The Finnish Whistleblower Protection Act in practice: what does a company’s reporting channel need?

This obligation is not new. Finland’s Whistleblower Protection Act entered into force at the beginning of 2023, and the transition period for private-sector organisations with 50–249 employees ended on 17 December 2023. If a channel is still missing, the task is to meet an obligation already in force, rather than prepare for a future deadline. [1, section 40; 2, Article 26]

This article explains the main requirements of Finnish law and EU rules, and what they mean in day-to-day business. It focuses on companies in Finland. Public-sector organisations and industries subject to specific regulation have additional rules to consider.

At a glance: what does a company need to do?

• Check whether a channel is mandatory. An internal channel is generally required when there are regularly at least 50 employees. Industry-specific exceptions need a separate assessment.
• Appoint independent handlers. Agree on a deputy and on who handles reports concerning management.
• Track the deadlines. Acknowledge receipt within seven days and provide information on follow-up within three months. Finnish law makes an exception for anonymous reports.
• Give staff clear instructions. Explain the internal channel, the route to the authorities and the conditions for protection. Also brief supervisors on reports received through the wrong route.
• Register reports and restrict access. Recording an oral report requires the reporting person’s consent.
• Agree on deletion. The starting point is five years from receipt of the report, but unnecessary personal data must be deleted earlier. Grounds specified in the Act may require longer retention.

The obligations and their exceptions are explained below, with references to the sources.

The EU Directive laid the foundation; Finnish law defines the national obligations

The rules originate in Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law, often called the Whistleblower Directive. Its purpose is to protect people who learn about unlawful activity in a work-related context and report it appropriately. [2, Articles 1 and 4]

Finland implemented the Directive through Act 1171/2022. Its full name translates as the Act on the Protection of Persons Reporting Breaches of European Union and National Law. In everyday use, the Finnish Whistleblower Protection Act is sufficient. [1, section 1]

The distinction between the Directive and national law matters. The Directive sets EU-level requirements for Member States. A company operating in Finland must assess its practical obligations primarily against Finnish law and any applicable industry-specific rules. The EU General Data Protection Regulation, or GDPR, also applies to the processing of personal data. [1, section 3; 3]

The Act does not require buying software from a particular supplier. It requires a functioning reporting channel, proper handling and protection for the reporting person. Software should make those requirements easier to meet.

Who must establish an internal reporting channel?

Under section 10 of the Finnish Act, the organisations listed in that section must establish an internal reporting channel if they regularly have at least 50 people in an employment or public-service relationship. For an ordinary private company, the 50-employee threshold is the central starting point. The obligation also covers other organisations defined in the Act, not only limited liability companies. [1, section 10]

The word “regularly” matters. If staffing levels fluctuate, a single day’s staff list is a poor basis for assessing the obligation. The assessment must consider the organisation’s actual operations and the applicable rules.

Having fewer than 50 employees is not a universal exemption from all reporting-channel obligations. Section 10 imposes an obligation on certain institutions for occupational retirement provision regardless of staffing levels, and industry-specific regulation may impose other obligations on smaller organisations. [1, sections 3 and 10]

A smaller company can also establish a channel voluntarily. There is an important distinction from an ordinary feedback form: if a voluntary internal channel is established for reporting breaches within the Act’s scope, the Act’s provisions apply to the channel, reporting and protection of the reporting person. Voluntary adoption therefore does not mean informal handling. [1, section 13]

A company must allow its own employees to use the internal channel. It can also open the channel to others, such as subcontractors and business partners. The instructions should explain this clearly. [1, section 10]

Can a corporate group share a channel?

Under Finnish law, companies in the same group can share an internal reporting channel. Private organisations referred to in section 10(1), points 5–6, with no more than 249 people can also share resources for receiving and investigating reports. A shared handler or system does not, however, remove each organisation’s obligation to provide feedback, address breaches and maintain confidentiality. An international group must also check the requirements in its other countries of operation. [1, section 12]

What can be reported through the channel?

The Finnish Whistleblower Protection Act does not automatically cover every workplace problem or every unlawful act. Its scope is defined separately in the Act. It covers breaches concerning, among other things, public procurement, financial services, prevention of money laundering, product safety, environmental protection, food safety, consumer protection, and protection of personal data and information systems. [1, section 2; 2, Article 2]

The nature of the breach also matters. In the areas listed in section 2(1), the Act covers acts or omissions that are punishable offences, may result in a punitive administrative sanction, or may seriously endanger the achievement of legislation’s objectives in the public interest. These are three alternative conditions: at least one must be met. The scope also includes separate provisions on matters such as the EU’s financial interests, competition rules and corporate taxation. The current Act also includes a provision on breaches of sanctions. [1, section 2]

A practical example could be an employee noticing that product safety defects are being concealed or that personal data is systematically handled contrary to the rules. These may be matters for the channel, but whether each report falls within the Act depends on its content.

Dissatisfaction with a shift schedule or an individual disagreement with a supervisor does not, by itself, make a report subject to the Whistleblower Protection Act. The matter may still be important and require attention from human resources or occupational safety staff, for example.

The same service can also receive general feedback. In that case, users must be told what constitutes a statutory report and what is other feedback. The form’s name or the category selected by the user does not alone determine whether the Act applies: the report’s content is decisive.

Who does the Act protect, and on what conditions?

Protection is not limited to current employees. Subject to specified conditions, the Act’s personal scope includes, for example, self-employed people, shareholders, members of administrative bodies, trainees and volunteers. Protection can also cover someone whose work has ended or someone who obtained the information during negotiations preceding work. [1, section 5; 2, Article 4]

A central condition is that, at the time of reporting, the reporting person has reasonable grounds to believe that the information is true and falls within the Act’s scope. They do not have to complete an investigation or conclusively prove a breach before reporting it. A person who deliberately reports false information may have to compensate the person concerned for the financial loss caused. Under section 36, deliberately reporting or publicly disclosing false information is also punishable by a fine, unless the act is minor or a more severe penalty is provided elsewhere in law. This differs from a reasonable suspicion that later turns out to be unfounded. [1, sections 6, 26 and 36; 2, Article 6]

Company instructions should ask the reporting person to describe concretely what they observed, when, and what the observation is based on. They should also distinguish their own observations from assumptions and information heard from others. This helps the handler investigate without expecting an employee to deliver a finished investigation report.

What needs to be agreed on when handling reports?

A form on a website is not enough if nobody is responsible for the reports it receives. The organisation, or the outsourced service provider responsible for arranging the channel, must appoint one or more people to handle reports. They must be able to perform their duties impartially and independently, and only people appointed to this task may handle reports. [1, section 14]

Difficult situations also need a practical answer. If a report concerns the usual handler or their immediate supervisor, who takes over? What happens during holidays or a lengthy absence? Agree on deputies and conflicts of interest before the first report arrives.

The channel must allow reporting in writing or orally. Finnish law therefore does not generally require every organisation to acquire both an online form and a telephone service. If oral reporting is available, section 15 sets requirements concerning a telephone or other voice messaging system and, at the reporting person’s request, a meeting in person within a reasonable time. [1, section 15]

The organisation must also provide understandable information about the internal channel, the centralised channel maintained by the Office of the Chancellor of Justice, reporting procedures and the conditions for protection. Instructions must be easily accessible. A link hidden on the intranet without instructions leaves that work unfinished. [1, section 15]

What if a report goes directly to a supervisor?

Reports do not always arrive through the right form. If someone other than an appointed handler receives a report, or it arrives by another route, the recipient must keep confidential information that could reveal the identity of the reporting person or the person concerned. The report must be forwarded promptly, in its original form, to the person responsible for handling it. Supervisors need clear instructions for this; forwarding the message to a broad distribution list is not proper handling. [1, section 32]

How are reports and oral discussions documented?

Reports received must be registered in a case-management register or by other means. Minutes must be prepared for a meeting in person, and the reporting person must be allowed to check and approve them. An oral report may be recorded only with the reporting person’s consent. In practice, consent is requested before recording begins, rather than only when the file is uploaded to the channel. [1, section 37]

Also agree on how acknowledgements, correspondence, investigation steps and decisions are recorded. Handling then does not depend on one employee’s memory or inbox.

Seven days and three months: what do the deadlines mean?

An internal reporting channel has two key deadlines. An acknowledgement of receipt must be sent within seven days of receiving the report. The reporting person must then receive information on the measures being taken in response within three months of the acknowledgement being sent. [1, sections 15–16; 2, Article 9]

If no acknowledgement is sent, the three-month period starts when the seven-day deadline for acknowledgement expires. Failing to acknowledge receipt does not move the feedback deadline further into the future. [1, section 16]

The three-month deadline does not mean every investigation must be finally completed by then. The reporting person must be told about the measures being taken. A complex matter may require a longer investigation, but a receipt acknowledgement alone does not replace this information. The handler also has a duty to take the necessary steps to establish the accuracy of the information and, where necessary, address the breach. [1, section 16]

Finnish law makes an exception for anonymous reports: they do not require an acknowledgement of receipt or the information on measures specified in section 16(2). This exception does not mean an anonymous report can automatically be left uninvestigated. [1, section 17]

If the system supports anonymous two-way communication, acknowledging receipt and explaining follow-up are still sensible practices. The reporting person can add to their observations and see that the matter has not disappeared into a queue.

Anonymity and confidentiality are different things

The Finnish Whistleblower Protection Act does not generally require an internal channel to accept anonymous reports. An organisation can choose to accept them. Requirements for confidentiality and secrecy, however, apply regardless of whether the reporting person gives their name. [1, sections 17 and 32]

In a confidential report, the handler may know the reporting person’s identity but must not disclose it without lawful authority. In an anonymous report, the reporting person does not give their identity. Even so, a description of events or an attachment may itself reveal who made the report.

Confidentiality also covers information from which identity can be inferred directly or indirectly. As provided by the Act, it also protects the identity of the person concerned by the report. A report is the starting point for an investigation, not proof of guilt. [1, section 32; 2, Articles 16 and 22]

Do not promise that identity will never be disclosed to anyone. The Act separately specifies situations where confidential information can be disclosed, for example to investigate the matter or for proceedings before an authority. [1, section 33]

Someone who originally reported anonymously can also receive protection under the Act if they are later identified and the other conditions for protection are met. Subject to specified conditions, protection also extends to people assisting the reporting person, people close to them who risk retaliation because of their work, and legal entities connected to the reporting person. [1, section 5]

Retaliation is prohibited

The core of whistleblower protection is that a person must not be penalised for making a report that meets the Act’s conditions. Prohibited retaliation may include dismissal, temporary layoff, worsening employment terms or other unfavourable treatment because of reporting. The prohibition also covers adverse consequences arising from the reporting person’s participation in investigating the matter they reported. Conduct aimed at preventing reporting is also prohibited. [1, section 23; 2, Article 19]

For an organisation, this concerns supervisors’ day-to-day work as much as the channel’s settings. A promise of confidential handling does little good if the employee who reported the matter is then pressured at work.

The Act includes provisions on matters such as damages, compensation for retaliation and the burden of proof. This is legally binding protection, rather than merely a recommendation for good people management. [1, sections 25–26 and 34]

If the evidence gives grounds to presume that the prohibition on retaliation has been breached, the opposing party must show that it has not. This burden-of-proof rule does not apply in criminal cases. Compensation for retaliation must be claimed in a Finnish district court within three years of the conduct that breached the prohibition on retaliation or prevented reporting; damages have their own time-limit rules. [1, sections 25, 27 and 35]

An agreement that reduces rights or remedies under the Act is void. A non-disclosure agreement therefore cannot remove the protection provided by the Act. Exemption from liability for disclosing information nevertheless requires, among other things, reasonable grounds to believe reporting is necessary to reveal a breach. It does not authorise obtaining information through a criminal offence. [1, sections 24 and 28]

What happens if there is no channel?

The Finnish Whistleblower Protection Act does not impose a separate administrative penalty solely for failing to establish an internal channel. This does not make the channel optional: its absence may give a reporting person grounds to report directly to the authorities. Retaliation may lead to damages and compensation, and the Criminal Code provides a penalty for breaching the duty of confidentiality. Any industry-specific regulation must be assessed separately. [1, sections 3, 8, 10, 26, 34 and 36]

When can a report be made to an authority?

Under Finnish law, using internal reporting first is, as a starting point, a condition for protection, rather than merely a recommendation. Article 7 of the Directive, in turn, requires Member States to encourage internal reporting under certain conditions. The exceptions in section 8 of the Finnish Act are therefore essential: the internal route need not be used in every situation. [1, sections 7–8; 2, Article 7]

Section 8 defines the conditions for reporting to an authority. They include, for example, the absence of an internal channel or the reporting person not being allowed to use it, and reasonable grounds to believe that the measures referred to in section 16 have not been taken following an internal report within the statutory deadline. Reporting to an authority may also be appropriate where the reporting person has reasonable grounds to believe the breach cannot be addressed effectively internally or that they are at risk of retaliation. [1, section 8]

The Office of the Chancellor of Justice maintains a centralised external reporting channel and forwards reports to the competent authorities. Specific regulation may allow reporting directly to the competent authority. The centralised channel does not accept anonymous reports. [1, sections 18–19; 4]

The Office of the Chancellor of Justice sends an acknowledgement within seven days unless a statutory exception applies. The competent authority provides information on the measures taken within three months or, for justified reasons, within a maximum of six months of receiving the report. External-channel deadlines should not be confused with those for a company’s internal channel. [1, sections 19–20]

Public disclosure, for example in the media or on social media, has its own separate conditions for protection. It should not automatically be equated with internal reporting or reporting to an authority. [1, section 9; 2, Article 15]

Data protection: who can see the information, and how long is it retained?

A report can contain highly sensitive information about the reporting person, the suspected breach and other people. Access rights, retention periods and responsibilities for processing personal data therefore need to be settled before the channel is introduced.

The principles in Article 5 of the GDPR include purpose limitation, data minimisation and appropriate protection. Processing must also have a lawful basis under Article 6. Processing through a statutory reporting channel and voluntary general feedback should not be grouped under the same lawful basis without justification. [3, Articles 5–6]

When using an external software service, the customer organisation typically acts as the controller of report data and the service provider as the processor acting on its behalf. Article 28 of the GDPR sets requirements for the processing agreement, and Article 32 covers the security of processing. [3]

The Finnish Whistleblower Protection Act has its own retention rule: information received through the reporting channel must be deleted five years after receipt of the report unless retention is necessary for the rights, obligations or legal claims specified in the Act. Personal data clearly irrelevant to handling the report must be deleted without undue delay. Five years is therefore not permission to retain everything collected just in case. [1, section 29]

Finnish law also has specific rules on processing personal data. Special categories of personal data and data relating to criminal convictions and offences may be processed only where necessary for the Act’s purpose. The right to restriction of processing under Article 18 of the GDPR does not apply to the processing of personal data covered by this Act. [1, sections 30–31]

The right of access under Article 15 of the GDPR can be restricted where necessary and proportionate to investigate the report or protect the reporting person’s identity. This does not authorise rejecting all access requests: information outside the restriction must be provided, and the Act also provides a right to be informed of the reasons for the restriction and to seek assistance from the Data Protection Ombudsman. [1, section 31]

Document the lawful basis for processing and assess the need for a data protection impact assessment before implementation. Under Article 35 of the GDPR, an assessment is required if processing is likely to result in a high risk to people’s rights and freedoms. Buying a service alone does not resolve this for the organisation. [3, Articles 6 and 35]

Storage in the EU is useful information when choosing a service, but it does not by itself demonstrate GDPR compliance. Access rights, service providers’ roles, possible transfers and practical handling procedures must also be assessed.

How Ilmoo supports report handling

Ilmoo brings written reporting, correspondence and handling into one service. The organisation gets its own address, such as yritys.ilmoo.fi, which it can share with staff and other channel users. [5]

A reporting person can submit a report without a user account and anonymously by default. They receive a personal access code that lets them return to follow the matter and communicate with the handler. Anonymity therefore does not prevent follow-up questions or additional information.

Handlers have access to reports, messages, attachments, internal notes and a handling event log. Access roles help restrict who can do what in the service. The organisation must still appoint its own handlers and give them appropriate rights for their duties.

According to the service information, data is stored in the EU. Stored content is encrypted, with end-to-end encryption available as an option. Encryption is one part of protection: it does not remove the need for careful access management or handlers who observe confidentiality. [5]

Ilmoo’s core is a written channel. An audio recording can also be uploaded, but the service does not include a live telephone service. If an organisation offers oral reporting, it must properly arrange the process and any required meetings. Recording an oral report requires the reporting person’s consent; the ability to upload a file does not replace that requirement. [5; 1, sections 15 and 37]

Ilmoo costs €19.90 per month per organisation, excluding VAT. There is no limit on user numbers. The first month is free, and no payment card is required for the trial. Pricing and features were checked against Aigen’s product page on 6 October 2026. [5]

Decisions to make when introducing the channel

The technical channel can be opened quickly. To ensure it also works when the first difficult report arrives, the organisation should address these matters at the same time:

1. Appoint handlers and deputies. Also agree on who handles a report concerning the usual handler or the organisation’s management.
2. Write clear instructions for reporting people. Explain what the channel is for, who can use it, and how the conditions for protection and external reporting work.
3. Decide how anonymous reports are handled. If they are accepted, also agree on acknowledgements, correspondence and follow-up.
4. Agree on the handling workflow. Who checks incoming reports, tracks deadlines, starts investigations and records follow-up? Also provide instructions for forwarding reports received through the wrong route, documenting oral reports and obtaining recording consent.
5. Check personal data processing. Arrange the processing agreement, necessary access rights, data protection information and deletion practices.
6. Test the whole route. Submit a trial report clearly marked as a test, respond to it and make sure the reporting person can find the response. Tell staff where to find the real channel.

Arranging the channel can be outsourced, but responsibility for meeting the Act’s obligations remains with the organisation. Finnish law states this explicitly. [1, section 11]

Ilmoo’s role is therefore to provide the channel and handling tools. The company’s role is to make sure reports receive a response, matters are investigated and people are treated as the law requires.

Try the Ilmoo demo or open a reporting channel for your organisation.

Sources

[1] Finnish Whistleblower Protection Act 1171/2022, current text, including amendment 181/2025 (in force from 20 May 2025). Act on the Protection of Persons Reporting Breaches of European Union and National Law. Sections cited in this article are identified alongside the relevant claims. The linked statutory text is in Finnish. https://www.finlex.fi/fi/lainsaadanto/2022/1171

[2] Directive (EU) 2019/1937. Directive of the European Parliament and of the Council on the protection of persons who report breaches of Union law. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32019L1937

[3] EU General Data Protection Regulation (EU) 2016/679, GDPR. In particular, Article 5 (processing principles), Article 6 (lawfulness), Articles 15 and 18 (data subject rights), Article 28 (processor), Article 32 (security) and Article 35 (impact assessment). https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679

[4] Office of the Chancellor of Justice: whistleblower protection. The linked guidance is in Finnish. https://oikeuskansleri.fi/ilmoittajansuojelu

[5] Aigen: Ilmoo – internal reporting channel. Product features, pricing and allocation of responsibilities. The linked product page is in Finnish. https://aigen.fi/sovellukset/ilmoo/

Legislative and product information checked on 6 October 2026. This article is an overview of a Finnish company’s reporting channel; industry-specific regulation may affect an individual organisation’s obligations.