Whistleblowers in the Company: When is a Reporting Procedure Needed

How to assess the threshold, prepare a reporting channel, and protect confidentiality.

Status checked: November 2, 2026. We are not a law firm. The material is for informational and educational purposes only and does not constitute individual legal advice. Before implementing solutions, check current regulations and consult a specialist regarding your specific situation.

Who the Threshold Applies To

The Whistleblower Protection Act links the obligation of an internal procedure generally to entities with at least 50 employees working for the entity as of January 1 or July 1. The method of counting employees and other individuals is specified by the law; it is not sufficient to count only signed employment contracts.

Exceptions and Scope of Reports

Some entities operating in areas specified by the law have obligations regardless of the threshold. The procedure pertains to reporting specific legal violations in a work-related context. Not every employee complaint automatically qualifies for whistleblower status. Data protection and confidentiality regulations must be considered separately.

What the Procedure Should Specify

The law lists elements of the procedure, including channels for receiving reports, authorized entities, follow-up actions, and feedback. Confidentiality of identity, access restrictions, and protection against retaliation are crucial. When creating the procedure, consultations with authorized representation are required by law.

Example of a Small Company

A company employs workers and also uses individuals working on other bases. It should analyze the statutory counting method on the relevant date and any potential sectoral exceptions. Simply having fewer than 50 full-time positions does not resolve all cases.

How to Count the Threshold in Practice

The law distinguishes between employees calculated as full-time equivalents and other individuals performing paid work on a basis other than an employment relationship, provided they do not employ others for this work, regardless of the employment basis. Check the exact conditions for specific collaborators and the appropriate date. Do not simply add all issued invoices.

Confidentiality and Actions After Reporting

Determine who receives the report, who can conduct follow-up actions, and how to avoid conflicts of interest. Limit access to the whistleblower's data and the person to whom the report pertains. The regulations specify the rules for confirming receipt and providing feedback; check the appropriate deadlines and exceptions in the current text of the law.

The procedure should be known to those authorized to report. Also, check information about external reporting to the appropriate authority and the rules for protection against retaliation. The document alone, without an operational channel and responsible individuals, is insufficient to organize the process.

List of Actions

1. Identify the entity and the application of the threshold and exceptions.
2. Prepare secure channels and authorize the appropriate individuals.
3. Conduct required consultations and announce the procedure.
4. Plan for confidentiality, a register, and follow-up actions.

Sources