May 19, 2022

New whistleblowing rules are coming to Europe; here’s what businesses need to know

The EU directive presents a serious shakeup for how companies handle employee concerns

Tim Smith

6 min read

Elizabeth Gardiner, chief executive at Protect, a UK whistleblowing charity

Startups have a reputation for being a bit of a Wild West when it comes to workplace culture. Rapidly growing companies, led by sometimes inexperienced founders, don't always find time to get the boring stuff like robust HR processes in place.

Now, new EU rules are coming in that will change the way that companies with more than 50 employees handle anonymous worker complaints. So why does whistleblowing matter, what do the new rules say and what startups are working on solutions to help other businesses comply? 

The value of whistleblowing

One former employee at a Berlin-based scaleup, which employs around 180 staff, tells Sifted about how one workplace bully had gone unchecked at the company because of a lack of secure channels to make complaints.


“If there had been a system in place that would have allowed everyone that had ever had an instance of harassment with him — or observed it from outside — to document it, then it wouldn’t have just been snippets and parts of stories everywhere.”

The former employee describes how the individual’s intimidatory, misogynistic and racist behaviour was only raised with senior management by chance, during a drunken conversation at an office party. 

By that point he’d already done considerable damage to the company and people within it, causing at least three employees to leave the organisation altogether, she says. “He had broken so many teams, so many people, so many cultures, so many egos. He had broken the confidence of designers that he’d completely insulted. Those scars run really deep.”

How to comply with new whistleblowing rules

EU member states were supposed to have passed the whistleblowing directive into their statute books by December 17, 2021 — some have faced delays passing legislation. It dramatically changes the way that European companies have to handle whistleblowing.

From December 17 2023, companies with 50 or more workers will be legally obliged to establish secure internal reporting channels, allowing employees to confidentially disclose information that might be in breach of EU law. 

Regulation across the continent will be patchwork, with different member states applying different protections above the minimum requirements in the directive (more on that below). And now a whole crop of startups is appearing to help other companies follow the rules.

WhistleB from Stockholm, people intouch from Amsterdam, Whistleblower Software from Copenhagen and Business Keeper from Berlin are all selling whistleblowing tools designed to be compliant with the directive.

Other more specialised services are also appearing, such as Madrid-based Metta Space, an AI-powered system to help identify and report sexual harassment in the workplace.

Usually it takes about three months for someone to want to report a case of sexual harassment

Founder and chief technology officer Eleanor Manley tells Sifted that Metta Space’s technology plugs directly into a company’s Slack channel, and learns to identify problematic communications in real time.

“If I was to send you a message, like, ‘Oh, Tim, you look so good today.’ That's not necessarily explicit, black and white harassment, but what we’d call grey sexual harassment, which occurs a lot in the workplace,” she explains. “You would receive a pop up asking you if you're comfortable with that message. And if you said, ‘No, I'm not comfortable,’ then the algorithm would learn that that's a case of sexual harassment and would give you the opportunity to timestamp it and use it as proof, if you want to submit a case now or later.”


Manley believes that tools like this can help employees to be more proactively aware of harassment they’re experiencing, and stop it from escalating over a longer period of time.

“Usually it takes about three months for someone to want to report a case of sexual harassment,” she says. “So what we're trying to do here is actually be preventative and kind of create this psychological switch before it gets so bad that you want to report a massive case.”

The new rules

Metta Space was born after the two cofounders experienced sexual harassment in a professional context, but the EU regulation doesn't actually cover this kind of workplace wrongdoing.

As a starting point, the directive protects whistleblowers raising concerns about the following areas of EU law:

  • public procurement
  • financial services, products and markets, and prevention of money laundering and terrorist financing
  • product safety and compliance
  • transport safety
  • protection of the environment
  • radiation protection and nuclear safety
  • food and feed safety, animal health and welfare
  • public health
  • consumer protection
  • protection of privacy and personal data, and security of network and information systems.

These are the minimum standards for EU member states, with issues like harassment, discrimination and bullying not covered by European law. EU countries are now in the process of transposing this legislation into national laws, and whistleblowing experts are hoping that governments will go further in the scope of the protection.

“Each individual member state should be looking to enhance [the directive] and do the absolute best protection it can. And that's when you'd say, ‘Let's look at what the national laws are to prevent bullying, harassment, or discrimination, and should we be including those in our whistleblowing provisions?’” says Liz Gardiner, chief executive at Protect, a UK whistleblowing charity.

Member states are now starting to pass the directive into law. We've summarised what each country's rules look like, so startups know what they need to prepare before the deadline arrives — and those in other countries know what the standard will be across the continent.


The French Assembly has adopted the whistleblower legislation and gone beyond the minimum EU protections, with a bill that will protect whistleblowing that's in “the public interest”. The law also legally protects whistleblower facilitators, such as NGOs, which might be involved in helping an individual report wrongdoing. Get more detail here.


Sweden also goes beyond just protecting reporting of breaches of EU law. Whistleblowers will be protected if the reported breach is “serious”, which is likely to cover issues like bribery, major security risks and “serious” discrimination and harassment. Read more detail here.


Cyprus’s whistleblowing law doesn’t make specific mention of issues like sexual harassment, but does say that reports of issues endangering the health and safety of any person will be covered. Read more detail here.


Lawmakers in Latvia say that their whistleblowing law is the only one in Europe to protect whistleblowers who report “climate crimes”. Whistleblowers will also be covered by a public interest defence, which should mean that reports of bullying and harassment are also protected. Read more here.


Portugal’s whistleblowing legislation also goes beyond EU law, and protects reporting of “violent, highly organised, and economic and financial crimes”. It’s unclear whether issues like workplace bullying and sexual harassment will be covered under “violent crimes”, but companies are likely to err on the side of caution when establishing reporting channels. Read more here.


Lithuania is so far the only country to offer monetary rewards to whistleblowers in its new law, but the system has got off to a rocky start after a number of people who should've received money didn't. The law goes beyond the EU directive by protecting reports of all breaches of the law, and includes reports in the “public interest”. Read more here.


Denmark was the first EU member state to adopt the legislation and, like many others, has gone beyond the bare minimum protections of European law. Whistleblowers will also be given some protection when reporting breaches of Danish law and serious infringements like bribery, corruption and sexual harassment, but critics say that the law doesn’t go far enough. Get more detail here.


Malta’s adoption of whistleblowing legislation has been criticised by many observers, who say it places too much burden of proof on the whistleblower. It’s a particularly sensitive issue in a country that’s been gripped by corruption scandals, and many fear that the new legislation won’t have a big impact. Read more here.

To keep up to date with countries adopting the directive into national legislation, follow the EU Whistleblowing Monitor site.

Tim Smith

Tim Smith is news editor at Sifted. He covers deeptech and AI, and produces Startup Europe — The Sifted Podcast . Follow him on X and LinkedIn