Whistleblower law in Italy: D.Lgs. 24/2023 #

Italy implemented Directive (EU) 2019/1937 through Legislative Decree No. 24 of 10 March 2023 (D.Lgs. 24/2023). Its provisions apply from 15 July 2023. The decree requires public-sector bodies and private entities with an average of at least 50 employees to set up a whistleblowing channel. The same duty applies, at any size, to entities that have adopted a Model 231 and to some sectors regulated by EU law. The decree also protects people who report from any retaliation.

D.Lgs. 24/2023 at a glance #

Applicable law #

• Legislative Decree No. 24 of 10 March 2023 — current text on Normattiva
• ANAC guidelines on external reports (resolution No. 311 of 12 July 2023, updated by resolution No. 479/2025)
• ANAC guidelines No. 1/2025 on internal channels (resolution No. 478 of 26 November 2025)

Who must set up a whistleblowing channel #

Private sector. Art. 2(1)(q) names three groups of entities:

1. entities that employed an average of at least 50 employees in the last year, on permanent or fixed-term contracts;
2. entities within the scope of the EU acts in Parts I.B and II of the annex to the decree, even below 50 employees. These are the acts on financial services, products and markets and on the prevention of money laundering and terrorist financing, plus some acts on transport safety (civil aviation and shipping) and on the safety of offshore oil and gas operations;
3. entities within the scope of Legislative Decree 231/2001 that adopt a Model 231, even below 50 employees.

To calculate the average, ANAC uses the last calendar year before the current one and the average staff figure in the company’s registry extract (visura camerale). For newly formed companies, the current year counts (guidelines, resolution No. 311/2023, § 1.3).

The Model 231 must include the internal reporting channels (art. 4(1), and art. 6(2-bis) of Legislative Decree 231/2001 as replaced by art. 24(5)).

Public sector. The duty applies to all public-sector bodies defined in art. 2(1)(p), with no size threshold. Where the body must have an anti-corruption and transparency officer (RPCT), that officer manages the channel (art. 4(5)).

What can be reported #

The decree protects people who report breaches of national or EU law that harm the public interest or the integrity of the organisation, learned in a work context (art. 1(1)). Art. 2(1)(a) lists six categories:

1. administrative, accounting, civil or criminal offences;
2. unlawful conduct relevant under Legislative Decree 231/2001, or breaches of Model 231;
3. breaches in the fields of the EU acts listed in the annex: public procurement, financial services and anti-money laundering, product safety, transport safety, environmental protection, radiation protection and nuclear safety, food safety and animal welfare, public health, consumer protection, privacy and network security;
4. acts or omissions that harm the financial interests of the EU;
5. breaches relating to the internal market, including competition, state aid and corporate tax;
6. acts or conduct that defeat the purpose of EU rules in the fields of points 3, 4 and 5.

Since 24 January 2026, the decree also covers reports of breaches of EU restrictive measures (sanctions) as defined in the Criminal Code and in art. 12(1-bis) of Legislative Decree 286/1998 (art. 1(1), as amended by Legislative Decree No. 211 of 30 December 2025). Reasonable suspicions and conduct aimed at hiding a breach can also be reported (art. 2(1)(b)).

In the private sector, protection depends on the type of entity (art. 3(2)):

Purely national offences (point 1) are covered only in the public sector (art. 3(1)). A private entity may still open its channel to other reports. According to ANAC, reports outside the scope of the decree can be handled as ordinary reports (guidelines No. 1/2025, § 3.5).

Excluded (art. 1(2) and (3)):

• complaints and claims of personal interest that relate only to the reporter’s own employment or to their relations with superiors;
• breaches already covered by mandatory procedures in the acts of Part II of the annex;
• breaches relating to national security and to defence or national-security procurement, unless EU law covers them.

The rules on classified information, legal and medical professional secrecy and the secrecy of judicial deliberations continue to apply.

Who is protected #

Art. 3(3) protects people who report information learned in their work context, in particular:

• employees in the public and private sector, including those on the contracts of Legislative Decree 81/2015;
• self-employed workers, collaborators, freelance professionals and consultants;
• workers and collaborators of suppliers of goods, services and works;
• volunteers and trainees, paid or unpaid;
• shareholders and people with administrative, management, control, supervisory or representative functions, even de facto.

Protection also applies during recruitment, during the probation period, and after the relationship ends for information learned during it (art. 3(4)). It extends to facilitators, to colleagues with a regular working relationship, to relatives up to the fourth degree and people with a stable emotional bond in the same work context, and to entities the reporter owns or works for (art. 3(5)).

The person is protected if, at the time of the report, they had reasonable grounds to believe that the information was true and within the scope of the decree, and if they used the channels the decree provides (art. 16(1)). Their motives do not matter (art. 16(2)). Protection is lost if the reporter’s criminal liability for defamation or malicious accusation is established, even at first instance, or their civil liability on the same grounds, in cases of intent or gross negligence. In that case a disciplinary sanction is also imposed (art. 16(3)).

Retaliation is reported to ANAC, which can work with the National Labour Inspectorate (art. 19(1) and (2)).

Requirements for the whistleblowing channel #

• Trade unions. The channel is set up after “hearing” the union representatives or organisations under art. 51 of Legislative Decree 81/2015 (art. 4(1)). For ANAC, this step is for information and the unions’ opinion is not binding. The notice goes out before the organisational act or the Model 231 update is approved: to the company union representatives (RSA or RSU), or, where there are none, to the local branches of the most representative unions. Without this step, the procedure does not comply and can be fined (guidelines No. 1/2025, § 2.1).
• Confidentiality. The channel protects, also through encryption, the identity of the reporter, of the person concerned and of anyone named, and the content of the report (art. 4(1)).
• Who runs it. A person or an autonomous, dedicated internal office with specifically trained staff, or an external party that is also autonomous and trained (art. 4(2)). For ANAC, the handler must have no conflict of interest. With an external handler, a contract sets its tasks and powers, and the handler may process data as a processor under art. 28 GDPR (guidelines No. 1/2025, § 3.4).
• Written and oral. Reports can be made in writing, including electronically, or orally, by telephone lines or voice messaging. On request, an in-person meeting is set within a reasonable time (art. 4(3)). ANAC states that the entity must offer both forms and that the reporter must be able to choose (guidelines No. 1/2025, § 2.2).
• Tools. ANAC prefers IT platforms. It considers email, ordinary or certified (PEC), not adequate on its own to protect the reporter’s identity unless specific countermeasures are in place (guidelines No. 1/2025, § 2.2).
• Anonymous reports. The decree does not require them to be accepted. Protection also applies to an anonymous reporter who is later identified and suffers retaliation (art. 16(4)). The entity may handle anonymous reports as ordinary reports if its rules provide for this, but it must record them and keep the file (ANAC guidelines No. 311/2023, § 2.2, and No. 1/2025, § 3.5). See also anonymous and confidential reporting.
• Report sent to the wrong person. It is passed to the handler within seven days, and the reporter is told (art. 4(6)).
• Information for staff. Clear information on the internal channel, its procedures and conditions, and on the external channel. It is displayed in the workplace, made available to people who do not work on site, and published in a dedicated section of the website, if the entity has one (art. 5(1)(e)).
• Data protection. The entity defines how it receives and handles reports on the basis of a data protection impact assessment, and it governs external providers with a contract under art. 28 GDPR (art. 13(6)). It gives privacy notices to the reporter and the people concerned (art. 13(4)). Data that is clearly not useful is not collected, or is deleted at once (art. 13(2)). See GDPR and whistleblower reporting.

Deadlines and what happens after a report #

For ANAC, the acknowledgement only confirms receipt and involves no assessment of the content. The handler then checks that the reporter is entitled to protection and that the facts fall within the scope of the decree (guidelines No. 1/2025, § 3.5). In the meantime, the handler stays in contact with the reporter, may ask for more information, and follows up the report diligently (art. 5(1)(b) and (c)). The person concerned may be heard, and must be heard if they ask (art. 12(9)).

The decree provides no extension of the feedback deadline for the internal channel. For the external channel, ANAC may take up to six months where there are justified reasons (art. 8(1)(f)). For ANAC, the internal deadline is not peremptory, because some checks take longer, but the outcome must still be communicated (guidelines No. 1/2025, § 3.5).

Confidentiality and records #

Confidentiality (art. 12). Reports are not used beyond what is needed to follow them up. The reporter’s identity, and any information from which it can be inferred, is not disclosed without their express consent to anyone other than the competent, authorised staff. Special rules apply:

• in criminal proceedings, the identity is covered by secrecy within the limits of art. 329 of the Code of Criminal Procedure;
• before the Court of Auditors, it is not disclosed until the investigation phase is closed;
• in disciplinary proceedings, if the charge is based on the report and the identity is essential for the defence, the report can be used only with the reporter’s express consent. The reporter is told the reasons in writing.

The identity of people concerned or named is protected until the proceedings are closed. Reports are exempt from public access to documents and from freedom-of-information requests.

Records (art. 14). Reports and their documents are kept for as long as needed to handle them, and no longer than five years after the final outcome of the procedure is communicated. Oral reports are recorded as follows:

• recorded telephone line or voice messaging: with the reporter’s consent, a recording or a full transcript;
• unrecorded line: a detailed written account of the call;
• in-person meeting: with the reporter’s consent, a recording or minutes.

The reporter may check, correct and confirm the transcript, account or minutes by signing them.

Shared channels and groups of companies #

Shared channel. Private entities with an average of up to 249 employees may share the internal reporting channel and its management. The same applies to municipalities that are not provincial capitals (art. 4(4)). Entities that share resources set out their data protection responsibilities in an internal agreement (art. 13(5)). For ANAC, sharing does not remove each entity’s duty to keep reports confidential, assess the facts and give feedback. Each entity appoints its own handler and sees only its own reports (guidelines No. 1/2025, § 3.4.3).

Groups of companies. The decree does not regulate groups. According to ANAC (guidelines No. 1/2025, in-depth note 2):

• the 249-employee threshold is calculated for each company, not for the group;
• companies with up to 249 employees may share the channel, for example through a single platform split into separate sub-channels, one per company. Dialogue with the reporter stays with each company;
• companies with more than 249 employees may not share the channel. Each one may, however, entrust its management to a third party, including another group company or the parent, under a contract that sets its tasks, powers and responsibilities.

Penalties and enforcement #

ANAC imposes the administrative fines of art. 21(1) of Legislative Decree 24/2023:

The fines are applied to the person responsible. For letter (b), ANAC identifies the person responsible as follows. For a missing channel and for missing or non-compliant procedures, it is the entity’s governing body, in both the public and the private sector. For failure to verify and analyse the reports received, it is the report handler (guidelines, resolution No. 311/2023 as updated by resolution No. 479/2025, Part Three, § 1). The governing body is jointly liable with its members, with a right of recourse against those who committed the breach (guidelines No. 1/2025, § 2.3). The fining procedure is set by ANAC resolution No. 301 of 12 July 2023. Private entities with a Model 231 (art. 2(1)(q)(3)) must also provide for sanctions against those responsible in the disciplinary system adopted under art. 6(2)(e) of Legislative Decree 231/2001 (art. 21(2)).

An honest assessment of enforcement. Letter (b) does not only penalise the absence of a channel: non-compliant procedures and failure to verify and analyse the reports received sit in the same band. Operating a channel nobody investigates therefore carries the same fine as having none, although ANAC holds the report handler, not the governing body, responsible for it. For ANAC, a procedure adopted without hearing the unions also does not comply and can be fined (guidelines No. 1/2025, § 2.1). The fine for a reporter is narrow by design: it requires an established finding of liability for defamation or malicious accusation, not merely a report that turned out to be unfounded.

External reporting authority #

The external authority is ANAC. In Italy, external reporting is not a free alternative to the internal channel. It is allowed only if one of these conditions applies (art. 6(1)):

• the internal channel is not mandatory, not active, or does not comply with art. 4;
• an internal report was made and was not followed up;
• the reporter has reasonable grounds to believe that an internal report would not be followed up effectively or would expose them to retaliation;
• the reporter has reasonable grounds to believe that the breach may be an imminent or clear danger to the public interest.

Public disclosure is also protected only under specific conditions (art. 15). The ANAC page describes the external channel, its deadlines and the fining procedure.

Data protection authority #

For GDPR complaints relating to the handling of whistleblower data, the relevant authority is the Garante per la protezione dei dati personali.

Setting up in seven steps #

1. Check the duty: average employees in the last year, Model 231, sectors of Parts I.B and II of the annex.
2. Choose the handler: an autonomous, trained internal person or office, an external party, or, up to 249 employees, a shared channel.
3. Hear the unions: send the notice before the organisational act or the Model 231 is approved.
4. Set up the channels: written and oral, an in-person meeting on request. Decide how to handle anonymous reports.
5. Protect the data: impact assessment, privacy notices, art. 28 GDPR contracts with providers.
6. Inform people: display the information in the workplace and publish it on the website.
7. Set the procedure: acknowledgement within 7 days, feedback within 3 months, records kept no longer than 5 years after the final outcome, training for the handler.

Official sources #

• Legislative Decree No. 24 of 10 March 2023 — current text (Normattiva)
• Legislative Decree No. 24 of 10 March 2023 — Official Journal No. 63 of 15 March 2023
• ANAC — whistleblowing
• ANAC — guidelines, resolution No. 311/2023 as updated by resolution No. 479/2025
• ANAC — guidelines No. 1/2025 on internal channels, resolution No. 478/2025
• Garante privacy

Frequently asked questions #

What is D.Lgs. 24/2023? #

It is Legislative Decree No. 24 of 10 March 2023, which transposes Directive (EU) 2019/1937 on whistleblowing into Italian law. It protects people who report breaches learned at work and requires public and private entities to set up a whistleblowing channel. It applies from 15 July 2023.

From how many employees is a whistleblowing channel required? #

From an average of 50 employees, on permanent or fixed-term contracts, in the last year. Below that threshold, the duty still applies to entities with a Model 231 and to entities in the sectors of Parts I.B and II of the annex, such as financial services and anti-money laundering (art. 2(1)(q)). Public-sector bodies must have a channel at any size.

Must the channel accept anonymous reports? #

No, the decree does not require it. An anonymous reporter who is later identified and suffers retaliation is still protected (art. 16(4)). According to ANAC, the entity must record the anonymous reports it receives and keep the file, and it may handle them as ordinary reports.

Is a written channel enough? #

No. The decree provides for written and oral reports (art. 4(3)), and ANAC states that the entity must offer both and let the reporter choose. On request, an in-person meeting must also be set. A non-compliant channel can be fined in the same band as a missing one (art. 21(1)(b)).

What deadlines apply after a report? #

Acknowledgement within 7 days of receipt. Feedback within 3 months of the acknowledgement or, without one, within 3 months of the end of the 7 days (art. 5(1)).

How long may reports be kept? #

As long as needed to handle them, and no longer than five years after the final outcome of the procedure is communicated (art. 14(1)).

What fines does D.Lgs. 24/2023 set? #

ANAC imposes fines of €10,000 to €50,000 for retaliation, obstructing reports and breaches of confidentiality, and for having no channel, non-compliant procedures or failing to verify reports. A reporter found liable for defamation or malicious accusation through intent or gross negligence faces a fine of €500 to €2,500 (art. 21).

Can a reporter go straight to ANAC? #

Only if one of the conditions in art. 6 applies: no internal channel or a non-compliant one, an internal report with no follow-up, reasonable fear that an internal report would fail or lead to retaliation, or reasonable grounds to believe that the breach may be an imminent or clear danger to the public interest.

May an external provider manage the channel? #

Yes. The decree allows management by an external party that is autonomous and has specifically trained staff (art. 4(2)). In groups, according to ANAC, this party may also be the parent or another group company, under a contract with each company.

Must trade unions be involved? #

Yes. The channel is set up after hearing the union representatives or organisations (art. 4(1)). Their opinion is not binding, but according to ANAC a procedure adopted without this step does not comply and can be fined.

Deploy your whistleblowing channel →