The directive obliges member states to protect people who report breaches of EU law in a work context, and requires employers above a headcount threshold to establish internal reporting channels with defined safeguards and timeframes.
What employers must provide
- A secure channel for reports, protecting the identity of the reporter
- Acknowledgement of a report within a set period
- Diligent follow-up and feedback to the reporter within a defined timeframe
- Clear information about external reporting routes as well as internal ones
The protection is broad
Protection extends beyond employees to job applicants, former employees, contractors, suppliers and others in a work-related context, and to people who assist a reporter. Retaliation is defined widely, covering not just dismissal but negative appraisals, withheld promotion, reputational harm and more. In disputes, the burden shifts to the employer to show that a detriment was not retaliation.
Why it matters when hiring internationally
This is an operational requirement, not a policy statement: a channel has to exist, be secure, and be answered within deadlines. Because implementation is national, thresholds and details vary by country, and a group operating across several member states may face different obligations in each.