EU Directive 2019/1937

1. What is the EU Directive 2019/1937?

The EU Directive 2019/1937, commonly known as the Whistleblower Protection Directive, establishes common minimum standards for the protection of persons reporting on breaches of Union law. Its goal is to guarantee a high level of protection for whistleblowers and to encourage the reporting of misconduct across all EU Member States.

2. Who is required to comply?

The Directive mandates that all legal entities in the private sector with 50 or more employees must establish secure internal reporting channels. In the public sector, all legal entities must comply, though Member States may exempt municipalities with fewer than 10,000 inhabitants.

3. Key Requirements for Reporting Channels

• Confidentiality & Anonymity: The identity of the reporting person must be kept strictly confidential. Anonymous reporting must be facilitated.
• Acknowledgment of Receipt: Acknowledgment of the report must be sent to the whistleblower within 7 days.
• Diligent Follow-up: The organization must designate an impartial person or department to follow up on the reports.
• Feedback: Feedback must be provided to the reporting person within a reasonable timeframe not exceeding 3 months.
• Data Protection: All processing of personal data must comply with the GDPR.

4. How complybox.eu helps you comply

complybox.eu is purpose-built to meet and exceed every requirement of the Directive:

• End-to-End Encryption: We ensure absolute anonymity by encrypting reports directly in the browser. Only the designated personnel with the decryption key can read them.
• Anonymous Two-Way Communication: The platform allows the designated personnel to chat with the whistleblower, request further information, and provide the mandatory feedback, without ever compromising their anonymity.
• Automated Timelines: complybox.eu automatically tracks the 7-day acknowledgment and 3-month feedback deadlines, sending reminders to ensure your organization stays compliant.
• Secure Log & Audit Trail: Every action taken on a case is logged securely to prove compliance in case of an audit.

5. National Transpositions

While the Directive sets minimum standards, each EU Member State has transposed it into national law (e.g., Law 4990/2022 in Greece). complybox.eu is designed to be flexible enough to accommodate stricter national requirements where applicable.