Internal whistleblower channel: obligation and protection

A report arrives one morning through the internal channel: an employee describes a suspected misappropriation. What must be done, within what deadlines, and how do you protect both the author and the accused person? Many leaders discover the obligation only when it materialises. Yet above a certain headcount, the internal whistleblower channel is mandatory, regulated and backed by strong protections for the whistleblower.

Quick answer. Any private or public legal entity with 50 or more employees must establish an internal procedure for receiving and handling reports (Waserman Act of 21 March 2022, applicable since 1 September 2022, with detailed rules set by Decree no. 2022-1284 of 3 October 2022). The entity must acknowledge the report within 7 working days, then inform the whistleblower of the measures envisaged or taken within a reasonable time not exceeding 3 months. The whistleblower enjoys civil and criminal immunity and protection against retaliation. They can also report directly to an external channel (competent authority, Defender of Rights) or, under conditions, make a public disclosure.

The obligation to have a whistleblower channel rests on two texts:

• Sapin 2 Act (Law no. 2016-1691 of 9 December 2016, Article 8): first obligation of an internal reporting procedure for entities with 50 or more employees.
• Waserman Act (Law no. 2022-401 of 21 March 2022): transposes Directive (EU) 2019/1937 of 23 October 2019 and strengthens whistleblower protection. Applicable since 1 September 2022.

The 50-employee threshold is assessed at the close of two consecutive fiscal years, per Social Security Code rules. Once reached, setting up the channel becomes mandatory. The topic extends that of the Sapin 2 Act and anti-corruption compliance.

A whistleblower is a natural person who reports or discloses, without direct financial consideration and in good faith, information concerning:

• a crime or offence;
• a threat or harm to the public interest;
• a violation of law (statute, regulation, international commitment).

The Waserman Act relaxed the requirement of "personal" knowledge of facts: in a workplace setting, a whistleblower can report information learned in the course of their duties. The requirement of financial disinterest is maintained.

Under the Waserman Act, the whistleblower has three channels, with no hierarchy: they can choose any one.

1. Internal reporting#

This is the channel the business must set up. The procedure must be:

• accessible: clearly communicated to all employees and agents;
• confidential: the identities of the whistleblower and the persons named are protected;
• effective: an acknowledgement is provided within 7 working days, and the whistleblower is informed of the measures envisaged or taken within a reasonable time not exceeding 3 months;
• impartial: examined without conflicts of interest, by a named person or service.

Decree no. 2022-1284 of 3 October 2022 allows the report to be received by a trusted third party (for example an external provider).

2. External reporting#

The whistleblower can report directly to an authority without using the internal channel:

• administrative or judicial authorities (public prosecutor, labour inspectorate);
• the Defender of Rights, who directs and supports the whistleblower;
• sectoral authorities (financial markets authority, data protection authority, etc.).

3. Public disclosure#

As a last resort, the whistleblower can disclose the information publicly where, notably, the report was not handled, a risk of retaliation exists, or there is a serious and imminent danger to the public interest. Disclosure must remain fair and proportionate.

Setting it up requires prior consultation of the works council, or of employees where there is none.

For entities with fewer than 250 employees, the procedure may be shared across several entities of the same group, cutting costs and duplication. Works council information dovetails with the economic and social database.

Civil and criminal immunity#

Article 122-9 of the Criminal Code removes the criminal liability of a whistleblower who reports or discloses information under the conditions set by law, provided they acted in good faith. This protection covers, within the same framework, civil actions such as defamation.

Ban on retaliation#

The law forbids any retaliatory measure linked to the report, including:

• dismissal or contract termination;
• demotion or adverse change of working conditions;
• pay cut, withdrawal of benefits;
• discrimination, harassment.

Any measure taken because of the report is deemed void, and the whistleblower can challenge it before the employment tribunal or the competent authorities.

Burden of proof shift#

When an adverse measure follows a report, it is for the employer to show that it rests on grounds unrelated to the report. This shift eases the whistleblower's burden.

Support from the Defender of Rights#

The Defender of Rights can receive the report, direct the whistleblower to the competent authority, act as a trusted intermediary and step in if retaliation occurs.

Group with fewer than 250 employees#

A group can pool its channel across several companies (parent and subsidiaries), provided the procedure remains accessible and confidentiality is preserved.

Non-profits and charities#

Charities and foundations with 50 or more employees are subject to the same obligations. Absent a works council, consultation is with the competent bodies.

Coordination with the works council, the DPO and GDPR#

The channel is separate from the works council and the data protection officer, but must dovetail with them: the works council is consulted before setup, the data protection officer oversees the processing of report data, and entry in the GDPR records register is required.

• Distinguish the three channels. Too many businesses offer an internal channel without stating that the whistleblower can go straight to an external authority. Clarify this freedom in your communications.
• Genuine confidentiality. A simple form shared with management does not meet confidentiality standards. Consider a trusted third party (secure platform, external adviser).
• Traceability and deadlines. Meeting the deadlines (acknowledgement within 7 working days, feedback within 3 months) requires tight organisation. A forgotten report exposes the business.
• Insufficient communication. Embed the channel in the staff handbook, induction documents and training, alongside the personnel register.
• Confusion with bad-faith claims. A good-faith whistleblower is protected; a bad-faith or patently false report can expose its author to liability. Preserve the accused person's rights too.

An industrial SME consulted us after receiving, through its internal channel, a report of suspected misappropriation. The report had been entrusted to an untrained manager who had not documented receipt, and its handling dragged on for months. When the company tried to dismiss the whistleblower on other grounds, the judge noted the lack of traceability and recharacterised the measure as retaliation. A clear procedure and a trusted third party would have avoided this.

Hayot Expertise advice. Before formalising your channel, have your exposure assessed by legal counsel (sector, data sensitivity, group size) and rely on employment-law support. Consider a trusted third party to manage reports, train your officers in impartial and confidential handling, embed the channel in the staff handbook, and document every report, every step and every deadline. This rigour is your best legal protection.

• Mandatory from 50 employees, assessed at the close of two consecutive fiscal years.
• Three channels: internal report (mandatory), external report (authorities, Defender of Rights), public disclosure (last resort).
• Key deadlines: acknowledgement within 7 working days, feedback on measures within 3 months at most.
• The whistleblower is protected against retaliation, immune if acting in good faith, and benefits from a burden-of-proof shift.
• Works council (or employee) consultation is mandatory before setup.
• For groups with fewer than 250 employees, a shared procedure is possible.
• Obstruction and retaliation incur criminal and civil penalties.

Official sources#

• Légifrance — Law no. 2022-401 of 21 March 2022 (Waserman Act)
• Légifrance — Decree no. 2022-1284 of 3 October 2022
• Légifrance — Law no. 2016-1691 of 9 December 2016 (Sapin 2)
• Service-Public — Whistleblowers: internal reporting procedure
• Defender of Rights — Directing and protecting whistleblowers
• Légifrance — Criminal Code, Article 122-9