Croatian whistleblower protection law "NN 46/2022"

Croatia protects whistleblowers under a law with a plain name. The Act on the Protection of Reporters of Irregularities (NN 46/2022) sends outside reports to the People's Ombudsman. It lets workers pick the person who hears reports inside a firm. And since a 2025 reform, it can fine a company up to 100,000 euros. Here is how the rules work.

Who does the law protect, and what counts as an irregularity?

The law shields anyone who reports an irregularity they learn about at work. An irregularity is an unlawful act or omission tied to the fields the law lists. That starts with breaches of EU law, from public procurement and financial services to product safety, the environment, and data protection. But Croatia went wider than the Directive asks. It also covers breaches of national rules that put the public interest at risk.

"This Act lays down protection for persons who report irregularities ... relating to other provisions of national law where such a breach also endangers the public interest."
Article 4(1)(d) of the Act on the Protection of Reporters of Irregularities

Protection reaches a long list of people. It covers employees and the self-employed. It covers shareholders, board members, volunteers, and trainees, paid or not. It reaches contractors, subcontractors, and suppliers. It even covers a job applicant who learned of a breach while being hired, and a worker whose contract has already ended. Helpers and relatives are protected too, since they can face revenge for someone else's report.

The law uses its own word for the reporter. In Croatian they are a prijavitelj nepravilnosti, a reporter of irregularities, not the slang "zviždač". The report must spring from a work setting, the kind of place where the person could face revenge for speaking up. A few matters sit outside the law, such as classified information, legal privilege, medical confidentiality, and the rules of criminal procedure.

Who must set up an internal reporting system?

The duty falls on every public body. It also falls on private firms with 50 or more workers. Size does not matter in some fields. A firm in finance, anti-money-laundering, transport safety, or another listed EU area must build a channel whatever its headcount. Smaller firms may run one by choice. So the 50-worker line is the main trigger, but the listed sectors override it.

The law shares the load where it can. Private firms with 50 to 249 staff may pool resources. They can name one confidential person to receive reports for the group. Municipalities may share in the same way. The first employers had to move fast. The Act took effect on 23 April 2022. A firm had two months to adopt its reporting rules, and three months to name a confidential person.

How do you set up the internal channel and name the confidential person?

The heart of the in-house system is the confidential person (povjerljiva osoba). They receive each report, talk to the whistleblower, and run the steps that keep the reporter safe. The twist is who picks them. Workers do. The employer names the confidential person on the proposal of the works council, a union, or at least 20% of staff.

"The employer shall appoint a confidential person and a deputy ... on the proposal of the works council ... or of at least 20% of the workers employed by the employer."
Article 20 of the Act on the Protection of Reporters of Irregularities

The choice is not the employer's alone. The confidential person and the deputy must give written consent. The employer may not lean on them or steer how they handle a report. Only if the workforce puts forward no name does the employer pick on its own. Once a report lands, the clock starts. The confidential person must confirm receipt within 7 days. They must give the reporter feedback as a rule within 30 days, and never later than 90.

WeMoral seats the confidential person your workers nominate behind one encrypted inbox, and only that person can open a report. It keeps the running record Article 18 calls for, with every entry time-stamped. The tool holds to Croatia's whistleblower law and ships as ready-to-run whistleblowing software, so there is nothing to build. The Act also lets a firm name an outside person as its confidential handler, and WeMoral can fill that seat. When the Ombudsman reviews a case, that time-stamped record is the file you reach for. You can stand up the in-house channel in a day.

What happens when you report to the Ombudsman?

The outside route runs through one office. Croatia named the People's Ombudsman (pučki pravobranitelj) as the authority for external reports. A whistleblower can go there after the internal channel, or head straight to it. The Ombudsman confirms receipt within 7 days. It looks into claims of revenge, forwards the matter to the body that can act on it, and keeps the reporter's name out of that hand-off. You can read the channel rules on the Ombudsman's own site.

The 2025 reform widened the front door. Before it, a report made straight to the police or the State Attorney's Office (DORH) sat in a grey zone. The amended law is clear. A person who reports an irregularity directly to those authorities now gets the same protection as one who goes to the Ombudsman. The reform also stretched the law's reach over economic crime, bribery, and embezzlement, and aligned it with newer EU acts.

Going public is the last resort, and the law fences it in. A whistleblower keeps protection for a public disclosure in only a few cases. The first is when the internal or external route failed to act in time. There may also be an immediate danger to the public interest. Or the reporter has good reason to fear revenge, or to doubt an external report would help.

What protection do whistleblowers get?

The law bans revenge outright. An employer may not retaliate, try to, or threaten to, against a whistleblower, their helpers, or the confidential person. The law spells out fifteen forms of payback. They run from dismissal and demotion to a pay cut, a forced transfer, a bad reference, a pulled licence, and even an order to take a psychiatric exam.

"The employer must not retaliate, attempt to retaliate, or threaten retaliation against the whistleblower, related persons, or the confidential person and their deputy."
Article 9 of the Act on the Protection of Reporters of Irregularities

The shield comes with real support. A whistleblower has a right to keep their identity secret. Only the handler may see the name, and the law allows disclosure only when a court or investigation demands it, with notice first. The reporter also has a right to free primary legal aid and to emotional support, a help the statute names in its own right. Damages round out the list.

Going to court and the remedies

A whistleblower who is punished can sue in a fast-tracked action, and they pay no court fees. They can ask the court to stop the revenge, undo its effects, and award damages. The court can even order its judgment published in the media at the employer's expense. The law also tilts the case toward the reporter, since it presumes the harm came from the report.

"It is presumed that the harm resulted from retaliation ... the person who took the action or omission must prove that it was based on justified grounds."
Article 31 of the Act on the Protection of Reporters of Irregularities

The court can act fast on an interim order, within eight days of the request. The 2025 reform tightened the wider timeline too. It set a 15-day window to respond to a suit and a six-month target to finish a first-instance case. The Ombudsman, or a group that fights corruption, may join the case on the worker's side, but only with the whistleblower's consent.

What does breaking the law cost?

The price of breaking the law climbed sharply in 2025. The original 2022 text capped fines in kuna at about 6,600 euros. The reform recast the fines in euro and lifted the ceiling to 100,000 euros for a company. The Ombudsman can bring the charge. The figures below come from the current text of the law.

For three years Croatia's law carried a fine a large firm could treat as a rounding error. The 2025 reform changed the maths. A company that unmasks a whistleblower or pushes one out now risks 100,000 euros. The other half of the design draws less notice, yet it may say more. The person who hears reports inside a Croatian firm is not the employer's pick. The workforce puts forward the name. A law that hands that choice to the staff is betting that trust in a channel starts with who sits on the other end of it. To see how Croatia lines up with the rest of the bloc, our list of whistleblowing laws by country sets them side by side.