What is Evidencia - Centralized Whistleblowing & Case Management platform?

La solution SaaS centralisée pour la gestion des cas d'investigation, le lancement d'alertes et la conformité.

Does Luxembourg impose broader obligations than the EU Directive?

Yes. Luxembourg transposed the Directive by extending its scope to violations of Luxembourg national law that go beyond the strict perimeter of the European Directive. It is one of the most protective transpositions in Europe.

Is the CNPD the only external competent authority?

No. The CNPD is the national coordinating authority, but sectoral authorities such as CSSF (financial sector), ILR (telecoms), or OGBL (social security) can receive reports falling within their respective domains.

Are temporary workers protected?

Yes. Luxembourg law extends protection to temporary workers, subcontractors, interns, and any person who gained knowledge of information in a professional context, even after the working relationship ends.

How long does a company have to process a report?

The company must acknowledge receipt within 7 days of the report, and provide feedback on measures taken within a period not exceeding 3 months from that acknowledgement.

Is Evidencia suitable for the Luxembourg market?

Yes. Evidencia supports multilingualism (French, English, Luxembourgish) and complies with GDPR requirements with EU hosting. Our platform is used by organisations operating in Luxembourg in financial and industrial sectors.

Whistleblower Regulation in Luxembourg

Law of 16 May 2023 - What Companies Need to Know

Luxembourg adopted an ambitious transposition of EU Directive 2019/1937. Since 16 May 2023, entities with 50 or more employees must have an operational internal reporting system.

← All countries

Regulation Overview

The Luxembourg legal framework

Law name

Law of 16 May 2023

Reference

Law of 16 May 2023 on the protection of persons who report violations of law

In force since

16 May 2023

Application threshold

50+ employees (private sector)

Competent authority

Commission nationale pour la protection des données (CNPD)

Penalties

Administrative fines up to €250,000 for obstruction or retaliation; criminal sanctions possible

Who Must Comply?

Scope of application

All private sector entities employing at least 50 employees, public administrations and local authorities with more than 10,000 inhabitants. Luxembourg extended the scope beyond the Directive's minimum.

Required Reporting Channels

Practical obligations

Internal channel

Mandatory from 50 employees. Must guarantee confidentiality and allow oral or written reporting. Acknowledgement deadline: 7 days. Feedback deadline: maximum 3 months.

External channel

CNPD is designated as the national competent authority for cross-cutting reports. Sectoral authorities (CSSF for financial services, ILR for telecoms, etc.) are also competent in their respective domains.

Whistleblower Protections

One of the most protective regimes in Europe

Extended protection against direct and indirect retaliation

Confidentiality of the whistleblower's identity and persons implicated

Civil and criminal immunity for good-faith disclosures

Reversal of burden of proof: employer must demonstrate absence of connection

Possibility of financial and psychological support for the whistleblower

Absolute nullity of any contractual clause limiting the right to report

Penalties for Non-Compliance

A strict punitive regime

Luxembourg law provides among the highest sanctions in Europe: up to €250,000 in administrative fines for obstruction or retaliation. Criminal sanctions may be added for the most serious violations.