Whistleblowers: rights and obligations for businesses and employees

Any employee, self-employed person, or director who learns of possible fraud or unlawful practices within an organisation often faces a difficult choice: stay silent or report it? Belgium's whistleblower regulation protects those who take that step. As employment and labour law attorneys in Flanders and Brussels, we assist both employers and employees with questions about reports, reporting channels, and the protection the law provides.

What is a whistleblower?

A whistleblower is someone who raises the alarm about possible unlawful or fraudulent activities within an organisation. The law defines "reporting person" broadly: protection extends not only to employees, but also to self-employed persons, volunteers, shareholders, directors, managers, supervisors, and paid or unpaid trainees.

The regulation stems from the European Whistleblower Directive, which was transposed into national legislation in Belgium.

Which breaches fall under the regulation?

Not every complaint automatically qualifies as a whistleblower report. The law only covers breaches falling within its material scope, such as:

• environmental protection
• product safety;
• protection of privacy
• security of information systems

Personal or purely employment-related disputes — for example, a disagreement over pay or working hours — generally do not fall under this law.

How can a breach be reported?

Who must provide an internal reporting channel?

Private-sector legal entities with at least 50 employees are required to provide an internal reporting channel and reporting procedure. The term "legal entity" is interpreted broadly and includes companies, associations, and foundations, among others.

Businesses subject to this obligation must designate a person or department responsible for handling reports, such as an HR manager, compliance officer, or legal department. A report can be made either in writing or verbally and must be handled confidentially, securely, and impartially.

External reporting channels

A reporting person may also approach a competent external authority directly, depending on the nature of the breach — for example, the FSMA, the Data Protection Authority, the public prosecutor's office, or the federal ombudsman. The reporting person is not required to use the internal channel first.

Public disclosure

Under certain conditions, the reporting person may also make the information public, for example through the press.

When is a reporting person protected?

A reporting person is protected when they had reasonable grounds to believe that the reported information was accurate and concerned a breach falling within the scope of the law.

Confidentiality and data protection

The identity of both the reporting person and the persons concerned must be treated confidentially. Reporting channels must provide sufficient safeguards regarding confidentiality, security, and the careful processing of personal data, in line with the GDPR. The Data Protection Authority oversees compliance with these core principles.

Prohibition of, and consequences for, retaliation

A company may never disadvantage a reporting person because they made a report. Examples of prohibited retaliation include dismissal, suspension, demotion, intimidation, or discrimination. Persons who assist the reporting person or who are connected to them may also, under certain conditions, be protected.

Anyone who nonetheless becomes a victim of retaliation may, under certain conditions, be entitled to:

• compensation equal to 18 to 26 weeks' pay
• in certain cases, reinstatement under the conditions that applied before the retaliatory measure

Retaliation may also carry criminal consequences: the law provides for imprisonment of six months to three years and a fine of EUR 600.00 to EUR 6,000.00. Anyone who feels disadvantaged after making a report would do well to consult a dismissal or employment law attorney promptly to have the situation assessed.

Conclusion: a balance between protection and diligence

The whistleblower regulation seeks a balance between protecting those who report a breach in good faith and protecting businesses against unfounded or knowingly false reports. For employers, it is essential to invest in a properly established reporting channel, a confidential and impartial follow-up of reports, and careful processing of personal data.

Contact

Are you facing irregularities within your organisation, or would you like, as a business, to set up your reporting channel correctly? Our employment and labour law attorneys in Flanders and Brussels, operating from Vilvoorde and Lede, are happy to inform you about whistleblower legislation in the private and public sectors. Contact FAIRWAY for more information!