The framework in brief

What should be confirmed at implementation.

Entity and scope

The obligation should not be inferred from headcount alone. The public or private nature, the sector, the activity and other applicable rules can change the framework.

Receipt and follow-up

The channel must allow the secure submission and follow-up of reports. Procedures must cover receipt, analysis, communication and appropriate measures.

Confidentiality and access

The law requires protection of identity or anonymity and prevention of access by unauthorised persons. The organisation must combine technical controls with internal rules.

Recording and retention

Reports and associated information must be documented and retained under the applicable terms, also considering possible judicial or administrative proceedings.

Official source: Protected Disclosures (Amendment) Act 2022 — Irish Statute Book. Last editorial review: 10 August 2026. This information does not replace legal advice.