Who's protected under the Directive

Not just current employees

Article 4 of Directive (EU) 2019/1937 protects a much wider group than "staff." Anyone who acquired information about a breach in a work-related context is covered, including:

• Workers and civil servants, in the ordinary employment-law sense.
• Self-employed people — a contractor or freelancer, not just someone on payroll.
• Shareholders, and anyone on an administrative, management, or supervisory body, including non-executive members.
• Volunteers and trainees, whether paid or unpaid.
• Anyone working under the supervision of a contractor, subcontractor, or supplier — a report doesn't have to come from someone the company directly employs.

A channel designed around the assumption that only "our employees" will ever use it is already narrower than what the law actually protects.

Before you're hired, and after you've left

Protection isn't limited to the window someone's actually on the payroll. Two extensions matter in practice:

• After the relationship ends. Someone who acquired information about a breach during a job that's since ended is still protected if they report it later (Art. 4(2)).
• Before it's begun. Someone who learned about a breach during recruitment or pre-contractual negotiations — a candidate who spotted something during an interview process, for instance — is protected even though they never actually started (Art. 4(3)).

People connected to the reporter, not just the reporter

Article 4(4) extends the same protection to three more categories, because retaliation against a reporter often lands on the people around them instead of the reporter directly:

• Facilitators — anyone who assists the reporting person in the reporting process.
• Third persons connected to the reporter — colleagues or relatives who might be targeted precisely because of who they know, not what they reported.
• Legal entities the reporter owns, works for, or is otherwise connected with in a work context.

Retaliation against any of these counts as retaliation under the Directive just as much as retaliation against the reporter themselves — see what counts as retaliation for the full list of what that covers.

Why this matters when you're setting up a channel

A channel that only lets someone in with a company email address or an internal login structurally can't take a report from a former employee, a job candidate, or a supplier's own staff — all of whom the Directive protects just as much as someone currently on payroll. Provoxis doesn't gate access that way: submitting and tracking a report runs on a case reference token, not a company account, so anyone in this list can use the same channel a current employee does. See anonymous vs identified reporting, explained for how that works.

Legal basis

• Art. 4(1), Directive (EU) 2019/1937 — the core list: workers, civil servants, the self-employed, shareholders and board members, volunteers, trainees, and staff of contractors, subcontractors, and suppliers.
• Art. 4(2) — protection extending to a work relationship that has already ended.
• Art. 4(3) — protection extending to information acquired during recruitment or pre-contractual negotiations, before a work relationship begins.
• Art. 4(4) — facilitators, third persons connected to the reporter, and legal entities the reporter owns or works for.