How to receive and process a whistleblower report in the workplace?

Updated 9 November 2026

Key contacts: Pascal-André Gérinier (Lawyer - Founder), William Mak (Lawyer - Founder)

Companies with at least fifty employees must establish an internal procedure for receiving and processing reports, after consulting the works council, the CSE (Sapin II Act, Article 8). The author receives an acknowledgement of receipt within seven working days and feedback within three months (Decree No. 2022-1284 of 3 October 2022, Article 4). Their identity is confidential, on pain of two years' imprisonment and a fine of 30,000 euros (Article 9), and any retaliation is void as of right (Article 10-1). The report is not the investigation: it calls for a check of its admissibility, then an assessment of the accuracy of the allegations, in practice through an internal investigation where the facts are serious.

Key points

• Fifty employees: the threshold above which the internal procedure is compulsory; below it, the employee may alert their superior or the employer and remains protected.
• Seven working days to acknowledge receipt, three months to inform the author of the outcome.
• Strict confidentiality of the identity of the author, of the persons concerned and of third parties; the identity of the implicated person is disclosed only once the alert has been established.
• Any retaliatory measure is void as of right, and obstructing a report is a criminal offence.
• The report is not the investigation: it may lead to one, depending on the seriousness and plausibility of the facts, and it is then the rigour of the investigation that will establish the facts.

From fifty employees, an internal procedure for receiving reports is compulsory (Article 8 of the Sapin II Act). This channel also makes it possible to detect early facts that call for intervention. An accessible system encourages their handling within the company, without ruling out the external route. The existence of an effective internal reporting channel is one of the criteria for assessing a public disclosure (Cass. crim. 13 janvier 2026, n° 24-86.344). The channel organises the receipt of alerts and facilitates their examination.

Who is a whistleblower?

A whistleblower is a natural person who reports or discloses, without direct financial consideration and in good faith, information concerning a crime, an offence, a threat or harm to the public interest, or a breach of an international commitment, of European Union law, of statute or of regulations (Sapin II Act, Article 6). Facts covered by national defence secrecy, medical confidentiality, the secrecy of judicial deliberations, the secrecy of criminal investigations and judicial inquiries and lawyers' legal professional privilege (secret professionnel) are excluded. Those who may report through the internal route are staff members, former employees and job applicants, shareholders and partners, members of the management bodies, external and occasional collaborators, contracting parties and their subcontractors (Article 8). An employee who in good faith reports or testifies to harassment benefits, in addition to the prohibition of retaliatory measures and their nullity, from the immunity, the adjusted burden of proof and the advance on costs provided for in Article 10-1, I and III, and in Articles 12 to 13-1 of the Sapin II Act (Article L. 1152-2 of the French Labour Code).

The internal channel: who must have one, and how

From fifty employees, you must establish an internal procedure for receiving alerts, after consulting the works council or the other social dialogue bodies (Article 8, I, B, of the Sapin II Act). An internal officer or a third party may receive the alerts. The procedure provides for written or oral reporting, or both; if it allows oral reporting, this may be done by telephone or voicemail and, at the author's request, at a video conference or a physical meeting organised no later than twenty working days after the request (Article 4 of the Decree of 3 October 2022). Inform employees of the system and how it works. Entities with fewer than two hundred and fifty employees may pool their procedures. A common procedure is possible within a group (Article 8, I, C). For the large companies concerned, link this channel with the anti-corruption system (Article 17).

Receiving the report: seven working days

The procedure informs the author in writing of the receipt of their report within seven working days (Decree, Article 4). The company then checks that the report falls within the scope of the Act: nature of the facts, status of the author, information obtained in a professional context. It may ask the author for any additional information and, if it considers that the report does not meet the conditions, tells them the reasons. For an anonymous report, the check of the author's status does not apply, but the procedure must specify how such reports are dealt with; an anonymous author whose identity is subsequently revealed enjoys the same protections, and the feedback obligation is not owed to them (Article 7-1). Where the facts concern another company in the group, the company may invite the author to send their report to that company as well.

Processing: from verification to investigation

After receipt, you check whether the allegations appear accurate and may ask their author for additional information. If the facts appear plausible, the company assesses their accuracy, if need be through an internal investigation. Where the allegations appear to be substantiated, you must implement the means of remedying the facts reported. The author receives written feedback, within a reasonable period not exceeding three months from the acknowledgement of receipt, on the measures envisaged or taken and the reasons for them. If the allegations are inaccurate, unfounded or moot, you close the report and inform the author in writing (Article 4, III, of the Decree of 3 October 2022). The guide How to conduct an internal investigation into harassment or discrimination? describes the method of the investigation itself.

Two precautions avoid the most frequent disputes. First, the officer who receives the alert must be neither concerned by the facts nor placed under the authority of the implicated person: the procedure designates a deputy or a third party for that case. Second, the implicated person is informed of the facts alleged against them and of the use made of their data, without the author's identity being disclosed to them, unless the author consents; this information, due in principle within one month, may be deferred as long as it would seriously compromise the investigation, for example where there is a risk of destruction of evidence, and must be given as soon as the risk has passed (CNIL reference framework on professional whistleblowing systems, Deliberation No. 2023-064 of 6 July 2023). Each decision, from characterisation to closure, is dated and reasoned in a file with restricted access: it is that file that will demonstrate, before the court or the authority, that the alert was handled seriously.

Confidentiality and data

The procedure guarantees strict confidentiality of the identity of the author, of the persons concerned, of any third party mentioned and of the information collected (Article 9). Information identifying the whistleblower may be disclosed only with their consent, except to the judicial authority where the persons in charge of processing are required to report the facts. Information identifying the implicated person may be disclosed, except to the judicial authority, only once the alert has been established as well founded. Disclosing this information is punishable by two years' imprisonment and a fine of 30,000 euros. Reports are kept only for as long as is strictly necessary for their processing and for the protection of the persons concerned, in compliance with the GDPR. In practice, this requires a closed circle of recipients, restricted IT access and an investigation conducted by persons who report only to the officer and to the mandating body.

Protecting the author: retaliation is void

Protection requires good faith and the absence of direct financial consideration (Article 6 of the Sapin II Act). The whistleblower is not civilly liable for the damage caused by their report if they had reasonable grounds to believe that it was necessary to safeguard the interests at stake, and they benefit from the exemption from criminal liability provided for in Article 122-9 of the French Criminal Code (Article 10-1). Retaliation is prohibited: dismissal, suspension, sanction, demotion, refusal of promotion, transfer, pay cut, negative appraisal, harassment, discrimination or blacklisting. It is void as of right. In the event of a dispute, the burden of proof is adjusted in the whistleblower's favour and an advance on legal costs may be granted to them (Article 10-1, III). Where the contract is terminated following the alert, the employee may apply to the labour court (conseil de prud'hommes) in interim proceedings (référé), and a top-up of their personal training account is possible (Article 12). Obstructing a report is punishable by one year's imprisonment and a fine of 15,000 euros; abusive proceedings against a whistleblower may give rise to a civil fine of up to 60,000 euros (Article 13).

External reporting and public disclosure

The whistleblower may also, after an internal report or directly, refer the matter to a competent external authority, the Defender of Rights, the judicial authority or a European Union body (Article 8, II). They may publicly disclose the information if, after an external report, whether or not preceded by an internal report, no appropriate measure has been taken within the time limits, in the event of serious and imminent danger, or where referral to an authority would expose them to retaliation or would not make it possible to remedy the facts effectively, for example if evidence risks being destroyed (Article 8, III). The criminal chamber held in January 2026 that the whistleblower defence provided for in the Criminal Code does not apply to defamation proceedings, but that the good faith of a person who discloses, in breach of the rules applicable to them, confidential information obtained in the course of their professional activity is assessed according to the criteria of the European Court of Human Rights: the existence of means other than public disclosure, reasonable grounds to believe the information authentic, the absence of personal gain, and the public interest weighed against the harm caused. In that case, the judges had noted that the person concerned had no effective means of internal reporting; the conviction for defamation was nevertheless upheld, because he had published serious accusations without verifying them and in order to target his former partner personally (Cass. crim. 13 janvier 2026, n° 24-86.344). For the company, the lesson remains the same: an internal channel that works, responds within the time limits and protects its author removes one of the main justifications for public disclosure.

Outsourcing the receipt of reports: what the firm can put in place

The law allows the receipt of reports to be entrusted to an external third party, and many companies benefit from this: the author speaks more freely to an outside contact, confidentiality is easier to maintain, and management is informed only of what it is entitled to know. MOSAIK can set up this channel for the company: a secure external address accessible to all employees, an acknowledgement of receipt and a first response within 24 working hours, an examination of urgency, confidentiality and conflicts of interest, then activation of the protocol agreed with the company, which alerts only the authorised persons and triggers the immediate measures. An aggregated monthly summary gives management an overview of trends and of the preventive actions to be taken, without passing on each individual report.

A channel is used only if it is known and credible. The launch is accompanied by an information campaign for employees, meetings, posters, internal messages, QR codes, presenting the risks, the rights, the confidentiality rules and the reporting process, and by training for officers and managers on receiving an alert: welcome, do not investigate oneself, protect, direct and record. Effectiveness is then measured: participation rate, understanding of the channels, anonymised feedback, and annual updating of the materials. The system is designed for groups with teams abroad, in the language of the employees concerned.

In an international group

In an international group, you may provide for a common procedure for receiving alerts (Article 8, I, C, of the Sapin II Act). A company that receives a report concerning another company within the scope of consolidation may invite the author to send it to that company as well (Article 4, II, of the Decree of 3 October 2022); any communication of information to a third party remains limited to what is necessary for processing (Article 6, I). Transfers of personal data outside the European Union remain subject to the GDPR. Provide a channel accessible in the languages of the employees concerned. Also check how it fits with foreign whistleblowing legislation. The guide How to conduct an internal investigation in an international group? details these rules.

What changes according to the facts

Below fifty employees, no procedure is required on the basis of headcount, save for sector-specific regulation, but an employee may report the facts to their line manager, to the employer or to an officer, and enjoys the same protections (Article 8, I, B). In companies with at least five hundred employees whose turnover, consolidated where applicable, exceeds one hundred million euros, the internal whistleblowing system is one of the eight anti-corruption measures imposed by Article 17 of the Sapin II Act, supervised by the French Anti-Corruption Agency. Where a specific reporting regime exists for a sector, it applies in priority, the measures of the Sapin II Act that are more favourable to the author, in particular protection against retaliation and the remedy before the labour court (Articles 10-1, 12 and 12-1), remaining applicable (Article 6, III). And where the report concerns harassment, the investigation rules described in the guide How to conduct an internal investigation into harassment or discrimination? are added to those of the whistleblowing system; the guide What are the rights of the employee who is a victim or implicated? describes the protection of the author, and the Internal investigations page the firm's approach as a whole.