Whistleblowing: Whistleblower Protection Act

We will prepare a solution tailored to your needs. From gap analysis, through solution design and whistleblowing system implementation, to the investigation of the initiatives and allegations received and appropriate identification of corrective measures.

Does your company have at least 50 employees? If so, the law applies to you as well. We will help you set up a system that meets the requirements of the law and was beneficial to you, i.e. helped you identify problems in the company in time.

50 +

companies with 50 + employees are required to implement an internal whistleblowing system
42 %

of fraud cases are detected based on a notice/tip, over half of which are from employees

ACFE 2022: “Report to the Nations. Global Study”
51 %

of companies claim to have been a victim of fraud in the last 24 months

Global PwC study: "Global Economic Crime and Fraud Survey 2022”
33 %

of companies do not have a fraud reporting system implemented

Czech Republic, PwC: "Survey of Fraud Prevention and Detection”

Our services in the area of whistleblower protection

We will design a solution tailored to the needs of your company.

Current state analysis reflecting the changes to be implemented pursuant to the new legislation. We use risk assessment and structured interviews, assess the current Whistleblowing Directive and technical solutions, perform an analysis and walkthrough concerning the individual processes and prepare legal assessment as well.

Design of an appropriate whistleblowing system based on the current state analysis. We will suggest the required reporting channels, suitable technical solution, corresponding processes, employee training system as well as communication related to the whistleblowing solution both inside and outside your company.

Full implementation of the whistleblowing system. From the whistleblowing process implementation, through employee training and processing of internal guidelines, to the implementation of a technical solution and final validation.

Violation investigation. Within the operation of the hotline, our specialists will be happy to help you investigate potential violations. They will look into and assess evidence, evaluate the validity of the notification and suggest appropriate measures to remedy or prevent the infringement.

We will be happy to help you implement an internal whistleblowing system, set up your current solution appropriately or investigate the received notifications.

Consultation request

Whistleblowing: What you need to know

Current state of whistleblower protection legislation
Which typical entities have an obligation to implement internal reporting system?
What illegal activities can be typically reported?
What are the primary obligations arising from the new law?
How can the notification be submitted?
How to proceed if the notification is anonymous?
When to start with implementation of a whistleblowing system?

Current state of whistleblower protection legislation

EU Directive 2019/1937 on the protection of persons who report breaches of Union law (“Whistleblowing Directive”) was not transposed to Czech law within the time limit, i.e. by 17 December 2021.
The relevant law was only adopted in June 2023.
Companies with 250 and more employees are obliged to implement a functional whistleblowing system and to meet other legal requirements already as of 1 August 2023.
Companies with more than 50 but no more than 249 employees still have time to implement an internal whistleblowing system until 15 December 2023.

Which typical entities have an obligation to implement internal reporting system?

Employers with 50 and more employees
Public contractors (exception, for example, for municipalities with fewer than 10,000 inhabitants)
Public authorities in the area of:
– civil aviation
– maritime transport
Certain employers defined by the Capital Market Business Act. A special category consists of entities with obligations under the "anti-money laundering” regulations, for which it is necessary to approach the issue of whistleblowing individually.

What illegal activities can be typically reported?

Felony
Misdemeanour (with a maximum fine limit of at least CZK 100,000)
Actions that violate the provisions of the Whistleblower Protection Act
Actions that violate other legal regulations or regulations of the European Union in certain areas, such as:
    – financial services
    – competition
    – public procurement
    – corporate income tax
    – consumer protection
    – environmental protection
    – personal data protection

What are the primary obligations arising from the new law?

Establishment of communication channels and set-up of a process for receiving and handling notifications of infringements, including the possibility to submit notifications in person and to publish mandatory information by means allowing remote access, e.g. on the company‘s website.
Appointment of a designated person responsible for receiving and assessing the validity of notifications and for preparation of proposals for the necessary measures.
Adherence to time limits – confirmation of a whistleblower’s report within 7 days of its receipt and informing the whistleblower of the steps taken to remedy the infringement within 30 days with a possibility to prolong the time limit to 90 days at maximum in justified cases
Whistleblower protection, i.e. especially the whistleblower’s identity, and prevention of retaliation if the whistleblower is an employee of the company

How to proceed if the notification is anonymous?

The Whistleblower Protection Act applies to notifications containing information about the name, surname and date of birth, or other information from which it is possible to infer the identity of the whistleblower
Anonymous reports are therefore not protected by law and the company is therefore under no legal obligation to investigate them. Nevertheless, such notifications need to be recorded. Anonymous whistleblowers must be protected by the company as of the moment the whistleblower’s identity is revealed. Moreover, companies which are obliged persons under the AML Act have an obligation to investigate even anonymous reports.
Therefore, we recommend that companies also investigate relevant anonymous reports. The Act on Criminal Liability of Legal Entities lists selected criminal acts that can be attributed to a legal entity. A legal entity shall be exempt from criminal liability if it has made all efforts that could fairly be required of it to prevent the commission of the infringement.
The scope and method of investigation of anonymous reports should be set individually according to the needs of the company and the overall compliance setting.

When to start with implementation of a whistleblowing system?

The implementation period depends on the size of your company and, in some cases, it can take up to 6 months.
Gain an edge over others and avoid sanctions that can reach up to CZK 1,000,000.
Provide your employees (and possibly also selected external persons) with a suitable and secure channel in order to avoid the potential negative impact on your company's reputation

What is whistleblowing?

Whistleblowing refers to a situation where a so-called whistleblower alerts an authorised body or institution to unethical, unfair or unlawful conduct at the workplace. This includes, for instance, corruption, the failure to fulfil legal obligations or harm to health or the environment. Whistleblower, i.e. person reporting the infringement, is a person, most frequently an employee or even a third party, that “blows the whistle”, i.e. notifies the relevant body of misconduct.

Whistleblower Protection Act

Under the Whistleblower Protection Act, which was passed in June 2023, legal entities in the private and public sectors are required to establish secure internal channels for whistleblowing, create procedures for receiving notifications, ensure the confidentiality of the whistleblowers’ identity, and meet time limits for follow-up procedures, including investigation of the notification received and communication with the whistleblower. The Act is based on EU Directive 2019/1937, which sets out the minimum requirements for the protection of whistleblowers and which is implemented into Czech legislation through this Act. Nevertheless, the Czech law is stricter than the EU Directive in a number of aspects, which must be reflected especially if you use a group solution.

Is your company ready for the new legal requirements concerning whistleblower protection?

An internal whistleblowing system implemented in a due and timely manner will allow you to collect information on risks such as unethical conduct, which does occur in companies, and respond to these initiatives adequately.
This will reduce the likelihood that the whistleblower will take their complaint directly to the Ministry of Justice of the Czech Republic.
In such a case, there is a risk that serious and justified submissions will be referred by the Ministry of Justice to the competent authorities for further resolution, without your company being able to influence or resolve the submission internally. This constitutes not only a legal, but also a reputational risk for every business.

You might be interested in

Complex training for obliged persons

Comprehensive course covering whistleblower protection in the Czech Republic (Whistleblowing) - includes legal, forensic (conducting internal investigations) and psychological aspects

Whistleblower protection pursuant to EU legislation

Read the full wording of the EU Directive transposed into the law

Methodology of the Ministry of Justice

Methodology to the direct applicability of Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law.

The pitfalls of group whistleblowing solution

Whistleblower protection is often dealt with transnationally under common rules for the entire business group. However, upon the adoption of the Czech Whistleblower Protection Act, such solutions often do not meet its conditions and Czech companies thus may face significant sanctions.