Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law
Directive (EU) 2019/1937 of 23 October 2019 on the protection of persons who report breaches of Union law. Requires legal entities with 50 or more workers and public sector bodies to establish secure, confidential internal reporting channels with prescribed procedures (7-day acknowledgement, impartial follow-up, 3-month feedback); requires Member States to designate competent authorities operating external reporting channels; sets the conditions for protected public disclosure; mandates confidentiality of the reporting person's identity, GDPR-compliant data processing and record-keeping; prohibits retaliation and provides protective measures including reversal of the burden of proof, support measures and remedies; and requires effective, proportionate and dissuasive penalties.
Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law is a compliance framework from European Union with 7 domains and 21 controls that map to 3 other frameworks. The largest domains are Whistleblowing: External Reporting Channels (5 controls), Whistleblowing: Protection Measures (4 controls), Whistleblowing: Confidentiality, Data Protection and Record-Keeping (3 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (7)
Whistleblowing: Confidentiality, Data Protection and Record-Keeping
| Code | Title |
|---|---|
| WB-Art.16 | Duty of confidentiality |
| WB-Art.17 | Processing of personal data |
| WB-Art.18 | Record keeping of the reports |
Whistleblowing: External Reporting Channels
| Code | Title |
|---|---|
| WB-Art.10 | Reporting through external reporting channels |
| WB-Art.11 | Obligation to establish external reporting channels and to follow up on reports |
| WB-Art.12 | Design of external reporting channels |
| WB-Art.13 | Information regarding the receipt of reports and their follow-up |
| WB-Art.14 | Review of the procedures by competent authorities |
Whistleblowing: Internal Reporting Channels
| Code | Title |
|---|---|
| WB-Art.7 | Reporting through internal reporting channels |
| WB-Art.8 | Obligation to establish internal reporting channels |
| WB-Art.9 | Procedures for internal reporting and follow-up |
Whistleblowing: Penalties and Remedies
Whistleblowing: Protection Measures
| Code | Title |
|---|---|
| WB-Art.19 | Prohibition of retaliation |
| WB-Art.20 | Measures of support |
| WB-Art.21 | Measures for protection against retaliation |
| WB-Art.22 | Measures for the protection of persons concerned |
Whistleblowing: Public Disclosures
| Code | Title |
|---|---|
| WB-Art.15 | Public disclosures |
Whistleblowing: Scope and Conditions for Protection
Your Compliance Coverage
If you comply with Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law, you already cover:
Maps to 3 other frameworks
Coverage is not the same as your position
This page shows what Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.
The Compliance Position Diagnostic, $5,000 fixed, ten business daysWhat is Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law and who does it apply to?
Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law is a compliance framework from European Union with 7 domains and 21 controls. Directive (EU) 2019/1937 of 23 October 2019 on the protection of persons who report breaches of Union law. Requires legal entities with 50 or more workers and public sector bodies to establish secure, confidential internal reporting channels with prescribed procedures (7-day acknowledgement, impartial follow-up, 3-month feedback); requires Member States to designate competent authorities operating external reporting channels; sets the conditions for protected public disclosure; mandates confidentiality of the reporting person's identity, GDPR-compliant data processing and record-keeping; prohibits retaliation and provides protective measures including reversal of the burden of proof, support measures and remedies; and requires effective, proportionate and dissuasive penalties. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law actually require?
Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law has 21 controls organised across 7 domains. The largest domains are Whistleblowing: External Reporting Channels (5 controls), Whistleblowing: Protection Measures (4 controls), Whistleblowing: Confidentiality, Data Protection and Record-Keeping (3 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law do I already cover?
Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law maps to 3 other compliance frameworks. The top mapping partners are ISO 37002:2021 - Whistleblowing Management Systems (14% coverage), ISO 37301:2021 (5% coverage), GDPR (5% coverage). Use our comparison tool to explore control-level mappings between frameworks.
How do I implement Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law?
Start your Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 21 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 704 frameworks.
Get Started Free →Free forever — no credit card required