The EU Whistleblowing Directive (Directive 2019/1937) required all EU member states to transpose a minimum standard of whistleblower protection into national law by December 2021.

For UK-based multinationals with operations, subsidiaries or employees in the EU, the Directive creates legal obligations that run in parallel to – and in some respects beyond – the UK framework under PIDA. Understanding where the two frameworks align, and where they diverge, is essential for compliance, HR and legal teams responsible for multinational training programmes.

What the EU Whistleblowing Directive requires

The Directive establishes a floor of protections for individuals who report breaches of EU law across a defined range of subject areas, including financial services, anti-money laundering, product safety, environmental protection, data protection, and public procurement. Member states were required to transpose the Directive by 17 December 2021, though implementation varied in pace and scope.

The key obligations for organisations are:

• Internal reporting channels: organisations with 50 or more workers in an EU member state must establish, operate and maintain secure internal reporting channels. These must allow for written and oral reporting, protect the identity of the reporter, and be managed by an impartial person or department.
• Acknowledgement and follow-up: organisations must acknowledge receipt of a report within seven days and provide feedback to the reporter on the action taken within three months.
• Prohibition on retaliation: a broad range of retaliatory acts are prohibited, including dismissal, demotion, negative performance assessments, withholding of training, and any other form of detriment. Crucially, the burden of proof is reversed – if a worker suffers detriment following a disclosure, it is presumed to be retaliatory unless the employer proves otherwise.
• Confidentiality: the identity of reporters must be protected, and processing of personal data connected with reports must comply with GDPR.
• Manager and staff training: while the Directive does not prescribe training in precise terms, its requirements around correct handling of reports, prohibition of retaliation, and proper escalation procedures cannot be met without trained managers. Several member states have made training explicit in their national implementing legislation.

The post-Brexit position for UK-based multinationals

The EU Whistleblowing Directive does not apply directly in the UK following Brexit. UK whistleblowing law continues to be governed primarily by PIDA as amended by ERA 2025, with the WPA 2023 covering the harassment prevention dimension. However, for UK-headquartered organisations with EU operations, the Directive’s requirements apply to their EU entities in full.

This creates a compliance landscape where:

• UK operations are governed by PIDA and ERA 2025
• EU operations are governed by the Directive as transposed in each member state – with significant variation in how member states have implemented it
• Group-level policies, training programmes and reporting channels must be designed to meet both frameworks, or to meet the higher standard where they diverge

For group HR and compliance functions, the practical consequence is that a single training programme aligned only to PIDA will not meet the requirements of, for example, the German Hinweisgeberschutzgesetz, the French Sapin II regime, or the Irish Protected Disclosures (Amendment) Act 2022. Each has its own procedural requirements, timelines and remedies.

Where the EU Directive sets a higher standard than PIDA

Reversed burden of proof

Under PIDA, once a worker establishes that they made a protected disclosure and suffered a detriment, the employer must show the detriment was not on grounds of the disclosure. The EU Directive goes further in many member state implementations, presuming retaliation where detriment follows a report and requiring the employer to disprove the connection. Managers in EU jurisdictions therefore operate under a stricter liability framework, making training on what constitutes detriment – and how to avoid it – even more critical.

Mandatory acknowledgement and feedback timelines

The Directive requires acknowledgement of a report within seven days and feedback within three months. PIDA imposes no equivalent procedural timelines. UK-based managers handling reports that may involve EU operations need to understand which procedural framework applies and ensure they meet the more demanding EU requirements where relevant.

Broader scope of protected subject matter

PIDA protects disclosures across six categories of wrongdoing. The EU Directive covers a defined range of EU law subject areas – which, depending on the member state’s implementing legislation, may be broader in some respects. Data protection breaches, financial services misconduct and environmental violations, for example, may attract different levels of protection depending on whether the disclosure is made in a UK or EU context.

Training implications for multinational organisations

For UK-based multinationals, the training challenge is one of consistency and calibration. A group-wide manager training programme that addresses only the UK position leaves EU-based managers insufficiently prepared. A programme calibrated to the most demanding EU member state standard will typically exceed UK requirements and provides a defensible baseline for the group as a whole.

Key areas where training must address both frameworks:

• What constitutes a qualifying disclosure in each jurisdiction – and how the subject matter scope compares between PIDA and the Directive
• The reversed burden of proof in EU jurisdictions and what it means for how managers document their actions following a disclosure
• The procedural requirements for acknowledgement, follow-up and feedback – and how to meet the EU timelines without compromising UK confidentiality obligations
• How to handle reports that involve conduct across multiple jurisdictions
• The specific retaliatory acts prohibited under the Directive, including the explicit prohibition on withholding training

Reporting channel design and the role of managers

The EU Directive’s requirement for internal reporting channels with 50 or more workers applies at the legal entity level in each member state, not at group level. A UK parent company with subsidiaries across multiple EU member states cannot rely on a single group-level channel to discharge each subsidiary’s obligation – though group channels can supplement local ones where properly configured.

Managers play a critical role in channel effectiveness regardless of jurisdiction. Freshfields’ 2023 whistleblowing survey found that line manager reporting had declined from 46% to 40% of cases, reflecting a degree of worker preference for independent channels over direct management chains. Where managers are seen as trained, responsive and non-retaliatory, internal reporting rates improve. Where they are not, workers bypass internal channels for external ones – losing the organisation the opportunity to address concerns before they escalate.

ACFE’s 2024 research reinforces this: organisations with anonymous hotlines and trained responders see fraud losses 50% lower than those without. The economic case for training managers to receive and handle disclosures correctly applies as strongly in EU jurisdictions as in the UK.

Practical steps for compliance and HR teams

Organisations navigating the dual UK/EU framework should consider:

• Auditing current training content against both PIDA/ERA 2025 requirements and the Directive as transposed in each relevant member state
• Identifying jurisdictions where national implementing legislation sets a higher standard than the Directive minimum – Germany, France and Ireland in particular have detailed procedural requirements
• Designing manager training that addresses the procedural and liability differences between UK and EU frameworks, particularly where managers operate across both
• Ensuring group-level whistleblowing policies and channel configurations meet local requirements in each EU entity
• Maintaining training records in a form that satisfies both UK tribunal evidential standards and EU regulatory audit requirements

Weiterführende Ressourcen

Gesetzliche Verpflichtungen zur Schulung von Führungskräften im Vereinigten Königreich (Hub): https://www.safecall.co.uk/resource/legal-obligations-for-manager-training-in-the-uk/

Whistleblowing-Schulung für Führungskräfte: https://www.safecall.co.uk/service/whistleblowing-training-for-managers-online-and-on-site/

Umgang mit Whistleblowing-Meldungen – Ein Leitfaden für Führungskräfte: https://www.safecall.co.uk/resource/what-does-the-public-interest-disclosure-act-require-of-managers/

Safecall-Ressourcenzentrum zum Thema Whistleblowing: https://www.safecall.co.uk/resources/

Safecalls Whistleblowing-Schulung für Führungskräfte

Safecall has delivered whistleblowing and workplace training since 1999, working with organisations across sectors and jurisdictions. Its Listen Up – Whistleblowing for Managers course is CPD Certified and can be tailored for organisations operating across multiple regulatory frameworks, including those with EU obligations under the Whistleblowing Directive. Available online (half day) or in person (full day), it draws on anonymised case material from 25+ years of live whistleblowing reports.

Erfahren Sie mehr über die Schulungen von Safecall unter safecall.co.uk/service/compliance-training/ oder wenden Sie sich an das Team unter [email protected] | +44 (0) 191 516 7720

Quellen und weiterführende Literatur

EU Whistleblowing Directive (Directive 2019/1937) – EUR-Lex: eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32019L1937

European Commission – Implementation status of the Whistleblowing Directive: ec.europa.eu/info/policies/justice-and-fundamental-rights/whistleblower-protection_en

Gesetz über die Offenlegung von Informationen im öffentlichen Interesse von 1998 (in der geänderten Fassung): legislation.gov.uk/ukpga/1998/23

Gesetz über Arbeitnehmerrechte von 2025: legislation.gov.uk/ukpga/2025

Protect – Wirkungsbericht 2025: protect-advice.org.uk/protect-2025-impact-report/

ACFE-Bericht an die Nationen 2024: acfe.com/report-to-the-nations/2024

Freshfields-Umfrage zum Thema Whistleblowing 2023: freshfields.com/en-gb/our-thinking/campaigns/whistleblowing-survey-2023/