Whistleblower Protection — Implementing a Reporting System

The obligation to implement an internal reporting channel applies to entities employing at least 50 people, and in some sectors (including finance and anti-money laundering) regardless of headcount. In the training we work through the criteria to determine clearly whether and to what extent your organization is subject to the obligation.

This training focuses directly on the practical implementation of a reporting system from scratch — choosing and configuring the channel, writing a procedure with statutory deadlines, and building a GDPR-compliant register — rather than only discussing the regulations. The outcome is a ready framework of documentation and procedure that the organization can further develop.

The organization must acknowledge receipt of a report within 7 days of receiving it and provide the whistleblower with feedback on follow-up actions within a maximum of 3 months. In the training we build a report-handling flow aligned with these deadlines, so they are not exceeded in practice.

The report register and documentation must be kept in line with GDPR and the data minimization principle — with restricted access, confidentiality of the whistleblower's identity, and a defined retention period. In the workshop we cover concrete organizational and technical measures that ensure this protection.

The law prohibits any retaliatory action against a reporter (including dismissal, demotion, harassment) and introduces a reversal of the burden of proof — the employer must show that an action was unrelated to the report. The whistleblower is entitled to compensation, and anyone who retaliates may face liability. In the training we cover how to build an environment that minimizes this risk.