Hungarian whistleblower protection law "2023. évi XXV. törvény"

Act XXV of 2023 is Hungary's whistleblower law. It covers complaints, public-interest disclosures, and the rules for reporting abuses. It brings EU Directive 2019/1937 into Hungarian law. It has applied since 24 July 2023. Two things set it apart. Firms can hand the channel to a special whistleblower-protection lawyer, and the state sets no fine for skipping it.

Who must build an internal reporting system?

The duty starts at 50 people. Any employer with 50 or more workers must set up an internal abuse-reporting system. The count covers everyone in an employment relationship. It is not just full-time staff. This is the same floor the EU Directive draws.

"An employer that employs at least 50 persons under an employment relationship shall set up an internal abuse-reporting system."
Section 18(1), Act XXV of 2023

Some firms must comply at any size. Headcount does not matter in higher-risk fields. The list takes in firms under money-laundering rules. It also covers offshore oil and gas operators, those that report civil aviation events, ship operators, and crowdfunding providers. They need the system even with a few staff.

Smaller firms got more time and a shared option. Employers with 50 to 249 workers had until 17 December 2023 to set up the system. They can also run one system jointly with another firm. That spreads the cost. State and local bodies came under their own timeline. The rules for local councils apply from 1 January 2025.

Three routes a report can travel

Hungary does not rely on one channel. The law builds three separate ways to raise an abuse. Each one has its own keeper. A worker can stay inside the firm. They can go to a watchdog for their sector. Or they can use a public system run by the national Ombudsman.

Ten state bodies run their own systems. The law names them one by one. They include the Hungarian National Bank and the Competition Authority. They also include the Integrity Authority, the data protection authority, the media authority, and the atomic energy authority. Anyone can report to these systems. Each body must review its own steps every three years. It also sends yearly figures to the Ombudsman, who passes a summary to the European Commission.

The Ombudsman runs a public register. The Commissioner for Fundamental Rights operates a protected electronic system for public-interest disclosures. It gives each report a unique number. It then publishes a short, anonymous summary and the report's status for anyone to read. A reporter can ask that their data stay with the Ombudsman alone. The system holds the records for five years, then deletes them.

The whistleblower-protection lawyer, a Hungarian invention

This role exists nowhere else in the EU. A private firm can hire a whistleblower-protection lawyer to take in and handle its reports. The lawyer is an attorney with a tightly drawn brief. The law builds a wall between this person and the firm that pays them. That keeps reports independent.

The rules around the role are strict:

• the lawyer must tell the regional bar of the mandate within 15 days, and the bar lists their details;
• they cannot take the job if they had another tie to the firm in the past 5 years;
• they may be paid by the client only, never by anyone else;
• they send the firm an extract that hides the reporter's name, unless the reporter agrees in writing;
• if a report names a senior officer, they must warn the supervisory board or the owner at once.

The lawyer does more than collect reports. They give the reporter legal advice on how to file. They keep in touch and ask for more detail when a review needs it. On request, they tell the reporter in writing what came of the report. They must also keep these case files apart from their other legal work.

"The mandate of the whistleblower-protection lawyer may be terminated only with justification. The lawful conduct of the whistleblower-protection lawyer may not ground the client's termination of the mandate or its refusal to pay the agreed fee."
Section 50(5), Act XXV of 2023

How do you set up the internal reporting system?

An impartial person or unit has to run it. The employer names someone who acts on their own. They must be free from pressure. The job can instead go to the whistleblower-protection lawyer or another outside firm. Whoever runs it must keep the reporter's name confidential at every stage.

The system has to meet a few clear rules:

• accept reports in writing or by voice, by phone or in person;
• send the reporter an acknowledgement within 7 days;
• look into the report as fast as it can, and within 30 days at the latest;
• extend that only with notice, and never past 3 months in total;
• tell the reporter in writing what was found and what was done.

Oral reports get special care. A worker can call a line or speak in person. The operator then has two choices. They can record the call, but only after they tell the worker. Or they can write up minutes and hand the worker a copy to check and sign. Either way, the law wants a full and accurate record.

WeMoral runs the internal channel for you. It seals each report so only the handler you name can open it. The law lets a private firm pass that work to a whistleblower-protection lawyer or another outside firm. Our role-based whistleblowing software fits that outside-operator role just as well as your own impartial officer. It squares with what 2023. évi XXV. törvény asks of the internal system. The time-stamped record it keeps is the proof you reach for if the employment authority checks how the channel runs. It runs in the browser with nothing to install. So you can open the internal channel in a day.

Who can report, and when can they go public?

The right to report reaches well beyond the payroll. A current worker can use the internal system. So can a former worker and a job applicant whose hiring has begun. The law adds the self-employed, owners, and board members. It also adds people who work for the firm's contractors and suppliers, plus interns and volunteers.

An anonymous report still earns cover. A worker can file without giving their name. If the firm later learns who they are and punishes them, the protection kicks in all the same. The same shield covers anyone who helps the reporter file.

Protection has limits, though. It applies to breaches of the EU laws listed in the act, such as finance, the environment, and public health. It also reaches breaches of EU sanctions. It does not cover classified material. Nor does it cover medical or legal privilege, the secrecy of court rulings, or certain national-security work.

Going public is a last resort, not a free pass. A reporter is protected when they go to the press or the public only in set cases. The official channels were used first and nothing was done in time. Or there is a clear danger to the public, such as a risk of harm that cannot be undone. Or the reporter has fair reason to fear payback or a cover-up.

What protection does a reporter get?

Payback for a lawful report is banned outright. Any step that hurts the reporter, taken because of the report, is unlawful. That holds even when the same step would be lawful in any other setting. The one carve-out is the reporter who knowingly lies.

"Every disadvantageous measure that is taken against the reporter because of the report shall be unlawful, even if it would otherwise be lawful."
Section 41(1), Act XXV of 2023

The banned list is long and concrete. It covers dismissal, suspension, demotion, and a refused promotion. It also covers a pay cut, a transfer, denied training, and a bad review. Coercion, harassment, freeze-outs, and blacklisting are on it too. So is harm to the reporter's name or wallet. Even the threat of these counts.

The reporter does not carry the burden of proof. First they show the report was lawful and that they were harmed. The law then presumes the harm was payback. The other side has to prove it acted for a fair reason of its own.

"The person who took the disadvantageous measure shall bear the burden of proving that the measure was taken on well-founded grounds and not because of the lawful report."
Section 41(3), Act XXV of 2023

Protection reaches further than the worker. The law shields the content of the report. It frees the reporter from liability for sharing it. It offers state legal aid. It also guards people around the reporter. A colleague or a relative who could be punished in their place is covered too. A contract or policy that tries to sign these rights away cannot be relied on in court.

What if an employer ignores the law?

The law leaves an odd gap. The employment authority checks whether firms meet the internal-system duty. Yet the law takes away its sharpest tools. For a breach of these rules, it may not impose a fine. It may not ban the firm from its activity either. Most EU states set fine ceilings in the hundreds of thousands. Hungary sets none for this duty.

Private claims do the real work here. A worker who is punished can have the measure undone. They can also claim for the harm, helped by the reversed burden of proof. The balance cuts both ways. A person who reports in bad faith, with data they know to be false, loses all protection. Their details can then be handed to the authorities.

Hungary built one of the more elaborate setups in Europe. It gave firms a bespoke lawyer to lean on. It gave the public an open register at the Ombudsman. Then it chose not to put a fine behind the core duty. So the weight falls on the worker who comes forward. It also falls on whether the courts make the ban on payback bite. To see how this fits the wider picture, browse our list of whistleblowing laws by country.