Guide to Whistleblowing

Contributing Editors

In this new age of accountability, organisations around the globe are having to navigate a patchwork of new laws designed to protect those who expose corporate misconduct. IEL’s Guide to Whistleblowing examines what constitutes a protective disclosure, the scope of regulations across 18 countries, and the steps businesses must take to ensure compliance with them.

Learn more about the response taken in specific countries or build your own report to compare approaches taken around the world.

Choose countries

 

Choose questions

Choose the questions you would like answering, or choose all for the full picture.

22. What procedure must the whistleblower follow to receive protection?

22. What procedure must the whistleblower follow to receive protection?

Flag / Icon

Australia

  • at Lander & Rogers

There is no formal registration process for whistleblowers[4]; however, the protections afforded under the law will only apply to a whistleblower who meets the following criteria:  

The whistleblower must be a current or former: 

  • employee of the company or organisation the disclosure is about, or a related company or organisation; ;
  • officer (usually that means a director or company secretary) of the company or organisation the disclosure is about, or a related company or organisation; 
  • contractor, or an employee of a contractor, who has supplied goods or services to the company or organisation the disclosure is about – this can be either paid or unpaid (and includes volunteers); 
  • an associate of the company or organisation, usually a person with whom the company or organisation acts in concert; or 
  • trustee, custodian or investment manager of a superannuation entity, or an officer, employee, or a goods or service provider to a trustee, custodian, or investment manager. 

Protection is also offered if you are a spouse, relative or dependant of one of the people referred to above.  

The organisation the disclosure is about must be:

  • a company; 
  • a bank; 
  • a provider of general insurance or life insurance; 
  • a superannuation entity or a superannuation trustee; or 
  • an incorporated association or other body corporate that is a trading or financial corporation – this includes not-for-profit organisations that trade in goods or services, lend or borrow money, or provide other financial services, and their trading or financial activities make up a sufficiently significant proportion of their overall activities. 

It is important to note that not all not-for-profit organisations are subject to whistleblower protections.

The whistleblower must make their disclosure to: 

  • a director, company secretary, company officer, or senior manager of the company or organisation, or a related company or organisation; 
  • an auditor, or a member of the audit team, of the company or organisation, or a related company or organisation; 
  • an actuary of the company or organisation, or a related company or organisation; 
  • a person authorised by the company or organisation to receive whistleblower disclosures; 
  • ASIC or APRA; or 
  • a lawyer.

The whistleblower must have reasonable grounds to suspect that the information they are disclosing about the company or organisation concerns:

  • misconduct; or 
  • an improper state of affairs or circumstances.

Relevantly, this information can be about the company or organisation, or any officer or employee of the company or organisation, engaging in conduct that:

  • breaches the Corporations Act; 
  • breaches other financial sector laws enforced by ASIC or APRA; 
  • breaches an offence against any other law of the Commonwealth that is punishable by imprisonment for 12 months; or
  • represents a danger to the public or the financial system. 

The protections under the Corporations Act can also apply to a whistleblower report to a journalist or a member of the Commonwealth Parliament or a state or territory parliament. However, protection is only in certain limited circumstances, as set out below:

Public Interest Disclosures

  • The whistleblower must have previously made a report to ASIC or APRA that satisfied the criteria set out above. 
  • At least 90 days must have passed since the whistleblower reported their concerns to ASIC or APRA, and the whistleblower does not have reasonable grounds to believe that action to address the concerns is being or has been taken.  
  • The whistleblower must have reasonable grounds to believe that reporting their concerns to a journalist or parliamentarian would be in the public interest. 
  • After 90 days from when the whistleblower reported to ASIC or APRA, the whistleblower must give ASIC or APRA a written notice that includes sufficient information to identify their earlier report and states their intention to make a public interest disclosure.[5] 
  • The whistleblower must report their concerns about misconduct or an improper state of affairs or circumstances or a breach of the law to a journalist or a parliamentarian.

Emergency disclosures

  • The whistleblower must have previously made a report to ASIC or APRA that satisfied the criteria set out above.
  • The whistleblower must have reasonable grounds to believe that the information in the report concerns substantial and imminent danger to the health or safety of one or more people or the natural environment.
  • The whistleblower must give ASIC or APRA a written notice that includes sufficient information to identify their earlier report and states their intention to make an emergency disclosure.[6]   
  • The whistleblower must report their concerns about the substantial or imminent danger to a journalist or parliamentarian.

Despite the above, there are certain exclusions from the protections for people who have observed or been affected by the misconduct of a company or organisation. If an individual falls into the following categories, they may not be covered by the whistleblower protections:

  • people experiencing employment disputes or a personal work-related grievance;
  • competitors; and
  • customers or clients.
 

[4] According to the ASIC Information Sheet 238 issued on 1 July 2019.

[5] This can be done by contacting the ASIC officer who first considered the whistleblower's concerns and by quoting the reference number of the case.

[6] Ibid.

Last updated on 23/08/2022

Flag / Icon

Belgium

  • at Van Olmen & Wynant

Please consult the conditions in question 14.

Last updated on 01/08/2022

Flag / Icon

Brazil

  • at CGM
  • at CGM
  • at CGM

The procedure for the whistleblower to receive protection is whatever is outlined in the company’s whistleblowing proceeding.

Last updated on 29/07/2022

Flag / Icon
Croatia

Croatia

  • at Babic & Partners
  • at Babic & Partners

To receive protection as granted under the WBP Act, the whistleblower must either:

  • submit an internal whistleblowing report as per the whistleblowing procedure established by  company and the WBP Act;
  • submit an external whistleblowing report to the competent authority for external reporting (which in Croatia is the Croatian Ombudsman) as per the regulations adopted by that authority and the WBP Act; or
  • publicly disclose information on irregularities as per the WBP Act (please see question 18).
Last updated on 29/07/2022

Flag / Icon

France

  • at Proskauer
  • at Proskauer

The whistleblower has the choice between the following reporting procedures:

  • Internal reporting procedure: the employee notifies his or her hierarchy or goes through the applicable internal procedure.
  • External reporting procedure: the employee reports to:
    • the competent authority among those designated by a future decree;
    • the Defender of Rights, who will direct them to the authority or authorities best able to handle it;
    • the judicial or administrative authority; or
    • an institution, body or agency of the European Union competent to collect information on violations falling within the scope of the 2019 Directive. 

A decree will establish the list of authorities competent to collect and process external alerts.

Public disclosure of information may also take place in the following situations :

  • no appropriate action has been taken in response to an alert made by an external channel at the end of a certain time set by decree;
  • imminent or obvious danger to the public; or
  • when an external notification would run the risk of retaliation or would not allow an effective remedy for the subject of the disclosure (for example, suspicion of conflict of interest, risk of concealment or destruction of evidence and collusion).
Last updated on 29/07/2022

Flag / Icon

Germany

  • at Oppenhoff
  • at Oppenhoff

To obtain protection, the whistleblower generally has to contact the responsible internal or external reporting offices. Disclosure of information about violations directly to the public is subject to strict conditions. This is only permissible, for example, if there is a risk of irreversible damage or in cases where the external reporting agency has not taken the required measures (section 32 (1) HinSchG-E).

The whistleblower providing the information must further act in good faith (ie, must have reasonable cause to believe, at the time of the report or disclosure that the information disclosed is true, and the information relates to violations that fall within the material scope of the Whistleblower Protection Act (section 33 (1) No. 2 and 3 HinSchG-E)).

Last updated on 29/07/2022

Flag / Icon

India

  • at Khaitan & Co
  • at Khaitan & Co

As per the Whistle Blower Protection Act, if any person believes they are being victimised because they filed a complaint, made disclosures or rendered assistance in an inquiry under the Act, they may apply to the competent authority (as may be designated or appointed under the Whistle Blower Protection Act) seeking protection.

The authority may take such action, as appropriate, and give suitable directions to the concerned public servant or the public authority (including the jurisdictional police to protect such person from being victimised or to avoid such victimisation. However, it is important to note that the Whistle Blower Protection Act does not clarify or lay down any standards or definitions for “victimization”, and the same is subject to the assessment of the competent authority.

The process to be followed by whistleblowers in respect of Covered Companies or other establishments is subject to the policy adopted by such establishments.

Last updated on 29/07/2022

Flag / Icon

Japan

  • at City-Yuwa
  • at City-Yuwa
  • at City-Yuwa

The protection requirements are as follows, and are different depending on whether the report is made to the Recipient of Services etc., an administrative organ of the authority, or the Others:

  • Reporting to the Recipient of Services etc. (article 3, item (i) of the Act) – if the reportable fact is considered to have occurred or is about to occur;
  • Reporting to an administrative organ of the authority (article 3, item (ii) of the Act) – if there are reasonable grounds to believe that the reportable fact has occurred, or is about to occur; or the reportable fact is considered to have occurred, or is about to occur, and the document with the whistleblower’s name and address and the reportable fact etc., are submitted;
  • Reporting to the Others (article 3, item (iii) of the Act)
  • there are reasonable grounds to believe that a reportable fact has occurred or is about to occur and when any of the following applies:
    • if the whistleblower has reasonable grounds to believe that he or she will be dismissed or suffer other discriminatory treatment if he or she makes a report to the Recipient of Services etc. , or the administrative organ;
    • if the whistleblower has reasonable grounds to believe that evidence of the reportable fact might have been concealed, counterfeited or altered if they make a report to the Recipient of Services etc.;
    • if the whistleblower has reasonable grounds to believe that the Recipient of Services will leak information identifying the whistleblower without just cause if the whistleblower makes a whistleblowing report to the Recipient of Services etc.;
    • if the whistleblower was asked by the Recipient of Services, without any just cause, not to make a report to the Recipient of Services etc., or the administrative organ;
    • if the whistleblower does not receive a notice from the relevant Recipient of Services etc. about the beginning of an investigation on the reportable facts within 20 days of the day the report was made to the Recipient of Services etc.in writing, or where the relevant Recipient of Services etc. does not investigate without any just cause; or
    • if the whistleblower has reasonable grounds to believe that some damage (limited to damage that cannot be recovered or considerable damage to an extremely large number of individuals directly caused by the reportable fact) to the life or body of an individual has occurred or is about to occur.

If the whistleblower is an officer, additional protection requirements (eg, the reportable fact has occurred or is about to occur despite conducting an internal investigation and taking rectification measures) are required when reporting to an administrative organ with the authority and the Others (Article 6, Items 2 and 3 of the Act).

Last updated on 29/07/2022

Flag / Icon
Latvia

Latvia

  • at Ellex Klavins
  • at Ellex Klavins

The whistleblower must lodge a non-anonymous whistleblower’s report. If the report is not recognised as the whistleblower’s report at a later date, the protection is forfeited.

Last updated on 29/07/2022

Flag / Icon
Lithuania

Lithuania

  • at Ellex Valiunas

Some of the established safeguards will apply automatically; others will apply upon the respective request of the whistleblower.

Last updated on 29/07/2022

Flag / Icon
Luxembourg

Luxembourg

  • at Castegnaro
  • at Castegnaro

The authors of a report will enjoy the protection provided for by this law if:

  • they had reasonable grounds to believe that the information reported on was true at the time of reporting and that this information falls within the scope of this law; and
  • they have made an internal report under article 7 or an external report under article 19, or have made a public disclosure under article 24.

By extension, the following are also protected:

  • facilitators[1];
  • third parties who are connected to the whistleblowers and who are at risk of retaliation in a professional context, such as colleagues or relatives of the whistleblowers;
  • legal entities owned by or employing the authors of the report, or with which they are connected in a professional context.
 

[1] a physical person who assists a reporter during the reporting process in a professional context and whose assistance should be confidential.

Last updated on 29/07/2022

Flag / Icon
Nigeria

Nigeria

  • at Bloomfield LP

A whistleblower must comply with the procedures stipulated below to receive appropriate protection:

  • a whistleblower must comply with the procedure laid down in the whistleblowing policy, including the reporting mechanism;
  • the disclosure must be made in good faith and there must be reasonable grounds to believe that unethical or illegal activity was or is about to be conducted; and
  • the matter disclosed must not be in the public domain.
Last updated on 29/07/2022

Flag / Icon

Portugal

  • at Cuatrecasas
  • at Cuatrecasas

A whistleblower who, in good faith and with a serious reason to believe that the information is true at the time of the report or public disclosure, reports or publicly discloses an infringement in the terms established in Chapter II of Law No. 93/2021 – on the means of reporting and public disclosure – will benefit from the protection granted by the referred law.

An anonymous whistleblower who is subsequently identified will benefit from the protection granted by the above-mentioned law, provided that he or she meets the conditions set out for an identifiable whistleblower.

Last updated on 29/07/2022

Flag / Icon

Romania

  • at STALFORT Legal. Tax. Audit.
  • at STALFORT Legal. Tax. Audit.

For a whistleblower to qualify for protection under the Draft Law, he or she must verify whether the personal condition and the work-related context are fulfilled, and file for a non-anonymous report using either the internal or the external channel. Public disclosures to the press are permitted only in exceptional cases (see question18).

Last updated on 16/08/2022

Flag / Icon

Spain

  • at Cuatrecasas
  • at Cuatrecasas
  • at Cuatrecasas

If the whistleblower believes that he or she has been retaliated against, he or she should inform the corresponding Independent Authority for Whistleblower Protection – or the equivalent body in the corresponding autonomous community. This is the Authority responsible for the adoption of protection measures and for imposing sanctions under Title IX of the Draft when infractions fall under the public sector scope and in the private sector when the reported infringement affects more than one autonomous community.

Moreover, the whistleblower, if appropriate, can also inform the company (internal disciplinary powers) or even file a claim against its employer before the Labour Courts (because dismissal or other measures implemented by the company as retaliation for having reported unlawful practices will be declared null and void). As stated in section 38 of the Draft, in employment proceedings before a court, once the whistleblower has reasonably demonstrated that he or she has communicated or made a public disclosure under the Law transposing the Directive and that he or she has suffered prejudice, it will be presumed that the prejudice occurred in retaliation for that disclosure. In such cases, the person who has taken the detrimental action will need to prove that such action was based on duly justified reasons not linked to the communication or public disclosure.

Last updated on 29/07/2022

Flag / Icon

Sweden

  • at Lindahl
  • at Lindahl
  • at Lindahl

Regarding the procedure, please see questions 17 and 18.

A reporting person (see question 12) receives protection under the Whistleblowing Act when:

  • the reported information concerns either:
    • a violation of EU law; or
    • an irregularity in the public interest (cf. question 10) in a business in which the reporting person is or has been operative or will operate, or with which the reporting person is or has been in contact through the reporting person’s work; and
  • the reporting person has reasonable grounds to believe that the reported is true; and
  • the reporting is made internally or externally to an authority (including both national and EU bodies) or publicly disclosed under the Whistleblowing Act.

A whistleblower may also enjoy protection under other applicable legislation, such as the Discrimination Act.

Last updated on 02/08/2022

Flag / Icon

United Kingdom

  • at Proskauer
  • at Proskauer
  • at Proskauer

To gain statutory protection, a whistleblower must follow the correct procedure for disclosing the qualifying disclosure as outlined in question 14.

Last updated on 29/07/2022

Flag / Icon

United States

  • at Proskauer
  • at Proskauer

OSHA administers more than 20 whistleblower statutes, with varying time limits for filing a whistleblower complaint, ranging from 30 to 180 days.

A SOX whistleblower must first file a complaint with OSHA. OSHA will then conduct an investigation. If the evidence supports an employee’s claim of retaliation, OSHA will issue an order requiring the employer to put the employee back to work, pay lost wages, restore benefits, and provide other relief, as appropriate. The exact requirements depend on the facts of the case. If the evidence does not support the employee’s claim, OSHA will dismiss the complaint.

After OSHA issues a decision, the employer or the employee may request a full hearing before an administrative law judge (ALJ). A final decision by an ALJ may be appealed to the Department of Labor’s Administrative Review Board (ARB). A decision by the ARB can then be appealed to a federal appellate court.

Last updated on 29/07/2022