How protection for whistleblowers differs across the 27 EU countries

Protection for whistleblowers differs across the 27 EU countries, and the WeMoral 2026 report puts every national rule side by side. One worker reports the same wrongdoing in Madrid, in Tallinn and in Budapest, and three different laws answer. In two member states a dismissed reporter has no civil remedy at all. Directive (EU) 2019/1937 is the shared floor. Everything above it is national, and the spread is wide.

What does the WeMoral 2026 report on the EU whistleblowing directive cover?

The WeMoral 2026 report on the EU whistleblowing directive covers all 27 national laws across 33 points. Those points fall into four parts. Scope settles who must run a channel. The process part sets what the channel takes in, and how fast it has to answer. Protection takes in what a worker may report, and what they get when it goes badly. Enforcement names who checks, and what a breach costs. Every entry comes from the statute itself, never from a summary. A second pass checked the whole set again. Each act is named with its official title and a link. The report states the law as it stood in July 2026. WeMoral did the work in house, sells whistleblowing software for these channels, and gives the report away free.

What can an employee report under an EU whistleblower law?

An employee can report far more under most EU whistleblower laws than the directive itself covers. The directive lists breaches of EU law in a closed set of fields. Only Estonia and Greece kept that list and stopped there. Everywhere else the list of subjects grew. In several countries the tie to EU law is gone. Slovenia takes a report about a breach of any rule in force. The Dutch act takes any harm to society, with no EU angle needed. France covers any crime, offence or harm to the general interest. Hungary lets anyone report any unlawful act, then protects only the reports on the directive's own list. That split catches employers out. The duty to take a report and the duty to protect the reporter do not cover the same ground.

Six member states and what a protected report may be about. Source: the WeMoral 2026 Report on Whistleblower Directive Transposition Across the EU.
Country What a protected report may be about
Estonia The EU law fields only, 13 of them
Slovenia Breach of any regulation in force
Netherlands Any societal wrongdoing
France Any crime, offence or harm to the general interest
Czechia Any criminal offence plus 14 fields
Germany All criminal offences plus 20 fields

Who is protected when they report wrongdoing at work?

The people protected when they report wrongdoing at work reach well past the payroll. All 27 laws agree on that much. Each one covers the reporter, the people who help, and the firms and persons tied to them. What sits on top varies a lot. Denmark names eight groups, Sweden nine, Ireland ten and Poland thirteen. Estonia protects the person who runs the channel. Slovenia covers student workers and suppliers' staff. Several states settled an open question and let a helper be a company rather than a person. A few trimmed instead. Latvia never names former staff. Malta puts the disciplined forces outside its act. In Belgium one regional decree drops contractors and job applicants that the federal law keeps, so cover depends on which of the eight Belgian texts applies.

Can a whistleblower go straight to a regulator?

A whistleblower can go straight to a regulator in most EU countries. Twenty one states wrote that free choice plainly into their law. Croatia went further in 2025 and added the police and the state attorney. Six states set conditions instead, and those conditions reach further than they look. Protection itself can follow the route the reporter took. Finland treats the internal channel as a condition, with four ways out. Italy lists four grounds, Slovenia three and Lithuania seven. Portugal sets five gates. Malta wants an internal try first, made or attempted. Going public is tighter still, and Portugal leaves the press outside the protected routes. Lithuania guards a public disclosure only when life, health or the environment is in urgent danger.

What happens to a whistleblower who is dismissed for reporting?

What happens to a whistleblower who is dismissed for reporting depends on the country. Cyprus and Italy void the act and order the job back on request. Greece voids such a dismissal every time. Denmark restores the job unless that would be plainly unfair. Estonia and the Netherlands leave a dismissed reporter nothing to sue on. Estonia bans the act and fines it, but the money goes to the state. The Dutch law names no remedy, and it repealed the Civil Code article that used to supply one. Czechia pays for hurt feelings and no more. Hungary simply rules the measure unlawful. Where money is on offer, several states cap it, and one of those caps is worth about a month of good pay.

What a dismissed reporter can recover in eight member states. Source: the WeMoral 2026 Report on Whistleblower Directive Transposition Across the EU.
Country Is the dismissal void Money
Cyprus Yes, job back on request Full loss, moral damages, interest
Italy Yes, plus interim measures Damages, no cap
Greece Yes, in every case Full compensation, no cap
Ireland No Capped at 260 weeks' pay
Sweden No Capped at 16 to 32 months' salary
Lithuania Consequences eliminated Capped at about €3,700
Estonia No None
Netherlands No None

Who has to prove that a dismissal was retaliation?

The employer has to prove that a dismissal was not retaliation in most of the EU. The reporter shows a report and a harm. The employer then has to show a sound reason. Some states went further. Germany flips the burden on the reporter's bare claim. Latvia asks the reporter to show nothing first. Croatia adds a presumption that the two are linked. Four states did not flip it, or flipped it only part way. Czechia has no such rule anywhere in its act. Bulgaria left it out and added a lawful ground defence. Austria asks both sides for a plausible case, which is a lighter shift than a full reversal. Slovakia flips it before its own office but not in court. Every other guard leans on this one rule, since a reporter who cannot shift the burden will rarely prove motive.

Can an NDA stop an employee from reporting?

An NDA cannot stop an employee from reporting in most EU countries, because the law voids the clause. Member states must strike out any waiver of these rights, whether it sits in a contract, a gag clause or a settlement. Malta wrote the widest version. It voids any term that merely discourages a report. Ireland voids one that blocks a claim, with no exceptions at all. Cyprus, Romania, Greece and Lithuania name arbitration agreed in advance. Four states left a gap a drafter can walk through. Luxembourg has no such clause anywhere. Slovenia says nothing on the point. Spain fines the employer but does not clearly void the term. Sweden voids waivers, yet lets a central union deal displace the channel rules. An exit deal written to the strictest of these standards travels across the whole bloc, while one written to local taste gets redrafted at every border.

What support does a whistleblower get after making a report?

The support a whistleblower gets after making a report is legal advice, and often little else. Legal aid shows up in eighteen states. Five of them skip the means test, so a well paid manager qualifies as easily as a clerk. Help for the mind is named in only seven. So is a letter confirming protected status, and that letter does real work. It is the paper a reporter hands to a court or to a new employer. Spain and Slovenia are the only states with the full range. Slovenia adds a benefit paid until final judgment and repaid by the losing side. At the bottom, five states name advice and nothing more. Three name no measure at all. Only what each act actually names was logged, so a blank means the statute is silent.

What does a false report cost the person who made it?

A knowingly false report costs the person who made it up to €300,000 in Spain. That is the heaviest money risk in the whole set. Twenty states attach a fine or a prison term to it. Seven attach nothing at all. Ireland can reach €100,000 and two years, and it lets anyone harmed by the report sue as well. On the prison side Greece is the harshest and asks for two years or more. At the small end the sums are close to symbolic. Money runs the other way too. Slovakia pays a state reward of up to fifty times the minimum wage. Lithuania grants an uncapped payment for good information, then drops the retaliation remedy once it has been paid.

The small end of the reporter's own risk, plus the states that fine nothing. Source: the WeMoral 2026 Report on Whistleblower Directive Transposition Across the EU.
Country Penalty for a knowingly false report
Latvia €30 to €700
Slovenia €400 to €1,200
Italy €500 to €2,500, plus workplace discipline
Croatia €600 to €4,000
France, Lithuania, Slovakia, Sweden, Malta No fine, protection is withdrawn instead
Hungary, Netherlands Nothing at all

Which whistleblowing software holds up under all 27 laws?

Whistleblowing software holds up under all 27 laws when it is built to the strictest rule in the set. WeMoral is compliant whistleblowing software, a subscription service that is hosted and patched for the customer. The branded reporting page is live in under 5 minutes. All case data is stored in Frankfurt, Germany, and stays on EU soil. Each report is encrypted on arrival and in storage, and so is every reply sent back. The form asks for no name by default, and an identified route is a setting rather than a different product. WeMoral PRO is €79 a month, net, with a 30 day free trial. The reporting page and the panel both run in 25 languages, picked separately by the reporter and the handler.

What an employer should do with these findings

An employer should take these findings country by country, then build one procedure to the hardest rule in the set. The report is free to download, with the 33 columns, the country tables and the source list. The reason to bother sits in the burden of proof. In most member states the employer has to show that the reason for a dismissal was sound. That is an evidence problem long before it is a legal one. The audit log answers it, because it records every read and every change with the time and the account. This suits a compliance lead who has to prove the channel works and hold the record that shows it. Dashboards and a submissions time series export straight into a board pack. One media group of about 1,000 staff cut its time to acknowledge a report by about 99%, from 11 days to 2 hours, after moving to WeMoral. That sits well inside the seven day window the directive sets.