Italy's D.Lgs. 24/2023, explained

Not Italy's first whistleblower law, but its first comprehensive one

The EU Whistleblowing Directive — Directive (EU) 2019/1937 — requires companies with 50 or more staff across the EU to give employees a protected, internal way to report wrongdoing; see the Directive, explained for the full baseline every member state builds on.

Italy already had whistleblower protection before the Directive existed — Legge 179/2017 gave public-sector employees a right to report wrongdoing without retaliation. D.Lgs. 24/2023, in force from 15 July 2023, doesn't amend that law; it repeals it outright (Art. 23) and replaces it with a single regime covering public and private entities alike. That's a different pattern from Germany's HinSchG, which built a new law from scratch, and closer to how France amended an existing one — except Italy chose a clean break over an in-place amendment. The result carries the Directive's core mechanics — the 50-employee threshold, the 7-day/3-month clock, broad retaliation protection — plus a handful of places where Italy's own text goes further than the Directive requires.

Three separate routes into scope, not just headcount

Article 2(1)(q) defines which private entities are covered, and headcount is only one of three ways in:

• The general rule — an average of at least 50 employees (permanent or fixed-term) over the past year.
• Regulated sectors, regardless of headcount — entities operating in financial services and markets, or anti-money-laundering/counter-terrorist-financing, are in scope even with a single employee.
• Any entity with a D.Lgs. 231/2001 compliance model, regardless of headcount — if a company has adopted an organisational and management model under Italy's corporate-liability framework, it's covered too, though its material scope is narrower (internal reporting of model-related violations only) unless it also crosses the 50-employee line.

The public sector has no headcount test at all — every public administration is covered.

On timing, Italy runs the same two-tier structure Germany does: the general effective date is 15 July 2023, but private entities with an average of up to 249 employees got until 17 December 2023 specifically for the internal-channel obligation (Art. 24(2)).

Where a violation actually costs you

Article 21 gives ANAC real, direct administrative-sanction power — not an indirect enforcement route through another authority. Three tiers:

• €10,000–€50,000 — for confirmed retaliation, for obstructing (or attempting to obstruct) a report, or for breaching the confidentiality duty set out in Art. 12.
• €10,000–€50,000 — for not having established a reporting channel at all, for not adopting a compliant procedure (or adopting one that doesn't meet Arts. 4–5), or for failing to actually verify and analyse reports that were received. Worth noticing: Italy puts "no channel exists" in the same band as active retaliation. That's a real design choice, not an oversight — see the comparison section below.
• €500–€2,500 — the smallest tier, aimed at the reporter rather than the entity: it applies where a reporting person is found civilly liable, even at first-instance judgment, for defamation or slander made with intent or gross negligence (Art. 16(3)), unless they've already been criminally convicted of the same conduct.

Unlike Germany's OWiG-based multiplier or France's Code pénal Art. 131-38, Art. 21 doesn't spell out a separate, higher cap for a legal entity — the fine attaches to whoever ANAC finds responsible for the violation, which in practice is the entity's governing body or legal representative rather than a distinctly multiplied corporate figure.

Anonymous reporting: no upfront mandate, but the protection follows you if you're later unmasked

D.Lgs. 24/2023 doesn't require an internal channel to be built for anonymous submissions — much like Germany, Italy leaves that operational choice open rather than mandating it. Where Italy's text is more explicit than most is Art. 16(4): the same protections that apply to a named reporter apply in full to an anonymous one if they're later identified and suffer retaliation as a result. That's not left to inference from general principle — it's written directly into the statute. Provoxis doesn't wait for that scenario to matter: anonymous reporting is always on, with no configuration needed — see anonymous vs identified reporting, explained.

Your unions have a statutory seat at the table, not a court-derived one

Article 8(1) of the Directive requires member states to ensure internal channels are established following social-partner consultation, where national law provides for it — the same baseline covered in what a compliant channel actually requires. Italy writes this obligation directly into the operative article that creates the channel itself: Art. 4(1) requires both public and private entities to consult ("sentite") their union representatives — the RSU/RSA structures defined by Art. 51 of D.Lgs. 81/2015 — before activating an internal reporting channel. That's a firmer footing than Germany's, where the right traces back to works-council case law rather than the whistleblowing statute's own text, and than France's, where it sits in an implementing decree rather than the law itself.

A wider net than the Directive's floor, and encryption is not optional

Two features make D.Lgs. 24/2023 worth a dedicated read rather than a footnote to the Directive:

• Broader material scope. The Directive's own list of covered subject areas is fairly narrow — public procurement, financial services, product safety, and similar. Article 2(1)(a) folds that list in as one category among several, but also separately covers general administrative, accounting, civil, or criminal offences that harm the public interest or an organisation's integrity, plus any violation of a company's own D.Lgs. 231/2001 compliance model. A report doesn't have to trace back to an EU-regulated sector to count.
• Encryption is written into the statute itself, not left to guidance. Both Art. 4(1) (internal channels) and Art. 7(1) (ANAC's external channel) require confidentiality to be guaranteed "anche tramite il ricorso a strumenti di crittografia" — including through the use of encryption — as an explicit statutory requirement, not a best-practice recommendation added later by regulator guidance.

Article 14(1) also sets a hard statutory retention ceiling: reports and related documentation can be kept for no longer than five years from the date the final outcome is communicated. See choosing a retention policy for how that compares with Provoxis's own retention tiers.

Can we just use an email address?

Only with safeguards you can justify. ANAC's guidelines on internal channels (Guidelines 1/2025, approved by Resolution 478 of 26 November 2025) say ordinary email and PEC are in themselves not adequate to protect the reporter's identity, unless accompanied by specific countermeasures, justified as risk-mitigation measures in the data protection impact assessment. ANAC's reasoning is that mail systems routinely generate and keep logs of every message sent and received, and that the risk of tracing the reporter is greater still when they use a mailbox provided by their employer. See is an email inbox a compliant whistleblowing channel? for what an inbox needs to pass, and can you use Google Forms as a whistleblowing channel? for the form-based alternative.

One external channel for everyone, with ANAC as the front door

Where Germany splits its external channel three ways by subject matter, Italy centralises: ANAC runs the single external reporting channel for both public- and private-sector reports (Art. 7). If a report ANAC receives actually falls under another authority's remit, ANAC forwards it on and tells the reporter it's been redirected — and that receiving authority then has to apply the same confidentiality safeguards ANAC itself would have (Art. 8(2)). A reporter never has to guess which of several agencies to approach first.

What this means if you're comparing IT to another member state

Italy and Germany land on the same headline ceiling — up to €50,000 — but split up what earns it differently. Germany reserves €50,000 for the worst conduct (retaliation, obstruction, wilful confidentiality breach) and caps simply not having a channel much lower, at €20,000, treating that as the lesser failure. Italy puts "no channel exists" in the exact same €10,000–€50,000 band as active retaliation (Art. 21(1)(a)–(b)) — under Italian law, never having built a compliant channel in the first place is exposed to the same maximum fine as punishing someone for using one. That's a genuinely different regulatory judgment about which failure is worse, not just a different number.

Legal basis

• Art. 1(1), D.Lgs. 24/2023 — the material scope: violations of national or EU law harming the public interest or an organisation's integrity.
• Art. 2(1)(q), D.Lgs. 24/2023 — the three routes into private-sector scope: the 50-employee threshold, regulated sectors, and D.Lgs. 231/2001 compliance models.
• Art. 3(2), D.Lgs. 24/2023 — how material scope narrows for entities covered only via the 231-model route.
• Art. 4(1), D.Lgs. 24/2023 — the internal-channel obligation, the statutory union-consultation requirement, and the encryption requirement.
• ANAC Guidelines 1/2025 on internal reporting channels, approved by Resolution 478 of 26 November 2025 — ordinary email and PEC treated as in themselves not adequate to protect the reporter's identity without justified countermeasures.
• Art. 7–8, D.Lgs. 24/2023 — ANAC's external channel, its encryption duty, and the routing obligation when a report falls outside ANAC's own remit.
• Art. 12, D.Lgs. 24/2023 — the confidentiality obligation, its scope, and its limits in disciplinary and judicial proceedings.
• Art. 14(1), D.Lgs. 24/2023 — the five-year statutory retention ceiling.
• Art. 16(3)–(4), D.Lgs. 24/2023 — loss of protection for bad-faith reports, and retroactive protection for an anonymous reporter later identified and retaliated against.
• Art. 21, D.Lgs. 24/2023 — ANAC's administrative-sanction powers and all three fine tiers.
• Art. 24, D.Lgs. 24/2023 — the transitional timeline: 15 July 2023 generally, 17 December 2023 for entities with up to 249 employees.
• Art. 8(1), Directive (EU) 2019/1937 — the EU-wide baseline requiring social-partner consultation, which Italy implements directly in Art. 4(1) rather than through case law or a separate decree.