Ashio whistleblowing software

Oct 5, 2026

Does My Company Need a Whistleblowing Channel? The EU SME Rule Explained

Does My Company Need a Whistleblowing Channel? The EU SME Rule Explained

Most EU companies under 250 employees assume the EU Whistleblowing Directive does not apply to them โ€” until a regulator, a journalist, or a single employee complaint makes the opposite obvious. The honest answer to "does my company need a whistleblowing channel" is that the directive itself draws a line at 50 employees for most private-sector employers, but several adjacent regimes pull smaller employers back into scope, and a growing number of SMEs set up a channel voluntarily because the reputational and legal cost of not having one now exceeds the cost of running one. Here is how to read the rule the way a compliance officer reads it.

Table of contents

Key takeaways

  • The EU Whistleblowing Directive 2019/1937 applies to private companies with 50 or more employees and to all municipalities regardless of size; smaller private employers are only in scope if sector-specific rules (financial services, anti-money-laundering, anti-corruption) say so.
  • Volunteers, contractors, board members, shareholders, and job applicants are protected once the directive applies, but the headcount threshold is calculated on employees in the way each member state defines it โ€” usually workers on a payroll, not contractors.
  • A compliant internal channel must accept reports in writing and orally, keep the reporter anonymous, acknowledge within 7 days, give feedback within 3 months, and keep a confidential case file with an immutable audit trail.
  • The original transposition deadline was 17 December 2021, but most member states (including Germany via HinSchG) transposed later; companies that waited for enforcement still need a working channel today.
  • Voluntary adoption is sensible for any employer that handles customer money, patient data, public funds, or has EU subsidiaries โ€” and the setup cost is now low enough that waiting for a forced decision is the riskier choice.

Who the EU Whistleblowing Directive actually applies to

The directive covers any legal entity in the private or public sector with 50 or more workers, plus a smaller set of organisations that fall in scope no matter the headcount. Member states may lower the threshold for their own transposition โ€” Germany did so to 50 employees for most employers and dropped it further for certain sectors โ€” but they cannot raise it above the directive's floor.

The entities that are always in scope, regardless of size, are:

  • Legal entities in the financial services sector that fall under EU anti-money-laundering rules
  • Companies covered by EU anti-corruption instruments, including those subject to specific EU funding integrity rules
  • Public-sector bodies at national, regional, and municipal level

Outside those carve-outs, the directive targets the typical mid-market employer: a company large enough to be operationally complex, small enough that a single dedicated compliance officer is unusual, and exactly the kind of organisation that benefits from a structured internal reporting channel rather than ad hoc HR handling.

A quick reality check for the office manager doing the first scan: if your organisation is a private company, has fewer than 50 workers, does not sit in a covered sector, and has no EU public-interest entity obligations, you are not bound by the directive today. Everything that follows in this guide helps you confirm that conclusion โ€” and shows you when you should still set one up voluntarily.

How many employees trigger the obligation

The headline threshold is 50 employees for private-sector legal entities. That number is the same across all member states because Article 1 of the EU Whistleblowing Directive sets it directly; national transpositions can lower it (Germany did, for some sectors) but cannot raise it. Companies with 49 or fewer workers are out of scope unless sector-specific law says otherwise.

A few practical notes that change how the number is read:

  • The count is normally taken at a point in time during the relevant financial year, not as a long-run average โ€” many compliance teams review the headcount at the start of each year.
  • Member states calculate the number differently in detail. France and Germany use a fairly conventional headcount based on the employer's workforce at a defined date; the Netherlands and Spain do similarly; some states look at the average over a reference period.
  • The directive distinguishes between employing the worker (counts) and being a customer of an independent contractor (does not count for the threshold, even if the contractor works exclusively for you).

The threshold is one part of the test. The other is the type of entity you are โ€” and the next section covers that.

What '50 employees' really counts in practice

Headcount is rarely as clean as the headline number suggests, because the question everyone in HR eventually asks is the same: do part-time staff, temps, board members, and contractors count? Member states and sector-specific regulators disagree on the edges, but the directive is explicit on the main categories and gives member states room to extend the list.

The workers who typically count toward the threshold include:

  • Full-time and part-time employees on the payroll
  • Fixed-term and temporary agency workers assigned to the organisation
  • Self-employed contractors where national law treats them as workers
  • Volunteers and trainees, where the member state has chosen to include them

People who are usually protected once the directive applies โ€” even though they are not counted for the headcount threshold โ€” include:

  • Shareholders, board members, and non-executive directors
  • Job applicants, when the information reported concerns the recruitment process
  • Former employees, suppliers, and their staff
  • Anyone who reports on behalf of a worker (a union representative, a family member, a colleague)

If you want a defensible headcount, ask three questions. First, how many people does the payroll department process this month. Second, how many contractors are integrated into the team long-term and could reasonably be expected to raise a concern about a manager. Third, would your defence hold up if a regulator cross-checked the figure against your workplace accidents register, your works council records, and your group financial reporting. If those three answers tell the same story, your threshold number is the one you can defend.

Do private companies, NGOs, and public bodies all fall in scope

The directive covers legal entities in both the private and public sector, but the way it lands differs sharply by type. Private companies with 50 or more workers are in scope for the full internal channel obligation. Public bodies are in scope regardless of headcount, with municipal authorities explicitly named in Article 1. NGOs and other civil-society organisations sit in a grey zone that depends on legal personality, funding, and the sector they operate in.

Are NGOs and charities covered by the directive?

Non-profits and charitable foundations are covered when they meet the directive's definition of a legal entity and either reach the headcount threshold or fall under a sector-specific rule that overrides the threshold. An NGO with paid staff and a board structure is generally a legal entity; the question is whether it is in scope as a private-sector employer or under a sector rule. The honest practical answer is that larger charities with 50 or more paid staff should treat themselves as in scope, while smaller ones should at minimum carry out a documented scoping assessment and record the conclusion.

Does the rule apply to public bodies with fewer than 50 employees?

Yes โ€” all public bodies are in scope regardless of headcount. Municipalities, regional governments, and national agencies cannot use the threshold as a defence. Smaller municipalities and parish councils sometimes rely on shared services to meet the channel requirements, but the obligation to operate one is still theirs.

What about sole traders and very small partnerships?

Sole traders and ordinary partnerships with no employees are outside the directive's personal scope. The moment they take on an employee โ€” even one โ€” they become an employer, and the headcount question reopens. Many small partnerships nevertheless set up a channel voluntarily because their insurer, their sectoral regulator, or a downstream counterparty asks for one.

The pattern across these categories is consistent: where an individual worker is in a position to raise a concern about how the organisation handles risk, money, safety, or integrity, the directive prefers a real channel to no channel โ€” and where there is no worker at all, the directive usually does not bite.

What a compliant internal channel has to do on day one

What a compliant internal channel has to do on day one A compliant internal reporting channel is a defined intake point, a structured case file, and a feedback loop โ€” not an email inbox and a promise. Article 2 and Article 5 of the EU Whistleblowing Directive set the floor; member states have added detail on top of it. Compliance officers who build the channel as a workflow, rather than as a tool, are the ones whose setup survives its first audit.

A channel that meets the directive's day-one requirements must:

  • Accept reports in writing, and where national law requires it, also by telephone or in person
  • Acknowledge receipt to the reporter within 7 days of submission
  • Designate an impartial person or function to handle the report โ€” usually the compliance officer, a designated lawyer, or an external ombudsperson
  • Maintain two-way communication with the reporter through a confidential channel that does not expose identity
  • Provide feedback on the action taken within 3 months of acknowledgement
  • Store reports and case files securely, with access limited to authorised staff, and retain them only as long as necessary
  • Protect the reporter against retaliation, both during the investigation and afterwards

A channel that misses any one of those points will fail an audit. The most common gaps are the oral intake route (still missing in many SME setups), the seven-day acknowledgement deadline (often treated as a calendar reminder rather than a hard SLA), and the immutable case file (still kept in shared mailboxes at many small employers). The details of how a compliant channel is structured โ€” what status fields it tracks, who owns each case, how reports are triaged โ€” are covered in the guide on internal reporting channels, which is worth reading before any vendor call.

How should an integrator read the data protection rules that come with a reporting channel?

The channel handles personal data, special-category data, and sometimes criminal-offence data on both reporters and the people they report about. That puts it squarely inside the GDPR's strictest processing regimes. Article 6(1)(c) โ€” legal obligation โ€” is the lawful basis for processing the report itself; Article 6(1)(e) โ€” public task โ€” applies to public bodies; legitimate interest under Article 6(1)(f) is rarely enough on its own. Special-category data triggers Article 9, and the controller must complete a DPIA before going live.

The data-protection picture most SMEs miss is that whistleblowing systems are usually joint controllers between the employer and any third party that processes the data on the employer's behalf โ€” meaning a written processing agreement is mandatory, not optional. The same logic applies to retention: most transpositions cap storage at the time needed to process the report, after which records are deleted or fully anonymised. The intersection of the directive, the GDPR, and national labour law is the single area where compliance officers spend the most time getting comfortable before going live.

What changes on 17 December 2021 vs the later 2023 deadline

The directive was published in November 2019, with an original transposition deadline of 17 December 2021. Member states were supposed to bring the rules into national law by that date and have operational channels within the next two years. The reality across the EU was uneven: some member states transposed on time, others were late, and several โ€” Germany included โ€” issued implementing laws in 2023 and 2024 after a long legislative process.

The two deadlines that matter in practice are:

  • 17 December 2021 โ€” the date by which member states had to transpose the directive. Missing it does not let a member state off the hook; the directive has direct effect once the deadline passes, which means individuals can sometimes rely on it directly.
  • 17 December 2023 โ€” the date by which the directive's internal channel obligation applied to legal entities with 50โ€“249 workers. Public bodies and entities with 250+ workers had to comply earlier (by 17 December 2021 at the national transposition stage, and from 17 December 2023 at the latest in operation).

The practical impact on a 60-person employer is straightforward. From 17 December 2023, your national transposition applies, and you must run an operational channel โ€” regardless of when your member state technically finished its legislative work. A regulator auditing your setup in 2026 will ask whether you had a working channel on 18 December 2023, not whether your parliament had passed the law by then. Compliance officers who built their setup against the directive's substantive requirements, rather than waiting for the national law to settle, are the ones who avoid the awkward conversation with an inspector.

When a smaller company should still set up a channel voluntarily

A company with 49 workers is outside the directive. That does not make it outside the obligation to think carefully about how a concern about fraud, harassment, or safety would be handled if it landed on Monday morning. The case for a voluntary channel grows whenever a smaller employer takes on the responsibilities of a larger one โ€” through customers, regulators, or partnerships that expect the same standard. For many SMEs weighing whether they need a whistleblowing channel, the conclusion is the same: a low-cost, self-service setup today is cheaper than a forced rollout after a regulator or a serious incident forces the question.

Sectors and situations where voluntary adoption is the safer choice:

  • Financial services and payments โ€” where anti-money-laundering reporting obligations apply regardless of headcount, and where banks and processors now ask counterparties for a channel
  • Healthcare and life sciences โ€” where patient safety reporting, professional misconduct routes, and pharma compliance lines overlap with the whistleblowing workflow
  • Public funds and EU grants โ€” where auditors will want to see a working channel as a precondition for funding
  • Companies with EU subsidiaries โ€” where a parent company's 200-person head office brings an in-scope entity into the group structure
  • High-growth scale-ups โ€” where the headcount may cross the threshold mid-year, and a channel built at 45 employees is operationally easier to retrofit than one built under audit pressure at 60

The cost of a basic internal channel has fallen enough that the economics now favour voluntary adoption. A flat-fee, self-service reporting tool can be set up in an afternoon, run by an existing compliance lead, and rolled out to staff with one communication. The bigger expense โ€” a year of awkward handling when a real report arrives without a process behind it โ€” is now the rational risk to manage. For the compliance officer weighing the in-house route against a freelancer against a ticketing system against an off-the-shelf tool, the calculation usually comes down to who is going to own the seven-day SLA and the three-month feedback clock on the day a real concern lands. In-house works when there is a named owner and a written runbook; a freelancer works for the legal review but not for the intake; a ticketing system tracks the work but does not protect the reporter; and a purpose-built whistleblowing platform built for the SME compliance market gives the compliance officer a pre-built intake and case file that already meets the directive's day-one spec. When you are ready to put a concrete tool in place, you can sign up and have a working channel running the same week.

Quick checklist: is your organization in scope?

This is the working sheet a compliance officer can run through before any vendor conversation. It is designed to be answered in order, with each question producing a yes, no, or "needs review". Anything that comes back as "needs review" is a real action item โ€” not a "we'll come back to that".

  1. Are you a legal entity with employees in an EU member state, Iceland, Norway, or Liechtenstein? Yes โ†’ continue. No โ†’ out of scope.
  2. Do you have 50 or more workers at the relevant reference date? Yes โ†’ in scope. No โ†’ continue.
  3. Are you in a sector that overrides the threshold โ€” financial services under AML rules, anti-corruption instruments, or public-interest entities? Yes โ†’ in scope. No โ†’ continue.
  4. Are you a public body at any level โ€” national, regional, or municipal? Yes โ†’ in scope. No โ†’ continue.
  5. Do you have EU subsidiaries, public funding, or sectoral regulator expectations that effectively require a channel? Yes โ†’ voluntary adoption is the safer choice. No โ†’ out of scope by the directive, but voluntary adoption may still be sensible.
  6. Is your HR or compliance team named as the owner of the channel, with written procedures and a designated impartial handler? Yes โ†’ operationally ready. No โ†’ channel exists on paper only.
  7. Can your intake accept written reports and, where required, oral reports, and do you have a confidential two-way communication route? Yes โ†’ meets Article 2. No โ†’ build the gap first.
  8. Do you have a documented SLA for the 7-day acknowledgement and 3-month feedback deadlines, with reminders in place? Yes โ†’ meets Article 5. No โ†’ build the SLA into the case workflow.
  9. Have you completed a DPIA, signed a data processing agreement with any third-party processor, and defined a retention rule? Yes โ†’ GDPR-ready. No โ†’ not deployable until this is closed.
  10. Have you published the channel to staff and contractors in a way that meets the directive's "information of the public" requirement? Yes โ†’ compliant on awareness. No โ†’ even a perfect channel fails the public-information test.

For the office manager running this list on a Friday afternoon, the rule of thumb is: if steps 1โ€“4 produce one yes, the channel is mandatory and steps 5โ€“10 are not optional; if they produce four noes but step 5 produces a yes, the channel is voluntary but worth building now; if all five are noes, you are out of scope today and should set a calendar reminder for the headcount review at the start of the next financial year. For the compliance officer who wants a deeper working document โ€” written procedures, DPIA outline, intake template, board paper โ€” the for compliance officers guide covers the operational scaffold in detail.

Frequently asked questions

Does the EU Whistleblowing Directive apply to companies with fewer than 50 employees?

No, not under the directive itself, unless you are in a sector where a different rule overrides the threshold โ€” most commonly financial services subject to anti-money-laundering rules, certain anti-corruption instruments, or where you hold public-interest entity status. For the typical private-sector employer, fewer than 50 workers means the directive does not apply. The directive is not the only reason to set up a channel, though: a voluntary channel can still be required by a regulator, a counterparty, or a parent company.

What is the 50-employee threshold in the EU Whistleblowing Directive?

The directive sets the headline threshold at 50 workers for private-sector legal entities, with public bodies in scope regardless of size. Member states can lower the threshold โ€” Germany lowered it to 50 employees for most employers and to fewer in certain sectors โ€” but cannot raise it above 50. The number is taken at a defined reference date, not as an annual average.

Do part-time workers, contractors, and board members count toward the 50-employee threshold?

Part-time employees and fixed-term workers generally do count toward the threshold; agency workers assigned to the organisation usually count as well. Self-employed contractors and volunteers only count where the member state has decided to include them. Board members, shareholders, job applicants, former employees, and supplier staff are protected by the directive once it applies to you โ€” even though they are not counted for the threshold itself.

What are the deadlines for acknowledging and giving feedback on a report?

The directive requires acknowledgement of receipt within 7 days of submission and feedback on the action taken within 3 months of acknowledgement. Member states may extend the feedback deadline to 6 months in complex cases, but the 7-day acknowledgement window is fixed in the directive and cannot be extended. Missing either deadline is a substantive compliance failure, not a procedural one.

Is a voluntary whistleblowing channel useful for a company that is below the 50-employee threshold?

Yes, for any employer that handles money, data, patients, or public funds, where sectoral counterparty expectations now treat a channel as a baseline control, or where headcount is likely to cross the threshold in the next planning cycle. A working channel is also the single cheapest way to be ready when a regulator or a serious incident forces the conversation. Most voluntary setups today use a self-service reporting tool that meets the directive's substantive requirements, even though the company itself is not bound by it.

Sources