Swedish whistleblower protection law "Lag 2021:890"

Lag (2021:890) is Sweden's whistleblower protection law. People call it the visselblåsarlagen. It took effect on 17 December 2021. It replaced a narrower 2016 law and put EU Directive 2019/1937 into Swedish law. Below we cover who it protects, what employers must set up, and how it is enforced.

What is Lag (2021:890)?

Lag (2021:890) is Sweden's version of the EU Whistleblower Directive. Its full name is the Act on the protection of persons who report wrongdoing. The Ministry of Employment drafted it. It came into force on 17 December 2021. The same day, it scrapped the older law from 2016, which only shielded workers who raised serious wrongdoing from reprisals.

The new act is wider. It covers more people, more types of report, and three clear reporting routes. It also sets one test that runs through the whole law: the wrongdoing must matter to the public, not just to the person who reports it.

"This Act applies to the reporting, in a work-related context, of information about wrongdoing that there is a public interest in being brought to light."
Chapter 1, Section 2 of Lag (2021:890)

Who is protected?

The law protects far more than the salaried employee. It also reaches job applicants, volunteers, trainees, and the self-employed. It covers people who sit on a company's board and shareholders who are active in the business. The cover holds before a job starts, during the work, and after it ends.

The shield also reaches the people around the reporter:

• someone who helps with the report, such as a union rep or safety officer;
• a colleague or relative tied to the reporter;
• a company the reporter owns, works for, or is otherwise linked to.

One thing sets Sweden apart. The report must concern a public interest. A private gripe about your own pay or your own contract is not whistleblowing. The wrongdoing has to be something the wider public would want to know.

What can you report?

You can report wrongdoing you learn about at work when there is a public interest in it coming out. On top of that, you can report acts that break EU law in the directive's fields, such as public procurement, financial services, money laundering, product safety, the environment, and data protection.

Some matters sit outside the law. It does not cover security-classified information. It also leaves out reports about national security at defence and security agencies. And it does not cut into the wider free-speech rights that Swedish workers already hold.

How do the three reporting routes work?

The act sets three routes: an internal channel, an external channel at a public authority, and public disclosure. A worker is free to report internally first. The external route and going public are protected too, but each comes with its own conditions.

You keep protection when you report externally if the internal route failed, if there is a serious danger to life, health, safety, or the environment, or if an internal report would risk reprisals. The same logic guards a worker who finally goes public, for example to the press.

One condition runs through all three routes. At the time of the report, the worker must have had reasonable grounds to believe the information was true. An honest mistake is still covered. A report the worker knows is false is not.

What is the ansvarsfrihet immunity?

Sweden builds in a strong shield called ansvarsfrihet, or freedom from liability. A reporter who breaks a duty of confidentiality cannot be held liable, as long as they had good reason to think the report was needed to reveal the wrongdoing. The same protection covers the act of gathering the information.

"A reporting person may not be held liable for breaching a duty of confidentiality, provided that, at the time of reporting, the person had reasonable grounds to believe that reporting the information was necessary to reveal the wrongdoing."
Chapter 2, Section 1 of Lag (2021:890)

The immunity has limits. It does not let a reporter hand over physical documents. It does not cover the wilful breach of certain secrecy rules, such as those that protect national defence. And it falls away if the reporter commits a crime while gathering the information.

How are whistleblowers protected from reprisals?

An employer may not hinder a report or try to. An employer may not take reprisals because of a report. That ban protects the reporter, the people who help them, their colleagues and relatives, and any company linked to them. It also protects a worker who turns to their union for advice.

The act puts real teeth behind the ban. An employer who breaks it must pay damages, both for the loss caused and for the violation itself. Disputes run under the labour-court rules. A clause that forces the dispute into private arbitration cannot be used. In fact, any agreement that removes or narrows a person's rights under the act is void. Best of all for the reporter, the burden of proof flips.

"If a person who considers that they have been hindered from reporting, subjected to an attempt to hinder reporting, or subjected to reprisals contrary to this Act shows circumstances giving reason to assume that this is so, it is for the defendant to show that no such measures were taken."
Chapter 3, Section 5 of Lag (2021:890)

So the worker does not have to prove the employer's motive. They only have to show facts that point to reprisal. Then it is the employer who must prove the act had nothing to do with the report.

How do you set up the internal reporting channel?

An employer with 50 or more workers must run an internal channel. The count is taken at the start of each calendar year. The duty arrived in two waves. Public bodies and larger private firms had to be ready by 17 July 2022. Private firms with 50 to 249 workers got until 17 December 2023.

You must name independent people or a unit to receive reports, follow them up, and give feedback. Those people can be your own staff or an outside provider you hire. The channel has to take both written and spoken reports, and a meeting in person on request. It must confirm receipt within seven days and give feedback within three months.

WeMoral gives you a tamper-evident, hosted whistleblowing software that fits the Swedish act. Chapter 5 asks you to name independent people or a unit who alone may handle reports, and it lets you pass that work to an outside provider. WeMoral steps in as that provider, or your own named handler signs in instead. Each report is sealed so only that handler can open it, and every action is logged with a time stamp, which is exactly what you want on hand the day the Work Environment Authority asks how your channel runs. Municipalities and firms of 50 to 249 staff may share one setup, and WeMoral fits that shared model too. You can get a reporting channel running without writing any code.

Smaller bodies got room to share. Private firms with 50 to 249 workers can share one channel and the staff who run it. Municipalities can share with each other and with municipal companies. A collective agreement signed by a central union can also adjust the internal-channel rules, as long as it keeps the rights the directive grants.

Who runs the external channel?

The government names competent authorities to run external channels in their own fields. A worker can report to the right authority, and it must take the report, follow it up, and give feedback. These authorities keep the same confidentiality the internal channel must.

Oversight of the internal-channel duty sits with one body: the Swedish Work Environment Authority (Arbetsmiljöverket). It checks that employers set up channels that meet the law and that they inform staff about them.

How are confidentiality, data, and free speech handled?

Anyone who handles a follow-up case must keep the reporter's identity secret, along with anyone else named in the case. In the public sector, the secrecy rules of the Public Access to Information and Secrecy Act apply instead. A spoken report may only be recorded with the reporter's consent, and they get to check and approve any written record.

The law sets a clear data limit. Personal data in a follow-up case may not be kept longer than two years after the case closes. Access is locked to the people who handle the case, and only to what each of them needs.

Sweden also guards a tradition older than the directive. The act does not touch the constitutional right to pass information to the media for publication, known as meddelarfrihet. So the new reporting channels sit on top of a long-standing freedom, rather than replacing it. Employers must tell staff about this right when they explain the channel.

What are the penalties for getting it wrong?

Sweden does not use a fixed table of fines. Instead, the Work Environment Authority can issue an injunction that orders an employer to fix its channel. That injunction can carry a conditional fine, the vite. The fine only falls due if the employer ignores the order. A worker who suffers a reprisal has a separate right to damages.

The 17 December 2023 deadline has long passed, so every Swedish employer in scope should already have a working channel and a published procedure. Our list of whistleblowing laws by country shows how Sweden lines up with the rest of the EU. What makes the Swedish act stand out is the company it keeps. It layers EU-style channels onto a country that has protected the leaking of information to the press since the 18th century. For an employer, the takeaway is plain. Build a channel that an independent handler can run, keep it confidential, and treat the right to speak out as a feature of the law, not a loophole.