Whistle-blower Protection Act
Notification channel
Appropriate responses
Protection of whistle-blowers
Indemnification and compensation

Companies may choose to implement a whistle-blowing channel to gain information about problems in their organisations. In the future, this will no longer be a choice: many companies will be obliged to maintain a whistle-blowing channel. Such companies must also treat notifications seriously and ensure that organisations can both review and, where necessary, respond to detected violations.


The term "whistle-blower" refers to an employee or other person working within an organisation who notifies the public or their company's management team about illegal, immoral or illicit behaviour within the organisation. The whistle-blower might be motivated by a sense of duty and the desire to make things right, or by anger or jealousy – they may wish to reveal the perpetrator in the hopes of a reward or other recognition.

No matter what motivates the whistle-blower, they take a risk by revealing wrongdoings within their organisation and they may be subject to retaliatory measures. The company or its management team may attempt to silence the whistle-blower by threatening to terminate their employment, requiring them to perform unpleasant tasks or even bullying them. Since society in general benefits if wrongdoings are brought to light, the legislature is trying to protect whistle-blowers so that individuals feel confident in reporting wrongdoings they have detected without fear of reprisals.

Whistle-blower Protection Act

The Whistle-blower Protection Act – that is, the law that implements the EU Whistle-blower Directive(1) – finally entered into force on 1 January 2023. Despite usually enacting EU legislation on time, Finland missed the deadline for the implementation of the EU Whistle-blower Directive by over a year. However, the implementation has faltered elsewhere as well – despite its delay, Finland still implemented the EU Whistle-blower Directive quicker than approximately half of the EU member states.

The Whistle-blower Protection Act obliges companies to set up a reporting channel through which employees and other parties working closely with the company can report potential wrongdoings. If the company regularly employs at least 250 employees, the notification channel must be put into use no later than 1 April 2023. For smaller companies, the deadline is 17 December 2023. Companies that regularly employ fewer than 50 people are completely exempt from the application of the law. However, if a company that employs fewer than 50 people introduces or has introduced a notification channel, the channel must meet the requirements set out by the law no later than 17 December 2023.

Notification channel

Under the Whistle-blower Protection Act, companies are obliged to implement and maintain a reporting channel. However, companies may choose how the channel works in practice as long as the employees are informed about the notification channel and are taught how to use it.

The possibility for companies to outsource the implementation of a reporting channel entirely to an external service provider has created an ample market for service providers. A wide range of services have become available, including technical platforms through which a notification channel can be implemented to full "whistle-blowing channel as a service" solutions.

Companies that belong to the same group can establish a common notification channel. If there is no group relationship between the companies, the companies can agree to cooperate and share resources so that the same person or people handle notifications concerning all companies. Despite such cooperation, each company would formally be responsible for its own notification channel; in the group situation, all companies would formally use the same notification channel.

The company may choose whether to accept notifications in writing and/or orally. The Act does not mandate specific technical details, but viable notification channels might include:

  • a feedback box;
  • an email address reserved for notifications;
  • an online message service designed especially for the notification channel; or
  • a telephone hotline.

Regardless of the implementation method, the person submitting a notification must receive confirmation of receipt within seven days of submission.

Appropriate responses

When a company is notified of a possible violation, it must find out whether the notification is well grounded and, if the notification is validated, take measures to address the situation. The company must initiate an investigation without delay and the whistle-blower must be informed about the measures taken by the company within three months of submission of the notification.

In order to respond to possible notifications effectively, companies should plan the investigation process and the duties of all involved well in advance. It is not necessary, nor in most cases even sensible, that the people who will make the decisions regarding the measures to be taken are also responsible for the investigation. The investigator could be an employee or an external services provider, possibly even an attorney, and their role is to assess whether the notification is warranted. The more detailed the notification, the more likely it is that an investigation will be successful. However, the company may not put all responsibility on whistle-blowers; the investigator must be given sufficient power to interview personnel and go through the company's material, even if the notification does not contain all the relevant details.

Even if the allegations made by the whistle-blower cannot be verified, the company has fulfilled its duties if it has genuinely tried to investigate the matter. However, the company must inform the whistle-blower once it closes its investigation; the whistle-blower may lodge a complaint with the court if they consider that the company has investigated the matter half-heartedly or neglected its duties.

If the notification proves to be justified, the company must treat the violation with the seriousness it requires. Depending on the violation, this could mean that:

  • the case is referred to a supervisory authority or even to the police for investigation;
  • defective products are withdrawn from the market;
  • the company's operating policies or practices are updated; or
  • the perpetrators face disciplinary measures.

Protection of whistle-blowers

Companies must ensure that employees feel confident to use the notification channel without fear of reprisal. The whistle-blower's employer – as well as any contractual partners or other entities that would have the opportunity to impose sanctions on the whistle-blower – are prohibited from taking any adverse actions towards the whistle-blower.

The Whistle-blower Protection Act explicitly mentions the termination of the whistle-blower's employment relationship or changes to their terms of employment as examples of prohibited countermeasures. The Act also prohibits companies from transferring whistle-blowers to a different role and denying whistle-blowers promotions, along with other countermeasures.

Indemnification and compensation

If the informant feels that they have been the subject to countermeasures, they have the opportunity to claim:

  • indemnification; and
  • compensation for the damages suffered.

The legislation does not specify any maximum indemnification, but the amount would be determined based on the overall situation, taking into account, for example, the reputational damage caused to the whistle-blower and the harm they suffered. The indemnification aims to compensate for the harm and suffering experienced by the whistle-blower, regardless of whether the whistle-blower has suffered any loss.

In addition to the indemnification, a whistle-blower whose rights have been intentionally violated can claim compensation for any damages suffered. In practice, compensable damages could include, for example, the costs incurred by the whistle-blower or the loss of future earnings. For example, if the whistle-blower's identity becomes generally known to those working in the field as a result of the employer's countermeasures and, therefore, the whistle-blower de facto permanently loses the opportunity to work within the same field of business, the employer could be liable to pay compensation for loss of future earnings during the time the whistle-blower takes to study for a new profession.

If the whistle-blower feels that they have been subjected to countermeasures, a reversed burden of proof will be applied in a possible lawsuit regarding compensation or damages. The whistle-blower need only prove that they have been subject to countermeasures; the employer is deemed guilty unless it is able to demonstrate a justified reason for the measures that is unrelated to the notification filed by the whistle-blower.

For further information on this topic please contact Jouni Kautto at Waselius & Wist by telephone (+358 9 668 9520) or email ([email protected]). The Waselius & Wist website can be accessed at


(1) 2019/1937/EU.