European Union

Overview

Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law established a baseline that every member state must implement in national legislation.

Core requirements

• Internal channels — organisations with 50+ workers must establish secure reporting channels.
• External channels — competent authorities must provide independent reporting routes.
• Three-tier reporting — internal, external, and (in defined circumstances) public disclosure.
• Anti-retaliation — a broad prohibition on reprisals, with a reversed burden of proof.

Scope

The Directive covers breaches across areas such as public procurement, financial services, product and transport safety, environmental protection, public health, and consumer and data protection. National transpositions frequently go further.

Implementation status and detail vary by member state. This guide is general information, not legal advice.