The period for transposing the Directive on the Protection of Persons who Report Breaches of Union Law (Directive (EU) 2019/1937) ('the Whistleblowing Directive') expired on 17 December 2021. In particular, EU Member States are required to bring into force the laws, regulations, and administrative provisions necessary to comply with the Whistleblowing Directive by 17 December 2021.

In summary, the Whistleblowing Directive aims to enhance the enforcement of EU law and policies in specific areas by laying down common minimum standards that provide for a high level of protection of persons reporting breaches of EU law. In this regard, the Whistleblowing Directive applies to persons working in the private or public sector who acquire information in a work-related context. Such persons qualify for protection if they have reasonable grounds to believe that the information in their report is true and if they have made their report in accordance with the procedures set out in the Whistleblowing Directive.

For businesses and organisations, the Whistleblowing Directive mandates Member States to ensure that legal entities in the private and public sector establish channels and procedures for internal reporting and follow-up. Subject to national variation, legal entities in the private sector with 250 workers or more are generally required to comply with these obligations by 17 December 2021, while legal entities with 50 to 249 workers must comply by 17 December 2023.

To date, only four Member States, Denmark, Lithuania, Portugal, and Sweden, have enacted laws to transpose the Whistleblowing Directive; notably, the Swedish Act on the Protection of Persons Reporting Irregularities (2021:890) and the Danish Act No. 1436 of 29 June 2021 on Protection of Whistleblowers enter into force on 17 December 2021.

You can read the Whistleblowing Directive here and OneTrust DataGuidance's 2021 roundup here.