledgment timelines, security) - Protected persons scope (employees, contractors, facilitators, third persons) - Reportable breach categories (Article 6 + national extensions) - Investigation procedures (independence, confidentiality, GDPR) - Anti-retaliation framework (Article 19 prohibited measures, burden of proof reversal) - External reporting authorities (by Member State and topic area) - Public disclosure conditions (Article 15) - GDPR integration (legal basis, DPIA, Article 23 restrictions, data minimization) - National transposition variations across key Member States - Support measures (legal, psychological, financial assistance — Article 20) - Sector-specific overlaps (MAR, MiFID II, CRD V, food safety, environmental) ...

## Jurisdictions

European Union



---
*Legalcode -- legalcode.md*