It is not enough to simply have an email address or a form for reporting serious concerns. For a company covered by the Danish Whistleblower Act, a whistleblower scheme must meet specific requirements regarding organization, confidentiality, case handling, information, documentation, and deadlines. These requirements should therefore form part of the company’s overall compliance framework.
Here, we explain who is covered, the employee threshold, applicable requirements, deadlines, responsibilities, and the consequences of non-compliance.
Are you unsure whether your current whistleblower scheme meets the legal requirements?
Use the checklist in this article to review responsibilities, access, deadlines, and documentation. With the MasterQMS whistleblower system, you can bring reporting and case management together in one secure and user-friendly solution.
When Is a Whistleblower Scheme a Legal Requirement?
As a general rule, private-sector workplaces with 50 or more employees must have an internal whistleblower scheme. The assessment is linked to the individual legal entity with its own CVR number. In group structures, employees should therefore not automatically be added together, nor should it be assumed that a shared scheme automatically fulfils the obligations of each legal entity. Group-wide schemes are permitted, but the legal requirements must still be met.
The number of employees is calculated as the average over the four most recent preceding quarters. All employees are included regardless of working hours, including full-time and part-time employees, fixed-term employees, project employees, and temporary staff. Companies with seasonal fluctuations should monitor the threshold on an ongoing basis.
Example: A company grows from 42 to 58 employees. What matters is not only the number of employees on a specific day, but the average calculated according to the official method.
The original implementation dates are now historical: 17 December 2021 and, for private-sector workplaces with 50–249 employees, 17 December 2023. Today, the focus is on the ongoing obligation to maintain a legally compliant whistleblower scheme. Companies with fewer than 50 employees may, in certain cases, be subject to other or sector-specific regulations.
Fact Box: Is Your Company Covered?
- Does the relevant legal entity have 50 or more employees based on the four-quarter average?
- Do any special sector-specific rules apply?
- Has the number of employees changed significantly?
- Is responsibility assigned to the correct legal entity?
- Is a shared or external whistleblower scheme organized in accordance with the applicable rules?
The fact box is for guidance only. Sector-specific regulations and the specific circumstances of the company may require a separate assessment.
What Requirements Does the Danish Whistleblower Act Set for the Scheme?
The legal requirements for a whistleblower scheme concern both its organization and the handling of reports.
A Clearly Defined Whistleblower Unit
The company must appoint an impartial person or department to act as the whistleblower unit. The unit must receive reports, maintain contact with the whistleblower, follow up diligently, and provide feedback. Responsibilities and resources must be clearly defined, and conflicts of interest must be managed appropriately.
Example: If a case concerns the manager who would normally be involved in handling the matter, the company must be able to transfer the case to an impartial function.
Reporting Options
The scheme must allow reports to be submitted in writing or orally – or both. Three parallel reporting channels are not a general requirement. If the scheme allows oral reporting, the whistleblower must, upon request, be offered an in-person meeting within a reasonable period of time.
Confidentiality and Restricted Access
The identity of the whistleblower, the person concerned, and any third parties mentioned must be protected, and unauthorized persons must not be granted access. Cases should therefore not be stored on ordinary shared drives or in general archives. Confidentiality is a legal requirement; anonymity is not a general requirement for private internal whistleblower schemes, although the company may choose to offer it.
Follow-Up and Feedback
The whistleblower unit must follow up diligently. This may include an initial assessment, an internal investigation, relevant actions, or closure of the case. Feedback consists of information about the follow-up that has been or will be carried out and the reasons for it. Feedback does not constitute final closure of the case, and other legal requirements or considerations relating to the investigation may limit the information that can be provided.
Information for Employees
The company must provide clear and easily accessible information about the internal procedure and relevant external reporting channels. It must be clear who may submit a report, what matters may be reported, and how reports should be submitted.
See also the Danish Whistleblower Act on Retsinformation, guidance from the Ministry of Justice, and the Danish National Whistleblower Scheme.
Registration and Documentation
The establishment of the whistleblower scheme and its procedures must be documented, and reports must be registered. The documentation should cover receipt, follow-up, assessments, decisions, feedback, responsibilities, and access. Information may only be retained for as long as it is necessary and proportionate; there is no single universal retention period that applies to all cases.
Protection Against Retaliation
A whistleblower who meets the legal conditions for protection must not be subjected to retaliation. This may include direct or indirect adverse actions such as dismissal, demotion, or harassment as a result of the report.
Key Deadlines for Whistleblower Reports
Receipt, acknowledgement, follow-up, feedback, further feedback, and case closure are separate stages. The deadlines should therefore not be treated as interchangeable.
| Event | Deadline or timing | Responsibility | What should be documented? |
|---|---|---|---|
| Receipt | When the report is received | Whistleblower Unit | Date of receipt |
| Acknowledgement | No later than 7 days after receipt | Whistleblower Unit | Date and method |
| Follow-up | Ongoing and diligent | Whistleblower Unit | Actions taken and assessments |
| Feedback | As soon as possible and no later than 3 months after acknowledgement | Whistleblower Unit | Content and date |
| Additional feedback | When relevant and possible while the case remains ongoing | Whistleblower Unit | Information about the ongoing process |
| Case closure | Depends on the nature of the case | Relevant responsible function | Reasoning and closure |
Receipt
Acknowledgement
Follow-up
Feedback
Additional feedback
Case closure
Acknowledgement must be sent no later than seven days after receipt. According to guidance from the Ministry of Justice, a report is considered received on the same day it is submitted, regardless of the time of day. The deadline is calculated from the following day, and calendar days are included.
Feedback must be provided as soon as possible and no later than three months from the acknowledgement. If the investigation continues, this does not constitute an automatic extension of the deadline or a general deadline for case closure. The whistleblower must be informed about the follow-up that can be disclosed and about the continued progress of the case. Further feedback should be provided when possible.
Example: If an investigation requires a review of several years of transactions, the company may provide timely feedback on the investigations initiated and the next steps, even if the final conclusion is not yet available.
What Happens If the Company Does Not Comply with the Danish Whistleblower Act?
The consequences depend on the nature of the violation. Fines, compensation, and other legal consequences should be considered separately.
Fines
An employer subject to Section 9 may be fined for failing to comply with the obligations set out in Sections 10–13 and Section 16, including requirements relating to the design of the scheme, the whistleblower unit, follow-up, deadlines, information, and documentation. Legal entities may also be held criminally liable. The Act does not specify one general standard fine.
Compensation for Retaliation
A fine is not the same as compensation. A whistleblower who is subjected to unlawful retaliation may be entitled to compensation. In cases of dismissal, special rules also apply regarding annulment of the dismissal and reinstatement. If the whistleblower can demonstrate that a lawful report was made and that they subsequently suffered a disadvantage, the other party must prove that the disadvantage was not an act of retaliation.
Breaches of Confidentiality and Improper Case Handling
Intentional or grossly negligent breaches of the specific duty of confidentiality may be punishable by a fine. Excessively broad access, unclear allocation of responsibilities, inadequate documentation, insufficient follow-up, missed deadlines, and improper handling of personal data may also create other legal and organizational risks.
A Whistleblower Scheme on Paper Is Not Necessarily Enough
The company should review more than just the reporting channel itself. Responsibilities, impartiality, access, procedures, deadline management, follow-up, feedback, documentation, information, and protection against retaliation should all be considered. These areas can be linked to the company’s broader risk management processes so that weaknesses are identified and addressed systematically.
Who Is Responsible for the Whistleblower Scheme?
The company has overall responsibility. The whistleblower unit is responsible for receiving reports, maintaining contact, carrying out diligent follow-up, and providing feedback. The unit may be internal or external, but impartiality, confidentiality, and restricted access must be ensured. Using an external provider does not remove the company’s responsibility.
This is not solely an IT, HR, or legal responsibility. Management, HR, compliance, and legal functions may have different roles, but the interfaces between them must be clearly defined. A management system can support the management of responsibilities, processes, documentation, and follow-up across the organization.
7 Common Compliance Mistakes Companies Should Avoid
A Clearly Defined Whistleblower Unit
Unclear ownership increases the risk of inadequate follow-up and missed deadlines.
Excessively Broad Access to Reports
Only individuals with a legitimate role should have access to case information.
No Procedure for Managing Deadlines
The company must distinguish between receipt, acknowledgement, follow-up, feedback, and case closure.
Insufficient Information for Employees
The target group must be able to find and understand the procedure, who it applies to, and the scope of the whistleblower scheme.
Inadequate Documentation of Case Handling
Without traceability, it is difficult to document dates, assessments, decisions, and feedback.
Mixing Ordinary HR Complaints with Whistleblower Cases
Not every workplace conflict is a whistleblower case. Conversely, a report should not be dismissed based on the subject matter alone; the assessment depends on the nature of the matter and the scope of the law.
No Procedure for Protection Against Retaliation
The organization’s response after a report has been submitted is also part of the compliance process.
Checklist — Does Your Whistleblower Scheme Meet the Requirements?
Is the responsible legal entity identified?
Have we correctly assessed whether the company is covered by the requirements?
Is the whistleblower unit clearly designated?
Have impartiality, conflicts of interest, competence, and resources been assessed?
Is it clear who is permitted to access whistleblower reports?
Do we have a documented process for receipt, assessment, follow-up, and feedback?
Can we document compliance with the 7-day and 3-month deadlines?
Does the target group know how to submit a report and which matters are covered by the scheme?
Do the procedures protect identity information and other confidential information?
Do we have rules for registration, retention, and deletion?
Do managers and HR know how a potential whistleblower case should be assessed and routed?
Do we prevent and address retaliation, and do we regularly review the procedures, for example through internal audits?
Companies that want to bring reporting, access control, case management, and documentation together in a structured process can read more about the MasterQMS whistleblower system.
Frequently Asked Questions About Whistleblower Schemes and Legal Requirements
When Is a Whistleblower Scheme Mandatory?
As a general rule, private-sector workplaces with 50 or more employees are required to have a whistleblower scheme. Below this threshold, special sector-specific rules or other requirements may still apply.
How Are the 50 Employees Calculated?
As the average number of employees over the four most recent preceding quarters. All employees are included regardless of working hours, including part-time employees, fixed-term employees, project employees, and temporary staff.
At the same time, it strengthens employee ownership and makes the organization more resilient to market changes, as decisions are made based on data and documented standards.
What Is the Deadline for Acknowledging a Report?
No later than seven days after receipt. The guidance states that the deadline is calculated from the day after receipt and that calendar days are included.
How Quickly Must the Whistleblower Receive Feedback?
As soon as possible and no later than three months after the acknowledgement of receipt. This is a deadline for feedback, not a general deadline for closing the case. If the investigation continues, the whistleblower must be kept informed, and further feedback should be provided when possible.
Can a Company Be Fined for Failing to Have a Whistleblower Scheme?
Yes. An employer subject to Section 9 may be fined for failing to comply with the specific obligations set out in Sections 10–13 and Section 16. The Act does not specify one general standard fine.
Must a Whistleblower Be Able to Report Anonymously?
No. Anonymous reporting is not a general legal requirement for private internal whistleblower schemes. Confidentiality, however, is mandatory and protects identity information against unauthorized access and unlawful disclosure.
What Is Retaliation Against a Whistleblower?
Direct or indirect adverse reactions resulting from a protected report that cause or may cause harm to the whistleblower. Examples may include dismissal, demotion, harassment, warnings, or denial of a pay rise.
This article provides general information and does not replace a specific legal assessment.
