Belgium's whistleblower protection law, the Act of 28 November 2022
The Act of 28 November 2022 protects whistleblowers in Belgium's private sector. It brings the EU directive 2019/1937 into Belgian law. It has been in force since 15 February 2023. A second law, of 8 December 2022, covers the federal public sector. This article looks at the text for companies. Here is who is protected, which firms must act, and the penalties.
Key takeaways
- The duty applies to private companies with at least 50 workers. For those with 50 to 249 workers, it has applied since 17 December 2023.
- The scope runs from public procurement to data protection, and Belgium added tax fraud and social fraud.
- There are three reporting routes. The external route runs through the Federal Ombudsman, who acts as the coordinator for the private sector.
- Reprisals are banned, and the burden of proof falls on the employer. Payouts run from 18 to 26 weeks of salary.
- Block a report or retaliate, and you face six months to three years in prison and a fine of 600 to 6,000 euros.
What is Belgium's whistleblower law?
Belgium turned the directive into law through two acts. The Act of 28 November 2022 covers the private sector. The law of 8 December 2022 covers the federal public sector. Both set up the same things. They ask for reporting channels, a clear follow-up, and protection from reprisals. A private company falls under the first one.
The text is a matter of public order. You cannot waive it. A contract, a work rule, or a collective agreement makes no difference. Any clause that strips a whistleblower of these rights is void. The law sets a floor, and a company cannot go below it.
Who is protected by the law?
Protection reaches beyond the employee. Under article 6, it covers anyone who learns of a breach at work. We explain the term in our article on who is a whistleblower. The law names in particular:
- workers, former employees, and job candidates;
- self-employed people, shareholders, and members of a management or oversight board;
- volunteers and trainees, paid or unpaid;
- people working under the direction of contractors and suppliers.
The circle around them is covered too. It reaches facilitators. It also covers colleagues and relatives who face reprisals, and companies linked to the whistleblower. Good faith stays the core test. They had to have good reason to believe, at the time, that the information was true.
What breaches can you report?
The law covers a wide list of fields. You can report a breach of Belgian or EU rules in any of these:
- public procurement;
- financial services, products and markets, and the fight against money laundering;
- product safety and compliance;
- transport safety;
- protection of the environment;
- radiation protection and nuclear safety;
- food and feed safety, and animal health and welfare;
- public health;
- consumer protection;
- privacy and personal data, and the security of networks and systems.
Belgium added two fields of its own. The law also covers reports about tax fraud and social fraud. On top of that, it covers breaches that harm the EU's financial interests, and breaches of the single market rules, including competition and state aid.
Some secrets stay outside the law. It does not cover state secrets, medical secrecy, a lawyer's privilege, or the secrecy of court deliberations. For everything else, the report is protected once the conditions are met.
Which companies must set up an internal channel?
The duty starts at 50 workers. Every private company with at least 50 workers must set up an internal channel. Firms with fewer than 50 workers are exempt. Regulated finance is the exception. It is covered whatever its size.
"Private-sector legal entities shall establish channels and procedures for internal reporting [...]. Paragraph 1 does not apply to entities with fewer than fifty workers."
Article 11 of the Act of 28 November 2022
The start dates were staggered. Companies with more than 250 workers had to act from 15 February 2023. Those with 50 to 249 workers had until 17 December 2023. One practical point on anonymous reports: a company with fewer than 250 workers does not have to accept them on the internal channel. The Federal Ombudsman and the named authorities still must. And if someone reports anonymously, is identified later, and then faces reprisals, the protection still applies. A 2024 amendment also changed how you count the fifty. You now use the average number of workers across the year.
How do you set up the internal reporting channel?
You consult the social partners first. The law has you set up the channel and its procedures only after that consultation. The channel must keep the reporter's name secret, along with the people named and any third parties. It accepts written and oral reports, and an in-person meeting on request. You can run it in-house or hand it to an outside provider.
"an acknowledgement of receipt [...] within seven days [...] a reasonable period to provide feedback, not exceeding three months."
Article 12 of the Act of 28 November 2022
The law sets two clear deadlines. You confirm the report within seven days. You appoint an impartial report manager, who keeps in touch with them. You give feedback within a maximum of three months.
Two more duties come with the channel. You handle the personal data under the GDPR, and you drop anything that is not relevant to the report. You also keep a register of the reports you receive. A company with fewer than 250 workers may share these resources with others, for example across a group.
Wemoral is confidential whistleblowing software compliant with the Act of 28 November 2022. It takes in reports, sends the seven-day confirmation, and lets the report manager reply inside the three-month deadline, with nothing built in-house. It ships with a policy template and a guide to set up the reporting channel.
What are the three reporting routes?
The law opens three routes for the same report:
| Route | To whom | When |
|---|---|---|
| Internal channel | To the company's report manager | When the breach can be handled in-house without a risk of retaliation |
| External channel | To the Federal Ombudsman, coordinator for the private sector, or to the named authority | Directly, or after an internal report that went nowhere |
| Public disclosure | To the public, for example to the media | In case of imminent danger to the public interest, a risk of retaliation, or inaction after an external report |
The external channel is centralized. Belgium gave this task to the Federal Ombudsman. The Ombudsman receives external reports, checks if they are valid, and sends them on to the named authority. The authority confirms within seven days. It then gives feedback within three months, or within six months in a well-justified case.
"The Federal Ombudsmen [...] are responsible for coordinating external reports in the private sector."
Article 18 of the Act of 28 November 2022
An institute supports the whistleblower. The Federal Institute for the Protection and Promotion of Human Rights acts as the central information point. It delivers the support measures. These cover free, independent advice, legal aid, counselling and, where needed, financial help during a case.
How is the whistleblower protected from reprisals?
The law bans fifteen forms of reprisal. It covers dismissal, suspension, and demotion. It covers a refused promotion, a pay cut, and a poor appraisal. It also covers bullying, harassment, exclusion, blacklisting, and harm to reputation. A threat or an attempt to retaliate is banned as well.
The burden of proof is reversed. Once the whistleblower shows that they reported and suffered harm, that harm is presumed to be a reprisal. Then the employer must show that the decision had nothing to do with the report.
"Any person who is the victim of retaliation [...] is entitled to claim damages [...]. This compensation is set at between 18 and 26 weeks of salary."
Article 27 of the Act of 28 November 2022
A fast protection route exists. A whistleblower who feels threatened can file a reasoned complaint with the Federal Ombudsman. The employer then has four weeks to show that the measure has nothing to do with the report. The coordinator issues a recommendation. The whistleblower also keeps the right to go to the labour court.
A good-faith report carries no liability. The whistleblower cannot be sued or prosecuted for the report, or for breaking a confidentiality clause to make it. The shield holds in claims for defamation, copyright, broken secrecy, data rules, and trade secrets. They are also safe for accessing the information they report, as long as getting it was not a crime in itself.
The person named in a report is protected too. Their identity stays confidential while the investigation runs, and the usual rights of defence apply. The law shields the reporter without dropping the rights of the accused.
What penalties does the law set?
The law separates the company's failures from attacks on the whistleblower:
| Failure | Penalty |
|---|---|
| Failing to set up the internal channel or keep the register of reports | Level-4 sanction under the Social Criminal Code |
| Obstructing a report, retaliating, bringing abusive proceedings, or breaching confidentiality | Six months to three years in prison and a fine of 600 to 6,000 euros |
| Knowingly reporting false information | Prosecution under articles 443 to 450 of the Criminal Code, plus damages |
The level-4 sanction is the heaviest band in the Social Criminal Code. It can be a criminal fine or an administrative fine. The fine is counted per worker concerned, so it adds up fast for a mid-sized company.
Belgium's law has applied in full since 17 December 2023. A company with more than 50 workers should already have an internal channel. If it does not, the risk grows with every report received outside the framework. To place Belgium among its neighbours, see our list of whistleblower laws by country.
Legal advisor specializing in business, commercial and IP law. Writes on whistleblower legislation, the EU Directive, and implementing reporting procedures.