Diese Seite ist nur auf Englisch verfügbar.

Whistleblower law in Norway #

Norway regulates whistleblowing through chapter 2 A of the Working Environment Act (arbeidsmiljøloven, Act of 17 June 2005 No. 62). It is not a transposition of Directive (EU) 2019/1937. It is also, on the point that matters most operationally, stricter: the duty to have internal whistleblowing procedures starts at five employees, not fifty.

A group that reads “outside the EU, therefore nothing applies” has Norway exactly backwards.

Applicable law #

Chapter 2 A was added by the Act of 16 June 2017 No. 42, in force 1 July 2017, and amended by the Act of 21 June 2019 No. 24, in force 1 January 2020. Both changes predate the Directive’s transposition deadline and were not written to it.

Does Directive (EU) 2019/1937 apply? #

No. Norway is an EEA state, and the Directive has not been incorporated into the EEA Agreement. The EFTA Secretariat’s factsheet records it as an “EU legal act marked as EEA relevant by the EU and under scrutiny for incorporation into the EEA Agreement by Iceland, Liechtenstein and Norway”, with no Joint Committee Decision adopted.

Norwegian obligations therefore stand entirely on their own. A Norwegian group with EU subsidiaries also carries the Directive’s obligations through those subsidiaries — the 50-worker threshold applies per legal entity, not per corporate group. See our reading of the threshold and the country-by-country obligations .

Who must establish an internal channel #

Section 2 A-6(1): “Undertakings that regularly employ at least five employees are obliged to have routines for internal whistleblowing. Undertakings with fewer employees shall also have such routines if the conditions at the undertaking so indicate.”

The Act applies to any undertaking that engages employees (s. 1-2), so the duty covers public and private employers alike. There is no sectoral carve-out and no larger-employer exemption.

The procedures themselves are prescribed, not left to the employer:

Written, and at minimum containing an encouragement to report, the procedure for notification, and the procedure for the employer’s receipt, processing and follow-up of reports (s. 2 A-6(4)).
Prepared as part of the undertaking’s systematic health, environment and safety work under s. 3-1, in cooperation with the employees and their elected representatives (s. 2 A-6(2)).
Easily accessible to all employees at the undertaking (s. 2 A-6(5)).
They may not limit the employee’s statutory right to report (s. 2 A-6(3)).

The participation requirement is the one most often missed: a channel procured and switched on without involving employee representatives does not meet s. 2 A-6(2), however good the channel is.

What counts as a reportable concern #

Section 2 A-1(2) defines kritikkverdige forhold as breaches of legislation, of the undertaking’s written ethical guidelines, or of ethical norms on which there is broad agreement in society — for example danger to life or health, danger to climate and the environment, corruption or other economic crime, abuse of authority, an unsatisfactory working environment, or breach of personal data security.

That is materially wider than the Directive, which is confined to breaches of listed areas of Union law. Section 2 A-1(3) draws the boundary the other way: matters relating only to the employee’s own work situation are not whistleblowing unless they also involve a reportable concern.

Reporting routes #

Section 2 A-2 sets out three tiers, and the second is unconditional:

Internally — to the employer or a representative, under the undertaking’s routines, under a duty to report, or via a safety representative, union representative or lawyer.
Externally to a public supervisory authority or other public authority — always permitted. There is no requirement to report internally first.
To the media or the public at large — only where the employee is in non-negligent good faith, the concern is of public interest, and the employee has first reported internally or has reason to believe internal reporting would not be appropriate.

Section 2 A-2(4) places the burden on the employer to show that a whistleblower did not follow proper procedure.

Employer duties on receiving a report #

Section 2 A-3 requires the employer to ensure the matter is “adequately investigated within a reasonable time”, and specifically to ensure the whistleblower has a fully satisfactory working environment, taking measures to prevent retaliation where necessary.

Norwegian law sets no fixed acknowledgment or feedback deadlines. A group applying the Directive’s seven-day and three-month rules across its Norwegian entities is above the Norwegian standard, not below it.

Retaliation and remedies #

Prohibition (s. 2 A-4). Retaliation is any unfavourable act, practice or omission in response to a report, and the section names examples: threats, harassment, arbitrary discrimination, social exclusion; warnings, change of duties, relocation, demotion; suspension, dismissal, summary discharge, disciplinary action. It also protects an employee who merely signals that they will report.
Reversed burden of proof (s. 2 A-4(4)). Where the employee produces information giving reason to believe retaliation has occurred, the employer must substantiate that it has not.
Redress and compensation (s. 2 A-5). Available without regard to fault. Redress is set by reference to the circumstances and the gravity of the retaliation; compensation covers financial loss.
Confidentiality at the authority (s. 2 A-7). Anyone working for a body that receives an external report must prevent others from learning the employee’s name or other identifying information — including from the parties to the case.

External reporting and enforcement #

Norway designates no single national whistleblowing authority; an employee reports to whichever public supervisory authority covers the subject matter.

The internal-routines duty is supervised and enforceable. Section 18-6 lists s. 2 A-6 among the provisions for which the Norwegian Labour Inspection Authority issues orders. Failure to comply with an order can attract a coercive fine (s. 18-7), and s. 18-10 allows an administrative fine of up to 50 times the National Insurance basic amount or four per cent of the undertaking’s annual turnover, whichever is higher.

Retaliation disputes go elsewhere: under s. 2 A-8 they may be brought before the Equality and Anti-Discrimination Tribunal , except cases concerning dismissal with or without notice, which remain with the courts.

Data protection authority #

For complaints about the handling of personal data in a reporting process, the competent authority is the Norwegian Data Protection Authority (Datatilsynet) .

Key compliance points #

The five-employee threshold is the single most consequential difference from the Directive. A group channel scoped to entities of 50 or more workers will leave small Norwegian entities out of compliance.
The definition of a reportable concern reaches the undertaking’s own written ethical guidelines, so a code of conduct is not decorative in Norway — breaching it is a statutory reporting ground.
Employees may go to a public authority without trying internally first. Internal handling competes for the report on its merits; it is not protected by a legal cascade as it is in some jurisdictions.
The routines must be produced through the health, environment and safety process with employee participation, and must be written and accessible. All four are checkable by an inspector.

Official sources #

Deploy your reporting channel →