France has progressively strengthened whistleblower protections through Sapin II and the Loi Waserman. Here is what organisations operating in France must now do to stay compliant.
France has established itself as one of Europe's most demanding jurisdictions for whistleblower protection, and the legislative journey from the Sapin II law of 2016 to the Loi Waserman of 2022 illustrates how rapidly obligations on companies have intensified. For any organisation with a footprint in France, understanding these two landmark pieces of legislation is no longer optional — it is a baseline legal requirement.
The Foundation: What Sapin II Established
Enacted in December 2016, the Loi Sapin II — formally the law on transparency, the fight against corruption, and the modernisation of economic life — introduced France's first comprehensive whistleblower statute. It created a single, unified definition of a whistleblower as a natural person who discloses or reports, in a disinterested and good-faith manner, a crime, a misdemeanour, a serious and manifest violation of an international commitment, a unilateral act of an international organisation, the law, or a threat or serious harm to the public interest.
Critically for businesses, Sapin II imposed a mandatory obligation on companies employing at least 50 employees to establish internal reporting procedures. These procedures had to allow staff, collaborators, and external stakeholders to raise concerns safely and confidentially. The law also prohibited any form of retaliation against a whistleblower and imposed penalties on organisations that failed to comply.
Sapin II was genuinely progressive by the standards of its time, but it contained notable gaps. The sequential nature of reporting — requiring employees to exhaust internal channels before going to regulators or the public — was criticised as prioritising corporate interests over individual protection. The law also offered limited clarity on the confidentiality of the whistleblower's identity and fell short on the breadth of persons protected.
The Step Change: Loi Waserman and the EU Directive
France transposed the European Union Whistleblower Protection Directive (2019/1937) through the Loi Waserman, which entered into force in September 2022. The reform was substantial in several key respects.
- Expanded scope of protection: The Loi Waserman broadened the definition of protected persons to include facilitators — individuals or legal entities that assist a whistleblower — as well as associated third parties such as colleagues or relatives who might face retaliation as a result of a disclosure.
- Removal of the sequential reporting obligation: Under Sapin II, whistleblowers were generally required to use internal channels first. The Loi Waserman dismantled this hierarchy, allowing individuals to report internally or externally to a competent authority simultaneously, or to choose whichever route they consider more appropriate.
- Strengthened confidentiality rules: Organisations are now under a strict legal obligation to protect the identity of the whistleblower throughout the process. Any breach of this confidentiality can itself constitute a criminal offence.
- Prohibition extended and clarified: The scope of prohibited retaliatory measures was expanded significantly, encompassing dismissal, demotion, discrimination, intimidation, and any other adverse professional consequence. Courts have been given the power to award provisional remedies to a whistleblower who faces retaliation while proceedings are ongoing.
- Burden of proof shifted: Where a whistleblower alleges retaliation, the burden shifts to the employer to demonstrate that the adverse measure was taken on grounds entirely unrelated to the disclosure.
Practical Obligations for Organisations
Taken together, these two laws place significant and enforceable duties on companies operating in France. Organisations must maintain an internal reporting channel that is secure, accessible, and genuinely confidential. The channel must be capable of receiving reports, providing feedback to the reporting person within a defined timeframe, and protecting all information gathered during the process.
Regulators and courts in France have made clear that a nominal or paper-based procedure is insufficient. The channel must be operational and trusted by staff. Organisations that fail to establish an adequate system — or that are shown to have tolerated retaliation against a whistleblower — face not only administrative sanctions but also the reputational and legal consequences of civil and criminal proceedings.
It is also worth noting that the Loi Waserman introduced financial support mechanisms for whistleblowers facing lengthy legal battles, further signalling the French legislature's intent to make protection substantive rather than symbolic. The practical effect for companies is that attempts to discourage or suppress disclosures carry a far higher legal and reputational risk than was previously the case.
For multinational groups, France's framework interacts with obligations under the EU Directive as transposed across member states, meaning that group-wide whistleblowing policies must be calibrated carefully to meet the most demanding national requirements — which increasingly means France.
Organisations that have not yet reviewed their internal reporting arrangements in light of the Loi Waserman should treat that review as an urgent priority. Establishing a secure, confidential, and legally compliant whistleblowing channel is not merely good governance — in France, it is a legal obligation backed by meaningful enforcement. Specialist platforms such as Whistleblowing.services exist precisely to help organisations meet these requirements without complexity or delay. Now is the time to act.