Regulated function · Directive (EU) 2019/1937
We operate internal reporting channels and support the impartial follow-up of reports, under the Whistleblower Protection Directive and the national laws that transpose it.
Key facts
Private entities with 50 or more workers and, subject to limited exemptions, public-sector entities must establish internal reporting channels.
Article 8(5) allows reporting channels to be operated internally or provided externally by a third party.
Reports must be acknowledged within seven days and the reporting person must receive feedback within three months.
Private entities with 50 to 249 workers may share resources for receiving reports and for investigations.
The Directive requires an impartial person or department, competent to follow up on reports, to maintain communication with the reporting person and to give feedback. Confidentiality of the reporting person's identity and proper record keeping are legal duties, and retaliation is prohibited. National laws add detail: Portugal's general regime for the protection of whistleblowers (Lei n.º 93/2021) governs internal channels in Portugal, and Spain's Ley 2/2023 requires the management body to appoint a Responsable del Sistema and to notify the competent authority of that appointment within ten working days.
secure channel: written and oral reporting, with anonymous reporting where the law or the organisation allows it;
receipt and acknowledgement: registration of each report and acknowledgement within seven days;
triage: assessment of admissibility and of the competent person or department;
follow-up: support in internal enquiries, with independence from the persons concerned;
feedback: information to the reporting person within three months;
records and reporting: secure record keeping and periodic reports to the management body, without identifying reporting persons;
training: awareness for staff and training for those who handle reports.
We can operate the channel and act as the impartial follow-up function where national law allows it to be outsourced. Decisions on the outcome of each case and on any corrective or disciplinary measure remain with the organisation. Where the law requires an internal holder, such as Spain's Responsable del Sistema, we support that person.
Channel: secure channel, receipt, acknowledgement and record keeping;
Channel and follow-up: adds triage, support in enquiries and feedback to reporting persons;
Integrated: adds training and coordination with the anti-corruption programme and the Data Protection Officer.
Fees are set in a tailored proposal, according to the number of workers, entities and expected reports.
Related: Whistleblower Protection · Compliance Secretariat · Data Protection Officer · Information Security Officer · Compliance Officer
General information as at October 2026; it does not constitute legal advice.
Request a free review of your channel or a proposal for its external operation.