Whistleblower compliance for public sector #
Public sector entities have a stricter obligation than private companies. Under EU Directive 2019/1937, all public sector organizations must establish internal reporting channels — there is no 50-employee minimum. Most national transpositions preserve this broader scope.
How the Directive applies differently #
| Requirement | Private sector | Public sector |
|---|---|---|
| Employee threshold | 50+ employees | No threshold (all entities) |
| Deadline | December 2023 for 50–249 employees | December 2021 (most member states) |
| Shared channels | Allowed for municipalities <10,000 inhabitants | Allowed for municipalities <10,000 inhabitants |
| Anonymous reporting | Varies by country | Mandatory in some member states |
Article 8(9) of the Directive allows municipalities with fewer than 10,000 inhabitants or fewer than 50 workers to share reporting channels. This is the only concession — all other public entities must operate their own.
National variations #
- Germany (HinSchG) — all public employers must establish internal channels. Fines of €20,000–€50,000 for non-compliance (up to €500,000 for legal entities).
- France (Loi Waserman) — all public bodies covered. Whistleblowers can report directly to external authorities without using internal channels first.
- Poland — all public entities covered. Internal procedures required by January 1, 2025.
- Spain (Ley 2/2023) — all public entities covered regardless of size. Fines up to €1,000,000.
What gets reported #
- Misuse of public funds or procurement fraud
- Conflicts of interest in contracting
- Environmental violations by public works
- Workplace safety failures in public facilities
- Data protection breaches involving citizen data
- Abuse of authority
Why municipalities are at risk #
Most large government agencies have compliance infrastructure. Municipalities and smaller public bodies often do not. They assume the Directive doesn’t apply to them because they have fewer than 50 employees. It does. A reporting channel for a municipality can be operational in minutes — there is no procurement process or IT integration required.