Key takeaways:
- A corporate whistleblower is a natural person who, in good faith, reports wrongdoing or conduct contrary to the public interest.
- The law grants them strict legal protection.
- For employers, regulating this right is a cornerstone of governance and trust.
Whistleblower in a company: a precise legal definition
The term “whistleblower”, literally “one who blows the whistle”, refers in French to a “lanceur d’alerte”. Article 6 of the Law of 9 December 2016 provides a precise definition. It is a natural person who reports or discloses, without direct financial compensation and in good faith, information concerning a crime, offence, threat or harm to the public interest.
To benefit from whistleblower status, three cumulative conditions must be met:
- The person must be a natural person, never a company.
- They must act in good faith, without seeking personal gain.
- The information must concern genuinely serious or unlawful facts. An employee who did not obtain the information in a professional context must have personally become aware of it.
What can a whistleblower report?
The scope of a report is broad, but not unlimited. It covers, in particular, the following:
- a crime or offence, such as corruption or fraud;
- a violation of European Union law, legislation or regulations;
- a threat or serious harm to the public interest, including a serious risk to public health or the environment.
However, certain secrets remain excluded from the whistleblowing framework. Three types of secrecy fall outside the framework: national defence secrecy, medical confidentiality and lawyer-client confidentiality. They cannot be the subject of a protected report. Disclosing such information may result in the loss of protection, or even constitute an offence.
The legal framework: from the Sapin II Law to the Waserman Law
The status of corporate whistleblowers is based on two major pieces of legislation:
- The Sapin Law II of 2016 established the initial foundation for protection. It concerns transparency, the fight against corruption and the modernisation of economic life. It created a general framework applicable to all sectors.
- The Waserman Law of 21 March 2022 transposed European Directive 2019/1937 of 23 October 2019 into French law. This reform broadened the definition, simplified reporting channels and strengthened protection against retaliation.
Since 1 September 2022, whistleblowers can freely choose between an internal report, made to their company, and an external report, made to a competent authority. They are therefore no longer required to alert their employer first before turning to an external authority.
Setting up an effective whistleblowing framework often involves support from corporate governance experts and a compliance consulting firm.. Their role is to turn legal obligations into clear procedures that are easy to apply on a daily basis.
Reporting channels: internal, external, public disclosure
The law provides for three reporting channels, each with its own conditions. The table below summarises them simply.
| Canal | Destinataire | Quand l'utiliser |
|---|---|---|
| Signalement interne | L'employeur ou le référent désigné dans l'entreprise | Voie privilégiée quand un dispositif fiable existe |
| Signalement externe | Le Défenseur des droits, une autorité compétente ou l'autorité judiciaire | Directement possible, sans passage interne préalable |
| Divulgation publique | La presse, les médias, les réseaux sociaux | En dernier recours, sous conditions strictes |
- Good to know: public disclosure should remain exceptional. If used indiscriminately, it may result in the loss of protection.
Strong protection against retaliation
This is the core of the framework. A whistleblower cannot be subjected to any retaliatory measure for making a report in good faith.. Dismissal, disciplinary action, non-renewal of a contract, discriminatory measures: any such act is automatically void. The employee may then bring the matter before the labour court.
The law goes even further. The burden of proof is adjusted in favour of the whistleblower. They only need to provide evidence suggesting a link between the report and the adverse measure. It is then up to the employer to prove otherwise. Confidentiality of the whistleblower’s identity is also guaranteed, as is immunity from criminal and civil liability when the procedure is followed.
This protection also extends to facilitators, meaning relatives and colleagues who assist with the report.
Employer obligations: the internal whistleblowing framework
Any company with at least 50 employees must put in place an internal procedure for receiving and handling reports. It is often referred to as a “whistleblowing framework”. This channel must be secure, confidential and permanently accessible. It must allow written or oral reports to be submitted. An acknowledgement of receipt is sent to the whistleblower, and the report must be handled within a reasonable timeframe, in principle less than three months.
Obstructing a report is not without consequences. The offence of obstruction is subject to criminal penalties. Beyond the legal requirements, putting a reliable framework in place is simply good management practice. Without internal trust, an employee may sometimes prefer to contact an external authority directly, or even the press.
Is your whistleblowing framework really reliable?
Why is it important to properly manage whistleblowing?
The figures speak for themselves. According to the Ethical Climate Barometer, 84% of employees say they would be willing to raise an alert if they witnessed an ethical issue. Yet only slightly more than one employee in two knows that an internal framework exists in their company. Furthermore, in 2025, only 64% of employees believe that their report would be handled impartially.
This lack of trust is a risk.. A well-designed whistleblowing framework:
- Detects misconduct at an early stage
- Protects reputation
- Reassures business partners.
More and more contracting authorities also require compliance guarantees in their calls for tender. Turning a legal obligation into a lever for trust: this is precisely where the support of a specialist consulting firm becomes valuable. To structure a tailor-made approach, discover Eterra’s expertise, at the intersection of governance and compliance.
A corporate whistleblower is a person protected by a precise legal framework, based on good faith and the public interest. For employers, the question is no longer whether to act, but how to do so effectively. A clear, confidential and well-communicated framework protects both employees and the organisation itself.
YOUR QUESTIONS
FAQ – Corporate whistleblowing
Before contacting us, you may have these questions. Here are direct answers from our senior consultants.
—
Who can have whistleblower status in a company?
Only a natural person can have this status, never a company. They must act in good faith, without seeking personal gain, and report serious or unlawful facts of which they have personally become aware.
What facts can a whistleblower report?
They can report a crime or offence such as corruption, a violation of European or national law, or a serious threat to the public interest, public health or the environment. However, national defence secrecy, medical confidentiality and lawyer-client confidentiality remain excluded from this framework.
Does an employee have to alert their employer first before contacting an external authority?
No. Since 1 September 2022, the Waserman Law allows whistleblowers to freely choose between an internal report and an external report to a competent authority, without being required to go through the company first.
What protections does the law grant to whistleblowers?
Any retaliatory measure, such as dismissal or disciplinary action, is automatically void. The burden of proof is adjusted in their favour, their identity remains confidential, and they benefit from immunity from criminal and civil liability when the procedure is followed. This protection also extends to relatives and colleagues who assist them.
