Whistleblower Policy Checklist
Check a whistleblowing programme against the EU Whistleblower Directive, covering channels, the seven-day and three-month deadlines, confidentiality, the reversed burden of proof and retaliation protection.
Last reviewed by the Radiatus Cloud team
Going for ISO 27001, SOC 2, HIPAA or GDPR?
Radiatus runs end-to-end compliance & GRC programs.
The two deadlines are where programmes fail
Directive 2019/1937 requires acknowledgement of a report within seven days and feedback within three months. Both are hard deadlines with no discretion, and both are trivially provable after the fact from the timestamps on the report itself. An organisation with an excellent policy that acknowledged a report on day twelve has a documented failure that no amount of subsequent handling repairs, which is why the deadlines deserve more attention than the policy wording usually gets.
Protection extends far beyond employees
Article 4 covers contractors, suppliers, shareholders, volunteers, unpaid trainees, job applicants and people whose working relationship has ended. A channel available only through the staff intranet excludes most of that population, and the exclusion is invisible until someone outside it has something to report and uses the authority or the press instead. Facilitators and colleagues of the reporting person are protected too.
The burden of proof reverses, and managers rarely know
Where a person shows they made a protected report and subsequently suffered a detriment, Article 21(5) requires the employer to prove the detriment was for a duly justified reason unrelated to the report. In practice this means a manager who declines a promotion for a recent reporter must be able to evidence the decision on independent grounds, contemporaneously. Managers who have never been told this make ordinary decisions they cannot afterwards defend.
Related tools
- SOC 2 Evidence Readiness — Interactive checklist to gauge your SOC 2 evidence readiness.
- Privacy Policy Checker — Check if your policy covers standard requirements (GDPR/CCPA basics).
- Compliance Req Finder — Find which standards (ISO, SOC2, HIPAA) apply to your industry/region.
- Audit Readiness Planner — Plan your compliance audit timeline (SOC2, ISO) backwards from deadline.
Frequently Asked Questions
Which organisations must have internal channels?
Legal entities in the private sector with 50 or more workers, and public sector entities, subject to member state implementation. Some sectors are covered regardless of size.
What are the deadlines?
Seven days to acknowledge receipt and three months to provide feedback, the latter running from the acknowledgement or from seven days after receipt if none was sent. Both are provable from the report’s own timestamps.
Must anonymous reports be accepted?
Member states decide, but a person who reported anonymously and is later identified is protected regardless, so a channel that discards anonymous reports creates risk without saving work.
What does the reversed burden of proof mean?
Where a person shows they reported and then suffered a detriment, the employer must prove the detriment had a duly justified reason unrelated to the report. Contemporaneous evidence is what makes that provable.
Can an NDA stop a protected disclosure?
No. Article 24 makes waivers of protection unenforceable, so a confidentiality clause purporting to bar a protected disclosure is void. Such clauses surviving in template contracts is a common finding.
Privacy & Security
Everything runs in your browser; nothing is uploaded.
How to Use
Tick the elements you have in place to score the programme.
Disclaimer: This tool is provided "as is" without warranty of any kind. Results are for educational and utility purposes.
Related Tools
SOC 2 Evidence Readiness
ComplianceInteractive checklist to gauge your SOC 2 evidence readiness.
Privacy Policy Checker
ComplianceCheck if your policy covers standard requirements (GDPR/CCPA basics).
Compliance Req Finder
ComplianceFind which standards (ISO, SOC2, HIPAA) apply to your industry/region.