The EU Whistleblowing Directive, explained

Directive (EU) 2019/1937 — usually just called "the Whistleblowing Directive" — is the EU's law on protecting people who report breaches of EU law they encounter at work. The European Parliament and Council adopted it on 23 October 2019, after a run of scandals through the 2010s — Dieselgate, LuxLeaks, the Panama Papers, the Cambridge Analytica revelations among them — where the people who first raised the alarm had little or no legal protection, and in some cases faced prosecution for doing it. Rather than leave whistleblower protection to each member state to invent on its own, the Directive sets one binding EU-wide floor that every member state had to transpose into its own national law — which is why "the Directive" and, say, Germany's HinSchG describe the same underlying obligation wearing different national clothes. See the country guides below for how each member state actually did it.

For an employer, what the Directive requires comes down to three things. First, if you meet the headcount threshold (see the 50-employee threshold, explained), you must run an internal reporting channel people can actually use safely. Second, that channel has to meet specific mechanics that aren't optional — who's allowed to use it, how quickly you acknowledge a report, how fast you give feedback, and how you protect a reporter's identity. Third, you must not retaliate against anyone who uses it, and the law is deliberately broad about what counts as retaliation.

This section covers that baseline in full, in the order it makes sense to actually learn it: start with who's protected, then what a compliant channel actually requires and internal vs external vs public reporting routes. Confidentiality and legal protection and the 7-day/3-month feedback clock cover what happens once a report is made. What you can actually report and what counts as retaliation cover the detail worth knowing once the basics are in place. Country-specific detail — each member state's own law, competent authority, and penalty regime — is published one country at a time in the guides below.