Skip to content
Resources

The rules, in plain language

Everything on this page is the law as it stands: no scare tactics, no invented deadlines. When you’re done reading, you’ll know whether the directive applies to you and what it actually asks.

The EU Whistleblower Directive, explained

Directive (EU) 2019/1937 protects people who report breaches of EU law they encountered at work: employees, but also contractors, suppliers, former staff and job applicants. Its central mechanism is simple: organisations of 50 or more workers must offer an internal reporting channel so concerns can be raised safely before they become external scandals.

The channel must guarantee three things:

  • Confidentiality: the reporter’s identity is protected; only authorised case handlers see a report.
  • Deadlines: receipt acknowledged within 7 days; feedback to the reporter within 3 months.
  • No retaliation: dismissal, demotion or harassment linked to a report is prohibited, with the burden of proof reversed in the reporter’s favour.

Belgium: the Act of 28 November 2022

Belgium transposed the directive for the private sector with the Act of 28 November 2022. The timeline that matters:

  • 15 February 2023: the Act applies to legal entities with 250+ employees.
  • 17 December 2023: it extends to entities with 50–249 employees.
  • Financial services: the obligation applies regardless of headcount.

Two Belgian specifics worth knowing: entities with 250+ employees must also accept anonymous reports (smaller entities may choose), and each legal entity in scope needs its own channel; a group mailbox shared across subsidiaries is not compliant for the 50–249 band.

The deadlines, on a clock

Day 0: a report is submitted through the channel. Day 7: the reporter must have an acknowledgment of receipt. Month 3: the reporter must have feedback: what was investigated, what was decided, what happens next. These are not best practices; they are statutory deadlines, and they apply per report.

What a compliant setup looks like

  • A reporting channel reachable by everyone in scope, in languages your workforce actually speaks.
  • A documented choice on anonymous reporting (mandatory to accept at 250+ in Belgium).
  • A named, impartial case handler with no conflict of interest, plus a fallback when they’re conflicted.
  • A register of reports, with the 7-day and 3-month deadlines tracked per case.
  • A privacy notice explaining how report data is processed (GDPR applies fully).
  • Internal communication: a channel nobody knows about protects nobody.

Frequently asked questions

Do we count temporary workers toward the 50-employee threshold?
Headcount is calculated per legal entity and generally includes all workers. If you hover around the threshold, get a definitive count from your social secretariat, and remember the channel is worth having voluntarily below 50.
Can the case handler be our HR manager?
The law asks for impartiality and absence of conflict of interest. HR can work for some organisations, but reports about HR itself, or about senior management, need a route around them. Many companies name a second handler or an external recipient for exactly that reason.
Can we outsource receiving reports?
Yes. The directive explicitly allows external third parties to receive and handle reports on your behalf. Belfort offers this from €150/month on top of any Neo tier.
Does the channel have to accept anonymous reports?
In Belgium: mandatory for 250+ employees, a documented choice for 50–249. Anonymous channels tend to surface issues earlier; the two-way dialogue in Neo works even for anonymous reporters.
What are the penalties for not complying?
Belgium provides for criminal and administrative sanctions on entities that obstruct reporting or retaliate, and reporters who suffered retaliation can claim compensation. The practical risk is bigger: without an internal channel, reporters go straight to the regulator or the press, lawfully.
Is a shared group channel enough?
For entities of 50–249 employees, each legal entity must have its own channel. Group-level arrangements can complement, not replace it. Neo E handles per-entity provisioning with a group view.

Reading done. Ready to comply?

A channel takes about 15 minutes to configure. Or ask an advisor to sanity-check your situation first.

Start your channel Talk to an advisor