Whistleblowing law has two parts: duties to provide reporting channels and respond, and protection for people who report. The EU directive led Germany and France to require internal channels for employers with 50 or more employees, with fixed response times and fines; the UK protects workers who make qualifying disclosures but does not require a channel; and the US pays whistle-blowers who report to regulators, which raises the stakes of handling internal reports well.
Mandatory internal channels in the EU
Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law is implemented through national laws. In Germany, employers that generally have at least 50 employees must operate at least one internal reporting channel; those with 50 to 249 employees may share one. The channel must confirm receipt within seven days and give feedback within three months. Reprisals are prohibited, and a disadvantage after a report is presumed to be a reprisal unless the employer proves otherwise. Fines reach EUR 20,000 for having no channel and EUR 50,000 for obstruction or reprisals.
France also requires employers with at least 50 employees to establish an internal procedure for receiving and handling reports, after consulting the works council, and whistle-blowers may go directly to external authorities.123456
Protection without a channel duty: the UK
UK law protects a worker who reasonably believes a disclosure is in the public interest and shows a crime, a breach of a legal obligation, a miscarriage of justice, danger to health or safety, damage to the environment, sexual harassment, or concealment of any of these. Workers are protected from detriment and employees from unfair dismissal from day one, and claims must be raised within six months. Government guidance does not say employers must have a whistle-blowing policy, but a channel is part of adequate procedures under the bribery and fraud offences.78
US award programmes
The SEC pays awards of 10% to 30% of money collected in enforcement actions with sanctions over USD 1 million to people who voluntarily provide original information, and can act against retaliating employers. The Department of Justice runs a corporate whistle-blower awards pilot covering foreign corruption, sanctions and customs fraud; a company that self-reports within 120 days of an internal report, and before the Department contacts it, may still qualify for a declination. Fast internal triage is therefore a defence strategy as well as an employment duty.910
| Market | Channel duty | Response times | Sanction or incentive | Source |
|---|---|---|---|---|
| Germany | 50+ employees (50 to 249 may share) | Acknowledge within 7 days; feedback within 3 months | Fines up to EUR 20,000 (no channel) and EUR 50,000 (reprisals) | HinSchG |
| France | 50+ employees, after consulting the CSE | Not confirmed | External reporting to authorities permitted | service-public.gouv.fr |
| United Kingdom | No statutory duty identified | Not applicable | Unfair dismissal and detriment claims; six-month limit | GOV.UK |
| United States (federal) | No general duty identified | Not applicable | SEC awards 10% to 30% above USD 1 million; DOJ pilot awards | sec.gov; justice.gov |
Decisions to make
- Which group entities have 50 or more employees in an EU Member State?26Germany and France require internal channels at that size.
- Will the group run one global channel or local channels?23German law allows sharing only between employers of 50 to 249 employees, and each employer keeps its own duty to follow up and give feedback.
- Who triages reports, and how fast can potential self-reports be escalated?109US programmes reward external reporting, and the DOJ pilot links declination eligibility to self-reporting within 120 days of an internal report.
- How will managers be trained to avoid reprisals?48German law presumes a disadvantage after a report is a reprisal, and UK workers are protected from detriment from day one.
Documents usually needed
- Whistle-blowing policy covering all group entities and the local variations
- Channel description, access instructions and data protection notice
- Case log with acknowledgement and feedback dates
- Investigation protocol and escalation path to the board or audit committee
- Training records for managers on confidentiality and non-retaliation
Common mistakes
- Relying on a group hotline alone in Germany without meeting the local channel rules
- Missing the seven-day acknowledgement or three-month feedback deadline
- Disciplining a reporter for unrelated reasons without evidence, given the burden of proof
- Treating a report as an employment grievance and not assessing it for self-report decisions
- Failing to protect the reporter's identity in the investigation
Questions businesses ask
What this guide does not yet confirm
These points need checking with a qualified local professional before you rely on them.
- The articles of Directive (EU) 2019/1937 could not yet be checked on EUR-Lex; the 50-employee and response-time rules are recorded from the German implementing law.
- French response times and the role of the Défenseur des droits were not confirmed.
- UAE, Saudi, Indian and Singapore whistle-blowing rules were not researched.
- The UK six-month claim period should be checked against commencement of the Employment Rights Act 2025.
Sources and review status
Each statement is numbered to the source it was checked against. We use official sources where we can, and each statement says whether it was checked against an official or a secondary source. Sources last checked on 19 October 2026. None of it has been professionally reviewed yet: it is research checked against official and secondary sources by WONE Global, not legal or tax advice.
Directive (EU) 2019/1937 of 23 October 2019 on the protection of persons who report breaches of Union law entered into force on 16 December 2019 and is implemented through national laws in each Member State. EU-wide. Germany implements it through the Whistleblower Protection Act (HinSchG) and France through law 2016-1691 as amended by law 2022-401.
Only the title and metadata were readable; the articles on the 50-worker threshold and response times could not yet be checked on EUR-Lex and are recorded from the German implementing law.
Employers that generally have at least 50 employees must set up and operate at least one internal whistle-blowing channel under the Whistleblower Protection Act (HinSchG). Certain financial and investment firms are covered regardless of headcount (§ 12(3)). Employers with 50–249 employees may share a channel (§ 14(2)); their transitional period ended on 17 December 2023.
A German internal reporting office must confirm receipt of a report to the whistle-blower within seven days and give feedback on planned and completed follow-up within three months of that confirmation. HinSchG section 17(1) and (2). Where no confirmation was sent, the three months run from three months and seven days after receipt. Anonymous reports should also be processed (section 16(1)), though channels need not be designed for anonymous reports.
Reprisals against whistle-blowers are prohibited in Germany, and where a whistle-blower suffers a work-related disadvantage after a report, it is presumed to be a reprisal unless the employer proves it was justified on other grounds. HinSchG section 36(1) and (2).
Failing to set up an internal whistle-blowing channel can be fined up to EUR 20,000, and obstructing reports or retaliating against whistle-blowers up to EUR 50,000. Fine for not setting up a channel applies from 1 December 2023.
Employers with at least 50 employees must establish an internal procedure for receiving and handling whistle-blower reports, after consulting the CSE. Whistle-blowers can report externally, directly or after an internal report, to the Défenseur des droits, the judicial authority, competent authorities or EU bodies, and are protected against retaliation. Legal basis: law 2016-1691 (articles 6 to 13), law 2022-401 of 21 March 2022 and decree 2022-1284 of 3 October 2022.
In the UK a worker's disclosure is protected if the worker reasonably believes it is in the public interest and shows a criminal offence, a breach of a legal obligation, a miscarriage of justice, danger to health or safety, damage to the environment, sexual harassment, or deliberate concealment of any of these. Public Interest Disclosure Act 1998 provisions in the Employment Rights Act 1996. Disclosures are protected when made to the employer, a legal adviser or a prescribed person such as a regulator, and to others such as the media only in limited circumstances.
Page metadata shows last updated 16 October 2026.
UK workers who make protected disclosures are protected from detriment, and employees from unfair dismissal, from the start of employment, with claims to be raised within six months and Acas notified before an employment tribunal claim. Volunteers, most self-employed people and non-executive directors are unlikely to be protected. The guidance does not state that employers must have a whistle-blowing policy.
Page metadata shows last updated 16 October 2026; the six-month time limit should be checked against the commencement of the relevant provisions.
The SEC whistleblower programme pays awards of 10% to 30% of the money collected in SEC enforcement actions with over USD 1 million in sanctions to individuals who voluntarily provide high-quality original information, and the SEC can take action against employers that retaliate. Federal; Dodd-Frank Act. Award applications are due within 90 calendar days of a Notice of Covered Action.
The Department of Justice Corporate Whistleblower Awards Pilot Program pays eligible whistleblowers a share of forfeited assets for original information on corporate misconduct in areas including foreign corruption, sanctions violations, and trade, tariff and customs fraud; a company that self-reports within 120 days of an internal whistleblower report, and before the Department contacts it, may still qualify for a declination. Federal; Department of Justice Criminal Division. Awards are discretionary. Programme guidance was updated in July 2026.
Questions on this topic
10 statements on whistleblowing rules
