Internal vs external vs public reporting, explained

Three routes, not a strict ladder

The Directive gives a reporter three ways to raise a breach: internally, to a competent external authority, or — in narrower circumstances — publicly. A common assumption is that these sit in a strict order, internal first, external only if that fails. They don't. Each route has its own conditions for protection, and a reporter can choose among them.

Internal first is encouraged, not required

Article 7(1) makes the internal channel available as a reporting option. Article 7(2) adds that member states should encourage using it before going external — but only where the breach can be addressed effectively internally and where the reporter believes there's no retaliation risk. That's encouragement aimed at the reporter's own judgment call, not a gate a company controls.

Article 10 confirms the practical result directly: a reporter can report externally "after having first reported through internal reporting channels, or by directly reporting through external reporting channels." Going straight to a regulator, with no attempt at the internal channel at all, is a protected choice from the outset — not a fallback for when the internal route has already failed.

External reporting: straight to a competent authority

External reporting means going directly to whichever authority a member state has designated to receive reports in the relevant subject area — the kind of body covered in each country's own guide (see, for instance, Germany's three separate external channels or France's Défenseur des Droits). A reporter doesn't need a reason to prefer this route over the internal one — the Directive doesn't condition external reporting on the internal channel being tried, or failing, first.

Public disclosure: the narrowest route, and the last resort

Going public — to the press, or otherwise publicly — is the one route with real conditions attached. Article 15(1) protects a public disclosure only where one of three things is true:

• Internal and external reporting were tried and didn't produce appropriate action within the timeframes those channels require, or a direct external report went the same way.
• There's reasonable grounds to believe the breach is an imminent or manifest danger to the public interest — an emergency, or a risk of irreversible damage.
• There's a real risk the report won't be effectively addressed, or a risk of retaliation, if reported externally instead — evidence that might be concealed or destroyed, or an authority that might be in collusion with whoever's responsible for the breach.

Public disclosure made straight to the press under a separate national press-freedom protection system sits outside this article entirely — that's a different, independently protected route, not an unprotected one.

Why this matters for how you design a channel

Because a reporter is never required to try the internal channel first, a channel that's slow, hard to find, or doesn't inspire confidence doesn't just risk losing the report — it risks the report skipping the company entirely and landing with a regulator, or, if the conditions above are met, in public. See is an email inbox a compliant whistleblowing channel? for what that failure mode actually looks like in practice.

Legal basis

• Art. 7(1)–(2), Directive (EU) 2019/1937 — internal reporting as an available channel, encouraged but not required before going external.
• Art. 10 — the right to report externally, directly or after an internal report.
• Art. 15(1) — the three conditions under which a public disclosure qualifies for protection.