MAINSYSTEMS 
Seven Days and Three Months: The Procedural Timelines under the Irish Protected Disclosures Act
Governing Legislation: Section 6A(1)(a) and Section 6A(1)(c) of the Protected Disclosures Act 2014 (as amended by Section 9 of the Protected Disclosures (Amendment) Act 2022), in conjunction with statutory guidance issued by the Department of Public Expenditure, NDP Delivery and Reform (DPENDR) and procedural rules of the Workplace Relations Commission (WRC).
The Statutory Architecture of Procedural Timelines in Ireland
Before the enactment of the Protected Disclosures (Amendment) Act 2022, whistleblower complaints in Ireland frequently disappeared into procedural voids. Organizations often delayed investigations for months without communicating with the reporting worker. This procedural ambiguity severely compromised worker protection, fostered institutional suspicion, and exacerbated the risk of workplace retaliation.
The transposition of Directive (EU) 2019/1937 into Irish law fundamentally transformed this operational dynamic. Under Section 6A of the Protected Disclosures Act 2014 (as amended), compliance is strictly temporal. The Irish legislature created a rigid, chronological workflow consisting of two non-negotiable statutory pillars:
- Seven Calendar Days: The employer must provide formal written acknowledgment of receipt of the disclosure to the reporting person (Section 6A(1)(a));
- Three Months: The designated impartial person or department must provide comprehensive, substantive feedback to the reporting worker regarding the actions taken, underway, or envisaged as follow-up, and the specific grounds for such follow-up (Section 6A(1)(c)).
These deadlines are not aspirational best practices. They constitute strict statutory obligations enforceable through criminal sanctions under Section 14A and directly admissible in evidence before the Workplace Relations Commission (WRC) and the Labour Court. A failure to adhere to these statutory timeframes exposes the employer to claims of constructive penalisation and strips away institutional credibility in court.
The 7-Day Acknowledgment Obligation: Calculation and Mechanics
Section 6A(1)(a) provides that an internal reporting channel must provide for:
« the acknowledgment in writing to the reporting person of receipt of the report not later than 7 days after the date on which the report was received. »
Understanding the exact legal mechanics of this 7-day rule is essential for risk officers, compliance directors, and employment counsel operating within the Irish jurisdiction.
Calendar Days versus Working Days
In Irish statutory interpretation, unless an enactment specifically qualifies "days" as "working days" or "business days" (as is common in commercial arbitration statutes), the term "days" means consecutive calendar days. This interpretation is reinforced by the provisions of the Interpretation Act 2005.
Consequently, Saturdays, Sundays, and public bank holidays are fully counted within the 7-day period. If a worker submits an encrypted report via the company whistleblowing portal at 21:00 on a Friday evening preceding an Irish bank holiday weekend, the 7-day clock begins immediately, and the formal written acknowledgment must be issued before midnight on the following Friday.
Exceptions to the Acknowledgment Mandate
Section 6A(1)(a) sets forth two narrow, explicit statutory exceptions where the designated person is excused from issuing the 7-day acknowledgment:
- Explicit Refusal by the Reporting Person: Where the reporting person specifically requested in writing that no acknowledgment be issued (for example, where an employee fears that an incoming notification on a monitored personal phone might alert a controlling domestic partner or hostile manager);
- Reasonable Belief of Compromise: Where the designated person reasonably believes that acknowledging receipt of the report would jeopardize the protection of the reporting person's identity (for example, if the report arrived via an insecure corporate email address accessible to IT system administrators who are themselves named as targets in the disclosure).
In all other circumstances, issuing the acknowledgment within 7 calendar days is mandatory. Failing to deliver the acknowledgment without invoking one of these two statutory grounds constitutes an actionable procedural breach.
| Submission Scenario | Statutory Day Zero | Statutory Deadline for 7-Day Acknowledgment | Permitted Communication Channel |
|---|---|---|---|
| Monday morning (09:00) via web portal | Monday | Following Monday (by 23:59) | Secure portal inbox / encrypted token |
| Friday evening (22:00) before Bank Holiday | Friday | Following Friday (by 23:59) | Secure portal inbox / encrypted email |
| Oral report via recorded voicemail line | Day message left | 7 calendar days later | Secure portal or SMS if agreed |
| In-person meeting requested orally | Day meeting requested | 7 calendar days later | Written letter or secure portal message |
| Anonymous report via secure intake portal | Day report submitted | 7 calendar days later | Portal status screen accessible via ticket code |
The Role and Mandate of the "Designated Person"
Under Section 6A(1)(b) of the Act, an employer must appoint one or more impartial individuals, or an impartial organizational unit, as the designated person. This individual or committee is charged with:
- Receiving the disclosure;
- Maintaining communication with the reporting person;
- Requesting further information where necessary;
- Conducting the preliminary assessment;
- Executing diligent follow-up (including internal investigations or referral to competent bodies); and
- Delivering substantive feedback to the worker within statutory timeframes.
Impartiality and Conflicts of Interest
Impartiality is a strict statutory requirement. If a disclosure concerns financial fraud perpetrated by the Chief Financial Officer (CFO), the compliance officer cannot be subordinate to the CFO for the purposes of handling the report. Modern compliance frameworks in Ireland resolve this through dual reporting lines: the designated person reports directly to an independent Audit and Risk Committee or Non-Executive Board Director regarding whistleblower investigations.
Employers may also outsource the role of the designated person to an external third party, such as a specialized legal advisory firm, an independent forensic accounting practice, or a managed whistleblowing service provider. However, the corporate employer remains legally liable for any statutory failures committed by its external provider.
The Preliminary Assessment Phase (Triage)
Upon receiving a report, the designated person must promptly initiate a preliminary assessment. This phase serves as the critical triage mechanism and should ideally be concluded within the first two to four weeks of the three-month window.
The Three Triage Determinations
The designated person must evaluate the information and make one of three formal determinations:
Determination 1: Prima Facie Relevant Wrongdoing. The disclosure contains information that tends to show a relevant wrongdoing under Section 5. The designated person formally initiates a diligent investigation or refers the matter to the internal audit / disciplinary committee under strict confidentiality controls.
Determination 2: Interpersonal Grievance Excluded. The matter concerns a personal employment dispute exclusively affecting the reporter (e.g., interpersonal conflict, salary dispute, performance review friction). The designated person formally notifies the worker that the matter does not qualify as a protected disclosure under Section 5 and routes the issue to standard HR grievance or mediation channels.
Determination 3: Insufficient Information / Closure. There is insufficient evidence to substantiate a wrongdoing, or the allegation is manifestly trivial. The designated person decides to close the procedure, documenting the detailed factual and legal reasons for the closure in the statutory register.
Diligent Follow-Up: Investigations and Legal Safeguards
Section 6A(1)(b) mandates diligent follow-up (*obair leantach dhícheallach*). Diligent follow-up requires action that is genuine, thorough, and proportionate to the gravity of the allegations. A perfunctory or dismissive review violates the statutory standard.
Investigatory Steps Required by Law
- Information Gathering & Witness Interviews: Conducting private, recorded or transcribed interviews with witnesses while strictly safeguarding the identity of the whistleblower;
- Evidence Preservation: Securing digital audit trails, ERP logs, email archives, and financial records before potential perpetrators can destroy or alter evidence;
- Rights of the Accused ("Person Concerned"): Under principles of constitutional justice and fair procedures (*in re Haughey* principles in Irish constitutional law), an individual accused of wrongdoing must be informed of the allegations against them and afforded a reasonable opportunity to respond before any adverse finding is made. Crucially, this right to fair procedures does not entitle the accused person to know the identity of the whistleblower, which remains protected under Section 16.
- Legal Professional Privilege: In complex corporate investigations, retaining external legal counsel allows the employer to protect sensitive legal advice under litigation privilege, provided the investigation is structured correctly and does not conceal underlying criminal acts.
The 3-Month Feedback Mandate: Definition and Depth
Section 6A(1)(c) of the Act sets forth the definitive feedback deadline:
« the provision of feedback to the reporting person within a reasonable period, being not more than 3 months from the date of the acknowledgment of the report, or if no acknowledgment was sent, 3 months from the date on which the report was received. »
Statutory Definition of "Feedback"
Many compliance officers mistakenly assume that feedback requires merely sending a short email stating: "Your report has been investigated and the matter is closed." Under Irish law, such generic dismissals are unlawful.
Section 3 of the Act explicitly defines feedback as:
- The provision to the reporting person of information on the action taken or envisaged as follow-up; and
- The specific grounds for such follow-up.
Compliant feedback must inform the whistleblower of concrete actions: for instance, that an internal audit was commissioned, that internal controls were revised, that disciplinary proceedings were initiated, that the matter was referred to An Garda Síochána or the Central Bank of Ireland, or that the investigation concluded with no findings of wrongdoing on specified factual grounds.
Permissible Extension to 6 Months for Complex Cases
Section 6A(1)(c) allows an extension of the feedback deadline from 3 months to not more than 6 months, subject to two stringent statutory conditions:
- Justified by the Specific Nature and Complexity of the Report: The investigation must involve extraordinary complexities, such as forensic examination of multi-year financial statements, international cross-border transactions, or the review of thousands of encrypted communications;
- Formal Notice Before 3-Month Expiry: The designated person must write to the reporting worker before the initial 3-month period expires, setting out the factual reasons why the extension is necessary and providing an interim update on progress.
Failing to notify the worker before the 90th calendar day forfeits the right to an extension and constitutes an immediate statutory violation.
| Investigation Phase | Statutory Timeline | Action Required by Designated Person | Documentation Standard |
|---|---|---|---|
| Intake & Acknowledgment | Within 7 calendar days | Issue formal written receipt with case ID | Stored in secure case register |
| Preliminary Assessment | Days 8 to 30 | Determine if report shows relevant wrongdoing | Formal assessment memo signed by designated person |
| Diligent Investigation | Days 31 to 80 | Interview witnesses, audit records, preserve data | Forensic interview notes, evidence files |
| Interim Extension Notice (if needed) | Before Day 90 | Notify reporter of complex extension to 6 months | Written extension letter detailing complexity |
| Substantive Feedback | Within 3 months (or 6 months) | Deliver detailed findings and follow-up actions taken | Written feedback report delivered securely |
| Ongoing Updates | Every 3 months upon written request | Provide status updates until final closure | Ongoing communication logs |
Ongoing Updates and Right to an In-Person Meeting
Beyond the 7-day and 3-month milestones, the Protected Disclosures (Amendment) Act 2022 introduced two crucial worker rights that mandate ongoing operational readiness:
Quarterly Updates Upon Written Request
Section 6A(1)(d) establishes that where an investigation remains ongoing after the delivery of initial feedback, the reporting person is entitled to request further updates in writing. The designated person must provide further written feedback at 3-month intervals until the investigation is fully concluded and all follow-up procedures are closed.
The Right to an In-Person Physical Meeting
Section 6A(1)(e) guarantees that where a worker requests an in-person meeting to make or discuss a disclosure, the employer's internal reporting channel must facilitate such a meeting within a reasonable timeframe.
Best practices under DPENDR guidelines require that:
- The meeting must be held in a neutral, confidential physical location that ensures privacy;
- With the worker's consent, the meeting may be recorded on an encrypted audio device, or detailed written minutes must be drafted;
- The worker must be afforded the opportunity to review, correct, and sign the agreed minutes of the meeting.
Evidentiary Burden in WRC Proceedings and Labour Court Disputes
Why do these deadlines matter so intensely in corporate practice? The answer lies in how Irish employment tribunals evaluate retaliation claims.
When an employee brings a claim before the Workplace Relations Commission (WRC) alleging penalisation under Section 12 or unfair dismissal under the Unfair Dismissals Act 1977, the employer's adherence to statutory deadlines becomes the central battlefield:
- Reversal of the Burden of Proof (Section 12(2)): If an employer missed the 7-day acknowledgment or the 3-month feedback deadline, the adjudication officer is immediately primed to view the employer's subsequent adverse actions (such as placing the employee on a performance improvement plan) as retaliatory;
- Constructive Dismissal & Justification for External Reporting: If an employer fails to provide feedback within 3 months, Section 10 of the Act permits the worker to bypass the company entirely and make an external disclosure to a Prescribed Person or the Protected Disclosures Commissioner, or even proceed to public disclosure (media or online publication) without losing statutory protection;
- Admissibility of Case Logs: Adjudication officers routinely demand production of the internal case management timestamps. Employers who cannot produce immutable, timestamped logs proving that acknowledgment was issued within 7 days and feedback within 3 months face severe adverse inferences.
Operational Playbook: Managing Whistleblower Timelines
Timelines Compliance Checklist for Employers
- [ ] Automated 7-Day Timestamping: Ensure the reporting software automatically logs the exact minute of intake and generates an encrypted acknowledgment within 7 calendar days.
- [ ] Impartiality Assessment: Verify within 48 hours of intake that the designated recipient has no conflicts of interest regarding the named parties.
- [ ] Triage Conclusion by Day 21: Finalize the initial assessment to determine whether the issue is a protected disclosure, an interpersonal grievance, or a matter requiring immediate closure.
- [ ] Investigation Milestone at Day 60: Review the progress of the investigation and determine whether the matter will conclude within 3 months or requires a formal 6-month extension.
- [ ] Issue Extension Notice by Day 80: If a complex extension is warranted, deliver written notification to the whistleblower with specific factual grounds before Day 90 arrives.
- [ ] Deliver Substantive Feedback by Day 90: Provide concrete information detailing the follow-up actions taken or envisaged and the grounds for those actions.
- [ ] Maintain 3-Month Recurring Reminders: Set automated reminders to provide quarterly updates if disciplinary, regulatory, or judicial proceedings remain pending.
Frequently Asked Questions Regarding Whistleblowing Timelines in Ireland
1. Are the 7 days for acknowledging receipt counted as business days or calendar days?
Under Section 6A(1)(a) of the Protected Disclosures Act 2014 (as amended) and the Interpretation Act 2005, the 7-day statutory deadline is calculated as 7 consecutive calendar days. Bank holidays and weekends do not extend the statutory deadline.
2. When does the 7-day clock begin ticking?
The 7-day clock begins immediately on the date the report is received by the employer's reporting channel or designated person. If a report is submitted on a Tuesday afternoon, the acknowledgment must be issued before midnight on the following Tuesday.
3. Can an employer ever be excused from sending the 7-day acknowledgment?
Yes, but only under two strict statutory exceptions: (1) where the reporting person explicitly requested in writing that no acknowledgment be sent; or (2) where the designated person reasonably believes that acknowledging receipt would compromise the confidentiality of the reporting person's identity.
4. What constitutes compliant "feedback" under Irish law?
Under Section 3 of the Act, feedback means providing the whistleblower with substantive information regarding the action taken or envisaged as follow-up, and the specific grounds for such action. A mere confirmation that "the matter was investigated" is legally deficient.
5. When must the substantive feedback be provided to the reporting person?
Feedback must be provided not later than 3 months from the date of the acknowledgment of the report, or if no acknowledgment was sent, 3 months from the date the report was received by the organization.
6. Can the 3-month feedback deadline be extended?
Yes. The designated person may extend the feedback deadline to a maximum of 6 months where justified by the specific nature and complexity of the report. However, the employer must formally notify the whistleblower in writing before the initial 3-month period expires, providing detailed reasons for the extension.
7. What happens if an employer fails to provide feedback within 3 months?
Failing to provide feedback is a statutory breach. It exposes the employer to criminal penalties under Section 14A, creates an adverse presumption in WRC penalisation disputes, and legally entitles the whistleblower to make an external disclosure to a Prescribed Person, the Protected Disclosures Commissioner, or the media under Section 10.
8. Does the whistleblower have the right to request updates after the initial feedback?
Yes. Under Section 6A(1)(d), if an investigation remains ongoing after the initial feedback, the reporting person is entitled to request further updates in writing. The designated person must provide updates at 3-month intervals until the matter is fully closed.
9. What should the designated person do if a report is determined to be an interpersonal grievance?
If the preliminary assessment concludes that the matter is an interpersonal grievance exclusively affecting the reporter, the designated person must notify the worker in writing that it does not qualify under the Protected Disclosures Act and redirect the worker to the employer's HR grievance or dignity-at-work procedures.
10. How quickly must an in-person meeting be scheduled if requested by the worker?
Section 6A(1)(e) requires the employer to facilitate an in-person meeting within a reasonable time. In standard Irish practice, this should occur within 7 to 14 calendar days of the request, in a confidential location.
11. Can an employer disclose the identity of the whistleblower to the person accused during the investigation?
No. Section 16 strictly prohibits disclosing the identity of the reporting person, or any information from which their identity can be deduced, without their explicit consent, subject only to narrow statutory exceptions (such as court orders or criminal prosecutions).
12. How does missing the 7-day acknowledgment affect a penalisation claim before the WRC?
Missing the 7-day deadline creates immediate procedural vulnerability. Because Section 12(2) reverses the burden of proof, an employer that fails to adhere to statutory timelines struggles to convince the Workplace Relations Commission that subsequent personnel actions were taken in good faith.
13. Does an anonymous report have to be acknowledged within 7 days?
If the organization operates a digital channel that provides a secure, tokenized communication portal, best practice requires posting an acknowledgment on the secure portal within 7 days. If the report was truly uncontactable (e.g. an anonymous letter with no return address), acknowledgment is impossible and excused.
14. What level of detail can be withheld from feedback to protect data privacy?
While feedback must explain the follow-up actions and grounds, the employer must not disclose confidential personal data of other employees (such as specific medical details, salary reductions, or private disciplinary sanctions) in breach of the GDPR and Data Protection Act 2018.
15. What records must an employer keep to prove compliance with statutory deadlines?
Employers must maintain a secure, tamper-evident case register recording the exact timestamp of report receipt, copy of the written acknowledgment, preliminary triage assessment memo, interview notes, interim extension notices, and the formal feedback report.