The EU Whistleblowing Directive for Indian companies with EU staff

Does it apply to you?

The duty falls on the legal entity in the EU country, not on the Indian parent. A private-sector legal entity with 50 or more workers must set up internal reporting channels (Article 8(3)). Entities with 50 to 249 workers may share resources for receiving reports and investigating (Article 8(6)). Each country has written the Directive into its own law, and some go further, so check the law of each country where you have staff.

What the channel must do (Article 9)

• Acknowledge a report within seven days of receiving it.
• Name an impartial person or department to follow it up diligently.
• Give feedback within a reasonable time, no more than three months from the acknowledgement.
• Take reports in writing or orally, or both. Oral reports by telephone or another voice system, and on request a meeting in person within a reasonable time.
• Give clear information on how to report to the authorities outside the company.

Anonymous reports (Article 6(2))

The Directive leaves it to each country whether anonymous reports must be accepted and followed up. Several countries require it. A person who reported anonymously and is later identified is still protected.

Confidentiality and data (Articles 16 and 17)

The reporter's identity is not shared beyond the people authorised to receive or follow up reports without their explicit consent, except where national law requires it. Personal data is handled under the GDPR, and data that is clearly not relevant is not collected, or is deleted.

Records (Article 18)

Every report is recorded, kept no longer than needed. An oral report can be recorded only with the person's consent, or written up as minutes that the person can check and sign.

Protection from retaliation (Article 19)

Retaliation of any kind is prohibited, including dismissal, demotion, a change of duties or location, a cut in pay or hours, a negative performance review, intimidation and blacklisting. Penalties are set by national law (Article 23).

For an Indian group

1. List your EU entities and their headcounts; each with 50 or more workers needs its own channel.
2. Check each country's law on anonymous reports, deadlines and group-level channels.
3. Offer the channel in the local language, in writing and by voice.
4. Keep each entity's reports with that entity's case team, with the 7-day and 3-month clocks on every case.

This guide explains the law in plain words. It isn't legal advice: check your own facts with your lawyer.