Whistleblower law in France #
France implemented Directive (EU) 2019/1937 through Loi n° 2022-401 du 21 mars 2022 (“Loi Waserman”), with the October 2022 decree setting the practical framework for internal and external reporting procedures. For most employers, the central threshold remains 50 employees.
Applicable law #
Who must establish an internal channel #
- Private employers with 50 or more employees must establish an internal reporting procedure (headcount assessed over two consecutive years).
- Public legal entities and state administrations with at least 50 agents — excluding municipalities under 10,000 inhabitants.
- Some entities with fewer than 250 workers may pool the collection and processing arrangement.
The obligation has applied since 1 September 2022 (implementing décret 2022-1284 of 3 October 2022). This 50-employee channel duty is separate from the Sapin II anti-corruption compliance-programme obligation (500 employees / €100M turnover, Art. 17), which the AFA enforces with much larger sanctions.
Penalties and enforcement #
France’s framework is unusual: there is no direct fine for simply failing to establish a channel. The current Sapin II / Loi Waserman text imposes no sanction on a company for not setting one up, and the implementing decree contains no penalty provisions. Instead, penalties attach to specific conduct:
| Conduct | Individuals | Legal entities |
|---|---|---|
| Obstructing the transmission of a report (“in any way whatsoever”) | 1 year imprisonment + €15,000 | €75,000 |
| Discrimination / retaliation based on whistleblower status (Code pénal arts. 225-1/225-2) | 3 years imprisonment + €45,000 | €225,000 |
| Abusive or dilatory (“SLAPP”) proceedings against a whistleblower | civil fine up to €60,000 (plus damages) | — |
An honest assessment of enforcement. Not having a channel is not directly fined — but it is far from risk-free. A missing or defective channel creates indirect exposure: it strengthens a retaliation or wrongful-dismissal claim before the Conseil de prud’hommes, and feeds AFA scrutiny for large firms under the anti-corruption regime. Enforcement of whistleblower protection is primarily reactive and judicial: retaliatory dismissals are null and void by operation of law, and the labour court’s summary judge can order reinstatement (Cass. soc., 1 Feb 2023, Thales, n°21-24.271, with the burden of proof shifting to the employer). The Défenseur des droits oversees protection. The practical lesson: the real cost of not having a proper channel shows up as litigation and reinstatement liability, not a fixed administrative fine.
External reporting authority #
France does not rely on one universal whistleblowing authority. The Défenseur des droits helps orient and protect whistleblowers, while competent sectoral authorities may receive external reports in their own remit.
Data protection authority #
For concerns about unlawful processing of personal data or confidentiality failures in the reporting process, the relevant authority is the CNIL .
Key compliance points #
- France no longer requires whistleblowers to report internally before using an external channel.
- The procedure must keep the identity of the reporting person, the person concerned, and named third parties confidential.
- French official guidance points to acknowledgment within 7 working days and feedback within 3 months as the standard operating timeline.
Official sources #
- Loi Waserman — official text
- Service Public — lancer une alerte
- Loi Sapin II (Loi 2016-1691) — official text
- Décret 2022-1284 (internal/external reporting procedures)
- Défenseur des droits — orienter et protéger les lanceurs d’alerte
- Agence Française Anticorruption — les contrôles de l’AFA
- CNIL — adresser une alerte
Deploy your reporting channel →
Last updated: