OneTrust DataGuidance Research confirmed with Dietmar Huemer, Attorney at Huemer Legal Solution, on 11 May 2023, that the Whistleblower Protection Act ('the Act') had been adopted and published in the Official Gazette on 24 February 2023. In particular, the Act implements the Directive on the Protection of Persons who Report Breaches of Union Law (Directive (EU) 2019/1937) ('the Whistleblowing Directive') and outlines requirements for internal and external notification, publication of notifications, review procedures for referrals to external bodies, as well as provisions to protect whistleblowers and people around them.

With regard to scope, the Act provides that it applies to whistleblowers who have obtained information about violations of rights as a result of current or previous professional connections to a legal entity in the private or public sector. In addition, the Act clarifies that it applies to companies and legal entities in the public sector with 50 or more employees or civil servants. Specifically, on penalties, the Act outlines penalties of up to €20,000 for violations and €40,000 for repeat violations. Furthermore, the Act confirms that it will enter into force on the day following its promulgation, with the exception of Sections 11 to 13 of the Act with regard to companies and legal entities in the public sector with fewer than 250 employees. On the above, the Act confirms that Sections 11 to 13 will enter into force on 17 December 2023 with regard to such companies and legal entities.

Importantly, a transition period of six months from the entry into force of the Act applies to the establishment of internal and external bodies.

You can read the press release here and the Act here, both only available in German.