Who Must Establish an Internal Reporting Channel? Comprehensive Guide to the Irish Protected Disclosures Act

Legislative Framework: The Protected Disclosures Regime in Ireland

The landscape of whistleblower protection in Ireland underwent a profound and structural overhaul with the enactment of the Protected Disclosures (Amendment) Act 2022 (Act No. 27 of 2022), which commenced on 1 January 2023. This statute comprehensively revised the foundational Protected Disclosures Act 2014 to transpose Directive (EU) 2019/1937 of the European Parliament and of the Council on the protection of persons who report breaches of Union law.

Prior to the 2022 Amendment Act, Irish law protected workers who made protected disclosures from penalisation and unfair dismissal, but private sector employers were under no general statutory obligation to establish formal internal reporting channels or follow-up procedures. That permissive era has ceased. Section 6A of the amended Act now imposes an affirmative, mandatory legal obligation on specified private sector employers and all public sector bodies to establish, maintain, and operate formal, secure internal reporting channels and diligent follow-up mechanisms.

The phased commencement regime established two critical statutory milestones:

• 1 January 2023: Mandatory compliance took effect for all private sector employers with 250 or more employees, all public bodies regardless of headcount, and all entities operating within scope of specific European Union acts (most notably financial services and AML/CFT regulated entities, regardless of headcount);
• 17 December 2023: The statutory threshold dropped to capture all private sector entities with 50 or more employees.

Non-compliance with these statutory duties is no longer a mere civil governance matter. The 2022 Act introduced explicit criminal sanctions under Section 14A for failing to establish internal reporting channels, obstructing workers from reporting, or engaging in penalisation. Corporate entities and officers face criminal prosecution, with fines reaching €250,000 and terms of imprisonment of up to two years upon conviction on indictment.

The General Threshold: Private Employers with 50 or More Workers

Under Section 6A(1) of the Act, every private sector legal entity that employs 50 or more employees must establish formal internal reporting channels and procedures for the receipt, acknowledgment, and follow-up of protected disclosures. Understanding whether an organization falls within this statutory threshold requires a meticulous assessment of how headcount is calculated under Irish employment law.

Methodology for Calculating the 50-Employee Headcount

The statute applies to employers with 50 or more employees. Unlike certain European jurisdictions that mandate a 12-month trailing moving average or specific snapshot dates (such as the French or Polish regimes), Irish practice and statutory interpretation assess employee headcount based on active employment contracts. In evaluating whether an organization meets or exceeds the 50-employee threshold, employers must apply the following statutory criteria:

• Full-Time Permanent Employees: Counted as one unit per employee.
• Part-Time Employees: Under the Protection of Employees (Part-Time Work) Act 2001, part-time workers are employees who work fewer hours than a comparable full-time employee. In determining the 50-employee threshold under the Protected Disclosures Act, each individual employed under a contract of employment counts toward the headcount, regardless of whether their hours are full-time or part-time, unless a specific statutory instrument prescribes a whole-time equivalent (WTE) formula. Prudent corporate compliance mandates treating every individual under an active contract of employment as contributing to the headcount.
• Fixed-Term Employees: Individuals engaged under the Protection of Employees (Fixed-Term Work) Act 2003 are fully counted during the currency of their contracts, including seasonal or temporary staff.
• Apprentices and Paid Trainees: Individuals working under approved apprenticeship contracts or paid training contracts of service are counted as employees.
• Employees on Statutory Leave: Employees on maternity leave, paternity leave, parental leave, adoptive leave, or certified sick leave remain under active contracts of employment and must be included in the total headcount.

Fluctuation Across the Threshold

Organizations operating close to the 50-worker margin (for example, fluctuating between 45 and 55 staff due to seasonal hiring or rapid scaling) face critical compliance risks. Under the guidance issued by the Department of Public Expenditure, NDP Delivery and Reform, if an employer reaches 50 employees at any point during a calendar year, it should establish the internal reporting channel without delay. Maintaining a functioning, robust channel continuously is significantly less costly than facing criminal exposure under Section 14A for being caught without a statutory channel during an employment inspection or whistleblower retaliation dispute.

Zero-Threshold Entities: Mandatory Channels Irrespective of Headcount

The 50-employee threshold does not apply across all industries. Section 6A(1)(c) of the Act establishes that any legal entity in the private sector that falls within the scope of specified European Union acts must establish and operate internal reporting channels regardless of the number of persons employed. Even an entity with two employees must maintain a compliant channel if it falls within these regulated sectors.

Financial Services and Markets under Central Bank of Ireland Supervision

Any entity regulated by the Central Bank of Ireland (CBI) or operating under EU financial services legislation is subject to the zero-threshold rule. This includes:

• Credit Institutions and Retail Banks: Operating under the Central Bank Acts and the European Union (Capital Requirements) Regulations;
• Investment Firms and Fund Service Providers: Regulated under MiFID II (Directive 2014/65/EU) and the Investment Intermediaries Act 1995;
• Management Companies and Alternative Investment Fund Managers: UCITS management companies (Directive 2009/65/EC) and AIFMs (Directive 2011/61/EU);
• Insurance and Reinsurance Undertakings: Operating under the Solvency II framework (Directive 2009/138/EC);
• Payment Institutions and Electronic Money Institutions: Regulated under the Payment Services Directive (PSD2) and Electronic Money Regulations;
• Credit Unions: Subject to the Credit Union Act 1997 and regulatory supervision by the Registry of Credit Unions within the Central Bank of Ireland.

The Central Bank of Ireland maintains an active whistleblower desk and actively cross-checks whether regulated entities have implemented compliant internal reporting frameworks during statutory inspections and risk mitigation programmes (RMPs).

Prevention of Money Laundering and Terrorist Financing (AML/CFT)

Entities that qualify as "designated persons" under the Criminal Justice (Money Laundering and Terrorist Financing) Act 2010 (as amended by the 2018 and 2021 Acts) must maintain internal reporting channels regardless of headcount. This statutory reach captures:

• Trust and company service providers (TCSPs);
• Independent legal professionals and solicitors when participating in financial, property, or corporate transactions;
• Statutory auditors, external accountants, and tax advisers;
• Virtual asset service providers (VASPs) registered with the Central Bank of Ireland;
• High-value goods dealers and art market participants when transactions exceed statutory cash thresholds.

Transport Safety, Maritime, and Civil Aviation

Operators subject to EU regulations on civil aviation safety (Regulation (EU) 2018/1139), maritime transport safety, and inland navigation must operate compliant internal channels without regard to staff size. This requirement binds regional airlines, maintenance repair organizations (MROs), port authorities, and commercial shipping operators established in Ireland.

Environmental Protection and Offshore Safety

Entities operating under offshore oil and gas safety regulations (Directive 2013/30/EU) and installations licensed by the Environmental Protection Agency (EPA) for high-impact activities fall under the zero-threshold statutory mandate.

Public Bodies: Universal Mandate for the State Sector

Under Section 6A(1)(b) of the Act, all public bodies are under an absolute statutory duty to establish, maintain, and operate internal reporting channels and procedures. There is no employee threshold for the public sector. A small statutory board with 6 staff is bound by precisely the same statutory duty as a government department with 4,000 civil servants.

Definition of "Public Body" under Section 3

Section 3 of the Protected Disclosures Act defines public bodies comprehensively to encompass:

• Government Departments and Offices: Every Department of State, including the Department of Finance, the Department of Justice, and the Revenue Commissioners;
• Local Authorities: All 31 City and County Councils across the State;
• Health Sector: The Health Service Executive (HSE), statutory hospitals, and section 38 funded health agencies;
• Education Sector: Universities, technological universities, institutes of technology, and Education and Training Boards (ETBs);
• An Garda Síochána and the Defence Forces: Subject to specialized statutory arrangements governing security and defense disclosures;
• Commercial and Non-Commercial Semi-State Bodies: Entities such as ESB, EirGrid, Irish Water (Uisce Éireann), CIE, and statutory regulators (including the Central Bank of Ireland, WRC, DPC, and ComReg).

Statutory Guidance from DPENDR

Public bodies are legally required under Section 21 of the Act to have regard to the statutory guidance issued by the Minister for Public Expenditure, NDP Delivery and Reform. This guidance outlines mandatory requirements for written procedures, training of designated recipients, accessibility of reporting portals, and annual reporting obligations.

The Expanded Concept of "Worker" under Section 3

One of the most consequential expansions introduced by the Protected Disclosures (Amendment) Act 2022 is the widening of the statutory definition of "worker." Under the original 2014 Act, protection was largely tethered to individuals operating under contracts of employment or contracts personally to execute work.

Section 3 of the Act, as amended, now protects any individual who acquires information on a relevant wrongdoing in a work-related context. This fundamental definition determines who is entitled to utilize an organization's internal reporting channel and who is shielded by the sweeping anti-penalisation protections of Section 12.

Non-Traditional Workers Protected Under the Act

• Agency Workers: Individuals supplied by an employment agency to work under the direction and supervision of a hirer. Agency workers can report wrongdoings relating to either the employment agency or the end-user client, and both entities are criminally and civilly liable if they inflict penalisation.
• Independent Contractors, Consultants, and Self-Employed Persons: Freelance software architects, legal consultants, management advisers, and outsourced security personnel who perform work for the organization.
• Shareholders, Members of Administrative, Management, or Supervisory Bodies: This captures non-executive directors (NEDs), board members, trustees, and active shareholders who observe financial fraud, environmental violations, or corporate governance breaches.
• Trainees, Interns, and Apprentices: Both paid and unpaid interns, graduate trainees, and vocational apprentices. Prior to 2023, unpaid interns occupied a legal grey area; the 2022 Act settled this by explicitly conferring full whistleblower protection.
• Pre-Contractual Job Applicants: Individuals who acquire information regarding wrongdoings during recruitment processes or pre-contractual negotiations (for example, observing corrupt hiring practices, price-fixing discussions, or discriminatory background vetting systems).
• Former Workers: Individuals whose employment, contract, or directorship has ceased, provided the information regarding the wrongdoing was acquired during the course of their historical work relationship.

Corporate Groups, Subsidiaries, and Resource-Sharing Rules

In multinational and multi-tier corporate group structures operating in Ireland, executive leadership frequently seeks to centralize compliance functions. A common question is whether an Irish subsidiary with 70 employees can rely exclusively on the global whistleblowing hotline operated by its US or UK parent company.

The European Commission and the Irish legislature have provided categorical clarity on this matter, following formal interpretive guidance on Article 8 of Directive (EU) 2019/1937.

Medium-Sized Entities (50 to 249 Employees): Resource Sharing Permitted

Under Section 6A(4) of the Irish Act, legal entities in the private sector that employ between 50 and 249 employees are permitted to share resources as regards the receipt of reports and any investigation to be carried out. Consequently:

• Two or more mid-sized subsidiaries within the same corporate group in Ireland may share a joint reporting portal or joint investigatory committee;
• A mid-sized Irish subsidiary may share investigative capacity with its parent company;
• Mandatory Condition: The subsidiary must nevertheless maintain local access for its workers, ensure that the reporting person is kept informed in accordance with Irish statutory timelines (7 days and 3 months), and retain ultimate legal responsibility for the follow-up, feedback, and prevention of penalisation.

Large Entities (250 or More Employees): No Centralization

For legal entities in the private sector employing 250 or more employees, the rule is absolute: each legal entity must establish its own distinct, dedicated internal reporting channel. A large Irish subsidiary cannot discharge its statutory duty by merely redirecting workers to an omnibus corporate group hotline based in London, Frankfurt, or New York.

If an employee of an Irish company with 300 staff blows the whistle, the report must be capable of being received, processed, investigated, and concluded within the legal sphere of the Irish entity, adhering strictly to Irish statutory confidentiality and anti-retaliation rules.

Consultation with Trade Unions and Staff Representatives

Section 6A(6) of the Act introduces a mandatory procedural prerequisite that is frequently overlooked by corporate compliance departments: the duty of prior consultation.

« Before establishing, maintaining or operating internal reporting channels and procedures under this section, an employer shall consult with its employees, or the representatives of its employees, including any trade union recognized by the employer. »

This statutory requirement means that an employer cannot unilaterally impose an internal whistleblowing policy or roll out a digital reporting platform without formal, demonstrable engagement. The compliance workflow requires:

• Notification and Draft Policy Sharing: The employer must provide the draft protected disclosures policy, channel architecture, and confidentiality safeguards to recognized trade unions or elected employee forum representatives.
• Meaningful Consultation Window: The workforce must be afforded an adequate, reasonable period (typically 14 to 21 days) to review the documents, ask technical questions, and submit observations.
• Consideration of Submissions: The employer must review and formally consider the submissions received. While the union or staff committee does not hold a statutory veto over the implementation of a legally mandated channel, failure to engage in demonstrable consultation invalidates the procedural regularity of the channel and exposes the employer to industrial relations claims before the Workplace Relations Commission (WRC).

Criminal Penalties and Enforcement Mechanisms (Section 14A)

The Protected Disclosures (Amendment) Act 2022 introduced a comprehensive regime of criminal liability to ensure that the statutory obligations are rigorously respected. Section 14A establishes five distinct categories of criminal offenses:

• Failure to Establish Channels: Failing to establish, maintain, and operate internal reporting channels and procedures in compliance with Section 6A;
• Hindering or Obstructing Reporting: Hindering, attempting to hinder, or obstructing a worker in making a report or disclosure;
• Penalisation or Threat of Penalisation: Penalising or threatening penalisation against a reporting person, a facilitator, or an associated person;
• Breach of Confidentiality: Breaching the duty of confidentiality under Section 16 regarding the identity of the reporting person or any identifiable information;
• Bringing Vexatious Proceedings: Initiating vexatious judicial or administrative proceedings against a reporting person.

Statutory Penalties on Conviction

The penal consequences under Section 14A are among the most severe in the European Union:

• On Summary Conviction (District Court): A class A fine (up to €5,000) or imprisonment for a term not exceeding 12 months, or both.
• On Conviction on Indictment (Circuit Criminal Court): A fine not exceeding €250,000 or imprisonment for a term not exceeding 2 years, or both.

Personal Criminal Liability for Company Officers

Section 14A(3) incorporates the standard corporate piercing clause of modern Irish criminal law. Where an offense is proved to have been committed with the consent or connivance of, or to be attributable to any neglect on the part of, a director, manager, secretary, or other officer of the body corporate, that individual officer is personally guilty of the offense and liable to be prosecuted, fined, and imprisoned.

Practical Implementation Checklist for Irish Employers

To ensure full legal compliance with the Protected Disclosures Acts, every covered organization should follow this structured implementation roadmap: