Normativa
Whistleblowing under Legislative Decree 24/2023: internal channel, thresholds, penalties
Legislative Decree 24/2023 brought whistleblowing obligations together for organisations above 50 staff. Protected internal channel, designated case manager, protection of the reporting person, penalties of up to €50,000.
Who is covered
Private companies with at least 50 employees in the past year, whatever their sector. A lower threshold (any size) applies to entities in the financial, healthcare, environmental and anti-money-laundering sectors and to public administration.
Channel requirements
The internal channel must:
- Guarantee the confidentiality of the reporting person’s identity (end-to-end encryption, access logging).
- Accept written and oral reports (including in person, if requested).
- Respond within 7 days (acknowledgement) and 3 months (outcome).
- Allow anonymous reporting as an alternative to identified reporting.
- Retain reports for no more than 5 years after the case is closed.
Roles
- Case manager: an internal or external person or office so designated (it may be the OdV (supervisory body), internal audit or the DPO, provided there is no conflict).
- Employer: appoints, provides resources, does not intervene in individual reports.
- ANAC: supervision, alternative external channel, penalties.
Penalties
- Failure to set up a channel: from €10,000 to €50,000.
- Established retaliation against a reporting person: from €10,000 to €50,000.
- Failure to handle a report: from €10,000 to €50,000.
A common mistake
Using a generic whistleblowing@company.it mailbox: it breaches confidentiality, because the company’s IT staff have access to it. What is needed is a dedicated platform with encryption and audit logs.
The Forgest solution
We provide a compliant reporting channel, training for case managers and external handling of reports with reporting to senior management. Set up in 5 working days.
Training for channel case managers: Legislative Decree 24/2023 requires the managers of the internal channel to be trained in the confidential handling of reports and in data protection. The recommended path combines the basic privacy and GDPR course with the course for persons authorised to process personal data for those who access reporting persons’ data.
Tag