The framework in brief

What must be confirmed during implementation.

Organisation and scope

Obligations should not be inferred from employee numbers alone. The country of operation, public or private nature, sector, activity and national transposition rules can change the applicable framework.

Receipt and follow-up

Reporting channels must enable reports to be received and followed up securely. Procedures should cover receipt, assessment, communication and appropriate action.

Confidentiality and access

The Directive requires confidentiality of the reporting person's identity and protection against unauthorised access. Anonymous reporting is determined by the law and practice applicable in each jurisdiction.

Records and retention

Reports and related information must be documented and retained only for as long as necessary and proportionate, subject to applicable national rules and any judicial or administrative proceedings.

Official source: Directive (EU) 2019/1937 — EUR-Lex. National transposition law must be checked for the country concerned. Last editorial review: 10 August 2026.