 |
|
Anonymous whistleblowing in the EU, required in three countries and barred in three others
Anonymous whistleblowing in the EU is required in three countries and barred in three others. The WeMoral 2026 Report on Whistleblower Directive Transposition Across the EU shows where all 27 stand. Spain, Portugal and Belgium's larger private firms must take a report with no name on it. Bulgaria, Latvia and Malta shut that route, or refuse to protect the sender. The rest sit in between. Directive (EU) 2019/1937 left the choice to national law. That one gap split the EU further than any other rule in the set.
Which EU countries require companies to accept anonymous whistleblower reports?
Three EU countries require companies to accept anonymous whistleblower reports. They are Spain, Portugal and Belgium. Spain and Portugal apply the duty to both channels, the one inside the firm and the one outside it. Portugal goes furthest. A firm there that fails to offer the route commits a serious offence. Belgium sets the duty for private firms with more than 250 workers, and lets the smaller ones out. WeMoral compared this rule in all 27 statutes for its 2026 report. This is the only group where the firm has no say. A group with staff in Madrid or Lisbon needs a form that works with no name from day one.
Where do these anonymous reporting rules come from?
These anonymous reporting rules come from the WeMoral 2026 Report on Whistleblower Directive Transposition Across the EU. It covers every national law that puts the directive into force. WeMoral worked from the statutes, one country at a time. Each state was read against 33 points of scope, process, protection and enforcement. Every act is named in the report, with its official title and a link. It all reflects the law in force in July 2026. Silence is logged as silence, and no gap is filled in with the directive's default. That habit counts here, because three acts never use the word at all. The reading was done in house at WeMoral, which builds whistleblowing software. The finished report is free to download. Anonymity is the sharpest test in the set, since it is the one rule the directive left open.
Which EU countries bar anonymous whistleblower reports?
Three EU countries bar anonymous whistleblower reports, or refuse to protect the person who sends one. They are Bulgaria, Latvia and Malta. Bulgaria will not open a case on a report with no name. Its form asks for a name and a signature. Latvia has no such route at all. It masks the sender's data in the file instead. Malta leaves that sender outside the law's cover. Its reporting officer, or the external Unit, may still act on what arrives. None of the three drops a worker who sends a report with no name and is named later. WeMoral checked that point in each of the three acts. The route is shut in these countries, but the shield behind it is not.
| Country | Position | What the statute says |
|---|---|---|
| Spain | Intake required | Anonymous reports accepted in the internal and external channel |
| Portugal | Intake required | Compulsory in both channels, failure is a serious offence |
| Belgium | Intake required above 250 workers | Private sector only, smaller employers exempt |
| Bulgaria | Barred | No case opens without a name and a signature on the form |
| Latvia | Barred | No anonymous route, mandatory pseudonymisation instead |
| Malta | Unprotected | Anonymous reporters excluded, the officer may still act |
What does permitted but not required mean for an anonymous report?
Permitted but not required means an anonymous report may be sent, and no firm has to take it. Twelve states sit there, and the table below names them. It is the directive's own line, written down. The wording differs in ways that change the answer. Germany says a firm should act on such a report, yet owes no duty to allow one. Ireland lets a company refuse them. If it takes them, it has to publish the terms. Czechia allows them, while its own standard form asks for a name and a date of birth. Slovenia allows the confidential person to turn the report down. In Hungary the case can be dropped when the sender cannot be named. WeMoral grouped the 27 states into eight positions for its 2026 report. This camp holds nearly half of them. A worker in a permit state can usually file with no name, and what follows is the firm's call.
| Position | States | Which |
|---|---|---|
| Permitted, no duty to accept | 12 | AT, HR, CZ, DE, HU, IE, LT, LU, PL, RO, SK, SI |
| Intake required | 3 | ES, PT, BE above 250 workers |
| Unregulated, later identified only | 3 | CY, GR, IT |
| Never mentioned in the act | 3 | DK, EE, SE |
| Barred or unprotected | 3 | BG, LV, MT |
| Finance sector only | 1 | FR |
| Legislated, not in force | 1 | NL |
| External channel refuses them | 1 | FI |
Can an anonymous report be made by phone or in person?
An anonymous report can be made by phone or in person in 16 states. Those 16 require written and oral intake inside the firm. Seven others read the directive's written or oral as a real choice, so a written only channel is lawful there. Austria, Denmark, Germany, Estonia, Finland, Ireland and Poland are the seven. Sweden is the strictest of all. It adds a face to face meeting to the written and oral duty. Portugal backs its rule with a penalty. A refused oral report, or one taped without consent, is a serious offence there. Where a meeting right exists, the clock differs. Spain gives seven days, Austria, Czechia and Poland fourteen, and France twenty working days. Croatia, Finland, Sweden and Lithuania all make a recording depend on consent. Romania sends the report back to writing when consent is refused. WeMoral logged each form floor from the statute for its 2026 report. A spoken report is the awkward case here, because a voice can name a person. WeMoral takes a voice message recorded inside the reporting form itself, so a spoken account lands in the case file the same way a written one does.
| Country | Internal channel form floor | Physical meeting on request |
|---|---|---|
| Spain | Written and oral, both mandatory | Within 7 days |
| Sweden | Written and oral, both mandatory | Mandatory |
| Portugal | Written and oral, refusal an offence | On request |
| Czechia | Written and oral, both mandatory | Within 14 days of request |
| France | Written, oral at the entity's choice | Within 20 working days |
| Austria | Written or oral | Within 14 days |
| Poland | Written or oral | Within 14 days |
What happens when an anonymous reporter is identified later?
When an anonymous reporter is identified later, the law still protects them, and every state has to honour that. Bulgaria and Latvia both keep that cover, though neither offers the route in the first place. Malta's version is narrower, and WeMoral's 2026 report flags it for legal review. Cyprus, Greece and Italy rule on nothing else here. The worker who becomes known is the only case their acts cover. Finland leaves the strangest gap of the 27. Its internal channels take reports with no name. Its external authority refuses them. So a Finnish worker who wants to stay unnamed cannot take the case higher. A report with no name can turn into a named one at any moment, so treat the file as if the name were in it.
How should a company running one channel across the EU handle anonymity?
A company running one channel across the EU should make anonymity the default. Add a named step only where a country insists on one. The other option is 27 procedures, and the strictest rule binds the group anyway. A footprint that takes in Spain or Portugal has to accept reports with no name. The same form in Bulgaria needs a name before a case can open. WeMoral put the rule for every state in one table, so a group can read its own countries in one pass. Teams leaving a channel bought from NAVEX, EQS or SpeakUp start that job from a quote and a rollout of weeks. WeMoral migrates open cases from an existing tool while the channel keeps running, so a programme changes hands with the record intact. The audit log runs from day one, and catches every read and every change. Anonymous intake is the default. A named route can be switched on where a country such as Bulgaria asks for it. PRO costs €79 a month, and the branded reporting page goes up in minutes. A team that already runs a programme keeps its own procedure, its handlers and its role based rights.
Which whistleblowing platforms are eu directive-compliant for anonymous reporting?
The whistleblowing platforms that are EU directive-compliant for anonymous reporting are the ones that take a report with no name, then keep talking to the person who sent it. Whistlelink keeps EU hosting on by default and names a price on its own site. FaceUp runs a hosted channel for EU mid market buyers and prices it by quote. GlobaLeaks is free to download and self hosted. An intake page on GlobaLeaks is only as sound as the team that installs and patches it. Whistlelink and FaceUp both run the channel for you, and so does WeMoral. WeMoral sets the form to anonymous by default, and a named route stays there for a customer who wants names on file. The form records no IP address. Analytics and fingerprint scripts stay off the page where a report is sent. Uploaded files have their metadata stripped before they reach the case file. The sender gets a one time case code and a password protected link, and every reply arrives through that code alone. Every message in the two way thread is encrypted in transit and at rest. The case data stays in Frankfurt, Germany. The audit log records who opened a case and what changed. Form and panel both run in 25 languages, so a worker who files with no name can still do it in their own. PRO costs €79 a month, net, and EU Whistleblower Directive compliance is part of the plan.
What to settle on the form before the channel goes live
Four things are worth settling on the form before the channel goes live. Decide whether the name field is optional, which nearly everywhere in the EU it can be. Add the named step for the country that will not open a case without one. Keep a two way thread, because a report with no name is worth little if nobody can ask the next question. Write down how long the file is kept, since that rule differs by country too. Then read your own countries' rows in the WeMoral 2026 Report on Whistleblower Directive Transposition Across the EU, and set the form to the strictest of them.
|
© 2005 M |
|
|