Ireland's Protected Disclosures Act, explained

A law that predates the Directive by five years

The EU Whistleblowing Directive — Directive (EU) 2019/1937 — requires companies with 50 or more staff across the EU to give employees a protected, internal way to report wrongdoing; see the Directive, explained for the full baseline every member state builds on.

Ireland isn't transposing the Directive from a standing start. The Protected Disclosures Act 2014 already gave workers strong protection against dismissal and detriment for blowing the whistle, years before Directive (EU) 2019/1937 existed. Rather than sit alongside a new, separate statute, the Directive was transposed by amending that existing Act in place, through the Protected Disclosures (Amendment) Act 2022 (No. 27 of 2022), which commenced on 1 January 2023. The result is one consolidated law — most people just call it "the Protected Disclosures Act" — carrying both the original 2014 protections and the Directive's own requirements: the internal-channel obligation, the 7-day acknowledgement and 3-month feedback clock (see the 7-day/3-month clock, explained), and a new criminal-offence regime the 2014 Act never had.

That history is worth stating plainly, because it's easy to conflate with the UK's similar-looking Public Interest Disclosure Act 1998: Ireland's pre-existing law didn't exempt it from the Directive. As an EU member state, Ireland carries the same binding obligations as Germany or France — see UK vs EU: what's actually required where for why that distinction matters if you're comparing the two.

The threshold and the two-stage deadline

Section 6(3) sets the same headcount line the Directive itself sets: an employer with 50 or more employees must establish, maintain, and operate internal reporting channels — see the 50-employee threshold, explained for how that line is drawn generally. Two groups fall outside the threshold entirely, regardless of size: public bodies, and employers whose activities fall within the Directive's own Annex — financial services and markets, anti-money-laundering and counter-terrorist-financing, and transport safety among them (s.6(4)). Those employers have needed a channel since day one, however small they are.

For everyone else, the obligation arrived in two stages. Employers with 250 or more employees were covered from commencement, 1 January 2023. Employers with 50 to 249 employees got the extension Article 26(2) of the Directive allows member states to grant — the same date Germany chose for its own smaller-employer deadline — with the obligation applying to them from 17 December 2023 (s.6(5)).

A criminal-offence regime, not an administrative fine

Where Germany and France's penalties run through an administrative or criminal-fine process against the company, Ireland's 2022 amendment built its enforcement teeth as straightforward criminal offences, set out in a single new section, s.14A. Five things trigger an offence: hindering a report, penalising (or threatening to penalise) a reporter or anyone connected to them, bringing vexatious legal proceedings against a reporter, breaching the duty of confidentiality over a reporter's identity, or simply failing to establish a compliant internal channel at all. The penalty bands differ by which one applies:

• Up to €250,000, or up to 2 years' imprisonment, or both (on conviction on indictment) — for hindering a report, penalising a reporter, bringing vexatious proceedings, or failing to have a channel in place. On summary conviction the ceiling is a class A fine (up to €5,000) or 12 months, or both.
• Up to €75,000, or up to 2 years, or both (on indictment) — for breaching the confidentiality duty over a reporter's identity.
• Up to €100,000, or up to 2 years, or both (on indictment) — for a reporter who knowingly reports false information.

Two details make this land harder than the headline number suggests. First, where an offence is committed by a company, a director, manager, secretary, or other officer can be personally prosecuted alongside it if the offence is shown to involve their consent, connivance, or neglect (s.14A(6)) — this isn't only a corporate exposure. Second, the offence for simply not having a channel is prosecuted separately from the others: the Workplace Relations Commission (WRC), not the Commissioner described below, brings those summary proceedings (s.14A(7)).

Where the real exposure sits: compensation, not fines

The criminal offences above are the newest layer, but they sit on top of a compensation framework that predates them and, for most companies, matters more in practice. Three separate routes exist, and they can't all be used for the same complaint:

• Dismissal. A dismissal found to be wholly or mainly because of a protected disclosure is automatically unfair (Unfair Dismissals Act 1977, s.6(2)(ba), inserted by the original 2014 Act), with the normal qualifying-service and headcount exclusions disapplied. The usual 104-week compensation cap is more than doubled for these cases specifically — to 260 weeks' remuneration, roughly five years' pay (s.7(1A)).
• Penalisation short of dismissal. A worker penalised in any other way — demotion, a bad reference, a reduction in duties — can bring a complaint to the WRC under s.12(1). Compensation follows the same 260-week ceiling (or a flat €15,000 for an unpaid worker, such as a board member, who isn't in receipt of remuneration).
• A tort action. Separately, s.13 gives a person who suffers detriment a direct right of action in tort. An employee generally has to pick one route or the other for the same matter, not both.

All three routes share one deliberate feature the 2022 amendment added: the burden of proof is reversed. In a WRC penalisation complaint or a tort action alike, the detriment is presumed to have resulted from the disclosure unless the employer proves it was based on genuinely unrelated, "duly justified" grounds (s.12(7C), s.13(2B)) — see what counts as retaliation for how that presumption fits the Directive's own retaliation protections. There's also a fast route that doesn't wait for a full hearing: a worker who claims penalisation can apply to the Circuit Court for interim relief within 21 days of the last act of penalisation.

Anonymous reporting: no obligation to accept it, full protection if you do

Ireland takes a slightly sharper version of Germany's stance. Section 5A doesn't oblige a company to accept or follow up on anonymous reports at all — an internal channel can lawfully take identified reports only. But if a company chooses to accept anonymous ones and later identifies who made a report, that person is treated exactly as if they'd made an ordinary protected disclosure, with the full range of protections against penalisation that come with it. There's no partial or weaker status for someone who reported anonymously — see anonymous vs identified reporting, explained for how Provoxis handles this regardless of what any single jurisdiction requires: anonymous reporting is always on, with no setting to configure.

Can we just use an email address?

It can be. Section 6A requires internal channels to be designed, established and operated securely, protecting the confidentiality of the reporter and anyone named, and preventing access by anyone other than the designated people. Irish law doesn't require you to accept anonymous reports, which makes email more workable here than in Spain, for example, and Irish public bodies commonly publish a dedicated email address for disclosures. What matters is that only the designated people can open it. See is an email inbox a compliant whistleblowing channel? for what an inbox needs to pass, and can you use Google Forms as a whistleblowing channel? for the form-based alternative.

The Commissioner redirects reports — it doesn't investigate them

The Office of the Protected Disclosures Commissioner (OPDC) is a new statutory office, established by the 2022 amendment inside the existing Office of the Ombudsman — by law, whoever holds the role of Ombudsman also holds the role of Commissioner (s.10A). Its job when a report arrives isn't to investigate the underlying wrongdoing itself: it assesses the report and forwards it to whichever body — typically a sector regulator — is best placed to follow up, accepting and dealing with a report directly only where no more appropriate body exists. In its most recent full year the OPDC received 262 reports and redirected the large majority of them, handling only a handful itself.

What this means if you're comparing IE to another member state

Ireland's €250,000 ceiling looks larger next to Germany's own €50,000-per-violation cap, but the two systems aren't measuring the same thing. Germany's is a single administrative-fines regime aimed at the company; Ireland layers a criminal offence — one that can reach a director personally — on top of a compensation system that was already unusually generous before the Directive arrived. A company weighing its Irish exposure mainly against the criminal-fine bands is using the wrong yardstick: 260 weeks' pay per mishandled dismissal is the number that should worry an employer here more.

Legal basis

• Protected Disclosures Act 2014 (No. 14 of 2014) and the Protected Disclosures (Amendment) Act 2022 (No. 27 of 2022) — the consolidated law, as amended.
• Section 6 — the 50-employee threshold, the public-body and Annex-sector exceptions, and the 17 December 2023 extension for 50–249-employee employers.
• Section 14A — the criminal offences and their penalty bands, inserted by s.24 of the 2022 Act.
• Section 12 — penalisation short of dismissal, the reversed burden of proof, and the 21-day Circuit Court interim-relief route.
• Section 13 — the parallel tort right of action for detriment, with its own reversed burden of proof.
• Section 11 — the Unfair Dismissals Act 1977 amendments, including the 260-week compensation cap for a disclosure-linked dismissal.
• Section 5A — anonymous reports: no obligation to accept them, full protection if a reporter is later identified.
• Section 6A — internal channels designed, established and operated securely, protecting confidentiality and preventing access by anyone other than the designated people.
• Section 10A — establishment of the Office of the Protected Disclosures Commissioner.
• Art. 26(2), Directive (EU) 2019/1937 — the extended transposition deadline Ireland's own 50–249-employee timeline follows.