Do We Need a Whistleblowing Policy at 50 Employees?

Under the EU Whistleblowing Directive 2019/1937, Article 8 sets the trigger for mandatory internal reporting channels: organisations with 50 or more workers must establish and maintain a dedicated channel for receiving and processing whistleblower reports.

The directive specifies "workers" deliberately. This includes employees, contractors, temporary staff, and other individuals with a contractual relationship to your organisation. The distinction matters because some organisations miscalculate their headcount by counting only permanent, full-time employees—and miss their legal obligation.

If you have 50 or more workers across all categories, you have crossed the threshold. At that point, you cannot rely solely on ad-hoc reporting to line managers or unstructured email inboxes.

Article 8 of the directive mandates that your internal channel must:

• Enable workers to report breaches of law confidentially
• Protect the identity of the reporter
• Be easily accessible
• Be clearly communicated to your workforce

Critically, the directive does not require a published whistleblowing policy. It requires a functioning channel. That channel could be a dedicated email address with access restricted to a designated officer, a web portal, a telephone line, or an external platform—provided it meets the confidentiality and accessibility criteria.

What many organisations misunderstand is that the policy document itself is not the legal requirement. The channel is.

Once someone uses your channel, Article 9 sets specific timelines:

• You must acknowledge receipt of the report within seven calendar days
• You must provide feedback on the outcome of your investigation within three months

These are legal minimums, not aspirational targets. Failure to meet them creates compliance risk, even if your channel technically exists.

The EU Whistleblowing Directive is binding on EU member states, but each country transposes it into national law with variations. In the United Kingdom, the position is different: the Public Interest Disclosure Act 1998 (now Part IVA of the Employment Rights Act 1996) protects whistleblowers, but there is no statutory obligation for private-sector organisations to establish internal channels. However, if you operate across EU member states or have workers in the EU, you must comply with the directive in those jurisdictions.

Check the transposition law in every country where you operate. Your legal obligation is determined by the most stringent version that applies to your footprint. For comprehensive guidance on regulatory requirements across jurisdictions, see our whistleblowing regulatory guide for the UK, EU, and South Africa.

A policy document—the PDF your HR team drafts—is useful for good governance and demonstrates intent. But a policy without a functioning channel is simply paperwork.

Conversely, a functioning channel without a formal policy is compliant, though it leaves you exposed if someone later questions whether the channel was genuine or accessible.

The sensible approach is to maintain both: a clearly documented policy that explains how reports are handled, combined with a demonstrably working channel that workers can actually use. Our whistleblowing compliance checklist helps you verify both elements are in place.

If you have fewer than 50 workers, you have no legal obligation under the EU Whistleblowing Directive to establish an internal channel. However, you must still direct workers to external reporting channels—typically your national labour authority or competent authorities—and you remain liable if you retaliate against someone for making a protected disclosure.

As you grow towards the 50-worker threshold, this is the moment to implement a proper channel. Many organisations wait until they exceed 50, then scramble to set something up. Starting early is simpler.

Non-compliance is costly. If a worker reports a breach through an informal route and you fail to acknowledge it within seven days, or if you take three months and nine weeks to respond, you are technically breaching Article 9. If the worker subsequently suffers detriment, they can claim you failed to handle their report in accordance with the directive. This creates liability and reputational damage.

Moreover, the existence of a proper channel is a signal to your workforce that you take integrity seriously. Reports handled through informal channels are often lost, forgotten, or handled inconsistently. A dedicated channel—combined with a transparent policy—demonstrates genuine commitment to receiving and acting on concerns.