Whistleblowing policy template

1. Introduction

[Company name] is committed to conducting its business with honesty and integrity, and expects everyone who works for or with us to share this commitment. This policy sets out how [Company name] enables workers, and others who come into contact with the organisation through their work, to report a wrongdoing, and how [Company name] handles those reports. It is issued under the EU Whistleblowing Directive (2019/1937), as transposed into national law — [your country], and is intended to be read alongside — not instead of — that law.

2. Scope

This policy applies to anyone who has a work-based connection with [Company name]: employees, former employees, job applicants, agency workers, contractors, self-employed people, volunteers, trainees, shareholders, and members of [Company name]'s administrative, management, or supervisory bodies. It also extends to anyone reporting information acquired in a work-based relationship that has since ended, or that has not yet begun (for example, an issue identified during recruitment).

This policy is not the right route for a personal grievance about your own employment (such as a dispute over pay, an appraisal, or a disciplinary matter you're personally subject to) — those are handled under [Company name]'s separate grievance procedure. If you're unsure which applies, raise it with the person or department named in Section 10 and they will point you the right way.

3. Definitions

• Report — information about a breach, including reasonable suspicions, disclosed by a reporter.
• Reporter — a person who reports information on a breach acquired in a work-related context.
• Person concerned — a natural or legal person who is referred to in a report as someone who has committed, or is suspected of having committed, the reported breach.
• Follow-up — any action taken to assess the accuracy of a report and, where relevant, to address the breach reported, including through an internal inquiry, an investigation, prosecution, an action for the recovery of funds, or the closure of the procedure.
• Retaliation — any direct or indirect act or omission occurring in a work-related context, prompted by an internal or external report, which causes or may cause unjustified detriment to the reporter. See Section 13 for specific examples.

4. What you can report

A report can concern any breach of law, or any act or omission that is contrary to the objective pursued by the applicable rules, that has come to your attention in a work-related context — including, but not limited to: financial misconduct or fraud, corruption or bribery, money laundering or terrorist financing, data protection or privacy breaches, health and safety violations, environmental harm, discrimination or harassment, breaches of public procurement rules, threats to public health, consumer protection failures, and other criminal or seriously unethical conduct.

5. Reasonable grounds to believe

This policy protects reporters who have reasonable grounds to believe that the information reported was true at the time of reporting, even if it later turns out to be mistaken, or if the follow-up investigation does not substantiate the concern. Deliberately reporting information known to be false is a disciplinary matter in its own right, and falls outside the protection this policy provides — but a genuine report made on reasonable grounds that doesn't hold up is never treated as misconduct.

6. How to report

A report can be made in writing, orally by telephone or another voice-messaging system, or, at your request, in a meeting in person within a reasonable timeframe. Reports may be made anonymously; see Section 7.

Reports can be submitted through our reporting channel at [reporting channel address].

7. Anonymous reports

[Company name] accepts anonymous reports. To report anonymously, submit your report through the reporting channel without giving your name or contact details, and leave out details that would point to you unless you're comfortable including them. If the channel gives you a case reference when you submit, keep it safe: it's how you check for the acknowledgement and feedback described in Sections 9 and 12, answer follow-up questions, and add information later while staying anonymous, because [Company name] has no other way to reach you.

Anonymous reports are followed up with the same diligence as any other. Reporting anonymously can make it harder to ask clarifying questions, so where you're comfortable doing so, identifying yourself (even confidentially) tends to lead to a more thorough follow-up — but it is never a condition of having your report taken seriously. If you report anonymously and are later identified, you are protected against retaliation in the same way as any other reporter.

8. Confidentiality and data protection

Every report is handled in strict confidence. [Company name] will not disclose the identity of a reporter, or any information from which their identity could be directly or indirectly deduced, to anyone beyond those authorised to receive or follow up on reports, without the reporter's explicit consent — except where disclosure is a necessary and proportionate obligation imposed by law in the context of investigations or judicial proceedings, in which case the reporter will be informed before their identity is disclosed unless doing so would jeopardise the investigation.

Personal data collected through a report is processed only for the purposes of receiving and following it up, is limited to what is necessary for that purpose, and is handled in accordance with applicable data protection law. Personal data that is manifestly not relevant to handling a specific report is not collected, or is deleted without delay if collected accidentally.

9. Acknowledgement of your report

[Company name] will acknowledge receipt of a report within seven days of it being received.

10. Who handles your report

[Company name] designates an impartial person or department responsible for following up on reports, with the necessary competence, seniority, and resources to carry out that function. That person or department maintains diligent contact with the reporter and, where necessary, requests further information from them.

• Designated person or department: [Name or department, and how to contact them]

Where a report concerns the designated person or department itself, or where they otherwise have a conflict of interest, the report is instead escalated to [an alternative contact or escalation route, e.g. a board member or an external ethics line] to preserve impartiality.

11. Assessing and investigating your report

[Company name] carries out diligent follow-up on every report — including anonymous ones — assessing the accuracy of the allegations and, where appropriate, addressing the reported wrongdoing, including through an internal inquiry, an investigation, or referral to a competent authority for further investigation. The scope and depth of an investigation is proportionate to the seriousness and credibility of what's been reported.

12. Feedback

[Company name] will provide feedback on the actions taken or envisaged as follow-up, and the grounds for that follow-up, within a reasonable timeframe not exceeding three months from the acknowledgement of receipt (or, if no acknowledgement was sent, three months from the expiry of the seven-day acknowledgement period). Feedback explains what was done and why, not just that the matter is "closed."

13. Protecting you from retaliation

[Company name] does not tolerate any form of retaliation against a person who makes a report on the basis set out in Section 5. Retaliation includes, but is not limited to: dismissal, suspension, demotion, withheld promotion, negative performance evaluation, discrimination, harassment or ostracism, damage (including reputational) or financial loss, blacklisting, early termination or cancellation of a contract for goods or services, and cancellation of a licence or permit. Anyone who believes they have suffered retaliation for making a report should raise this immediately with the person or department designated in Section 10.

14. Support measures

Reporters and, where relevant, facilitators who have helped them, can request guidance on the reporting procedure, information about their rights, and — where appropriate under national law — access to legal advice or other support during proceedings connected to a report. [Company name] will not charge a reporter for accessing any support measure it puts in place.

You can also consult [name and contact details of a confidential adviser] in confidence for advice, before or after making a report.

15. Protecting the person being reported on

A person named in a report is entitled to the presumption of innocence, to be heard fairly before any conclusion is reached about them, and to the same confidentiality protection as the reporter — their identity is not disclosed beyond those who need to know it to properly follow up on the report. Nothing in this policy is a finding of wrongdoing against anyone named in a report until an investigation has actually concluded that.

16. Reporting externally

In most member states you are not obliged to report internally first. You are generally entitled to report directly to the relevant competent authority instead of, or as well as, using [Company name]'s internal channel, and — in certain circumstances defined by national law, such as where no appropriate action is taken on an internal or external report, or where there is an imminent or manifest danger to the public interest — to make a public disclosure, while still benefiting from protection against retaliation. Some national laws set conditions on reporting externally without first using the internal channel (Italy, for example); where they do, those conditions apply.

17. Record-keeping

[Company name] keeps a record of every report received, retained only for as long as necessary and proportionate to comply with the requirements imposed by this policy and by applicable law. Records are stored securely and access is limited to those authorised to handle reports.

Where a report is made by telephone, by voice message or in a meeting, [Company name] documents it, with the reporter's consent, by a recording or by a complete and accurate transcript or minutes. The reporter is given the opportunity to check, correct and agree the transcript or minutes by signing them.

18. Roles and responsibilities

• Senior management is accountable for this policy, for making sure the designated person or department in Section 10 has the resources and authority to do their job, and for the overall culture in which people feel safe to speak up.
• The designated person or department receives, acknowledges, and follows up on reports as set out in Sections 9–12, and keeps the records described in Section 17.
• All workers are expected to report only information they have reasonable grounds to believe is true, to cooperate with a follow-up investigation when asked, and to never retaliate against someone who has made a report.

19. Related policies

This policy operates alongside [Company name]'s other policies — including its grievance procedure (Section 2), disciplinary procedure, anti-bribery and corruption policy, and data protection policy — rather than replacing any of them. Where this policy and another appear to conflict on a specific point, raise it with the person or department in Section 10.

20. Training and awareness

[Company name] makes this policy available to everyone it covers, and communicates it again during onboarding rather than relying on a single announcement — a policy nobody remembers exists doesn't function in practice, however complete it is on paper.

21. Review and document control

This policy is reviewed periodically to ensure it remains accurate and effective, and to reflect any change in the designated person or department referred to in Section 10.

• Policy owner: [Insert role, e.g. Head of HR / Compliance]
• Version: 1.0
• Effective date: October 19, 2026
• Next review due: October 19, 2027

Legal basis

• Art. 6, 8(3) & 9(1), Directive (EU) 2019/1937 — conditions for protection, the obligation to establish an internal channel, and the seven procedural elements a channel must cover (Sections 6–12 above).
• Art. 9(2) — written, oral and in-person reporting (Section 6 above).
• Art. 16 — the duty of confidentiality.
• Art. 18 — record-keeping obligations for reports received, including how oral reports are documented (Section 17 above).
• Art. 19 & 21 — the prohibition of retaliation and the measures protecting reporters against it (Section 13 above).
• Art. 20 — support measures available to reporters (Section 14 above).

This document is a starting policy generated by Provoxis, grounded in the articles above. It is not a substitute for legal advice specific to your circumstances — have it reviewed by a qualified adviser before publishing it to your workforce.