Whistleblower law in France #

France implemented Directive (EU) 2019/1937 through Loi n° 2022-401 du 21 mars 2022 (“Loi Waserman”), which amended the existing Loi Sapin 2 framework, with the October 2022 decree setting the practical framework for internal and external reporting procedures. For most employers, the central threshold remains 50 employees.

Loi Sapin 2 or Loi Waserman? #

They are one framework, not two competing laws.

Loi n° 2016-1691 du 9 décembre 2016 (“Loi Sapin 2”, also written Sapin II) created France’s first whistleblower statute. Loi Waserman did not replace it — it amended it, in order to transpose Directive (EU) 2019/1937. The protections in force today therefore sit in Sapin 2 as amended, which is why the penalty provisions below cite Article 13 of the 2016 text rather than the 2022 one.

One distinction does real work in practice. Sapin 2 Article 17 imposes an anti-corruption compliance-programme duty on companies with 500 or more employees and €100M+ turnover, enforced by the Agence française anticorruption (AFA). That is a different obligation from the reporting-channel duty described on this page, it catches far fewer companies, and satisfying one does not satisfy the other. A 60-person firm has the channel duty and not the Article 17 duty; a 900-person firm has both.

Applicable law #

• Loi n° 2016-1691 du 9 décembre 2016 (Loi Sapin 2) — the framework Loi Waserman amends
• Loi n° 2022-401 du 21 mars 2022 (Loi Waserman)
• Service Public explainer for whistleblowers

Who must establish an internal channel #

• Private employers with 50 or more employees must establish an internal reporting procedure (headcount assessed over two consecutive years).
• Public legal entities and state administrations with at least 50 agents — excluding municipalities under 10,000 inhabitants.
• Some entities with fewer than 250 workers may pool the collection and processing arrangement.
• Financial / AML, transport-safety, and environmental entities — regardless of headcount.

The obligation has applied since 1 September 2022 (implementing décret 2022-1284 of 3 October 2022). This 50-employee channel duty is separate from the Sapin II anti-corruption compliance-programme obligation (500 employees / €100M turnover, Art. 17), which the AFA enforces with much larger sanctions.

Penalties and enforcement #

France’s framework is unusual: there is no direct fine for simply failing to establish a channel. The current Sapin II / Loi Waserman text imposes no sanction on a company for not setting one up, and the implementing decree contains no penalty provisions. Instead, penalties attach to specific conduct:

Verbatim, Article 13, I of Loi 2016-1691 : “Toute personne qui fait obstacle, de quelque façon que ce soit, à la transmission d’un signalement … est punie d’un an d’emprisonnement et de 15 000 euros d’amende.” The same Article 13 (II) raises the amende civile for an abusive or dilatory action against a whistleblower to 60 000 euros. There is no article anywhere in the Sapin II / Waserman framework that fines an employer for failing to establish a channel — confirmed against the consolidated Légifrance text and décret 2022-1284.

An honest assessment of enforcement. Not having a channel is not directly fined — but it is far from risk-free. A missing or defective channel creates indirect exposure: it strengthens a retaliation or wrongful-dismissal claim before the Conseil de prud’hommes, and feeds AFA scrutiny for large firms under the anti-corruption regime. Enforcement of whistleblower protection is primarily reactive and judicial: retaliatory dismissals are null and void by operation of law, and the labour court’s summary judge can order reinstatement (Cass. soc., 1 Feb 2023, Thales, n°21-24.271, with the burden of proof shifting to the employer). The Défenseur des droits oversees protection. The practical lesson: the real cost of not having a proper channel shows up as litigation and reinstatement liability, not a fixed administrative fine.

External reporting authority #

France does not rely on one universal whistleblowing authority. Décret n° 2022-1284 du 3 octobre 2022 publishes a schedule of competent external authorities — around twenty-three sectoral headings — each receiving reports within its own remit.

The Défenseur des droits sits alongside that schedule with a different role: it orients a whistleblower to the right authority, issues an opinion on whistleblower status within six months, and protects against retaliation. That page covers what it can and cannot do, the external deadlines, and how a report reaches it. The practical consequence for an employer is that there is no single regulator to name in an internal procedure.

Data protection authority #

For concerns about unlawful processing of personal data or confidentiality failures in the reporting process, the relevant authority is the CNIL .

Key compliance points #

• France no longer requires whistleblowers to report internally before using an external channel.
• The procedure must keep the identity of the reporting person, the person concerned, and named third parties confidential.
• French official guidance points to acknowledgment within 7 working days and feedback within 3 months as the standard operating timeline.

The framework in practice #

The Défenseur des droits — France’s designated external reporting authority — published its first two-yearly review of the regime, La protection des lanceurs d’alerte en France : un dispositif à l’épreuve de son appropriation, on 28 May 2026. Two of its findings bear directly on how an internal procedure should be run:

• External reporting has grown roughly fivefold. The review records more than 10,000 signalements in 2025, against about 2,000 in 2023 — reports made to external authorities rather than through an employer’s internal procedure.
• Retaliation, not intake, is the recurring failure. The Défenseur des droits reports witnessing frequent breaches of the statutory prohibition on retaliation, particularly in the employment relationship.

Reports cluster in health and medico-social services, environmental matters, and public integrity.

The practical inference for a French employer: since 2022 a reporter may go straight to an external authority, and the volume figures show they increasingly do. The question is no longer whether people will report, but whether the internal procedure is credible enough to be used first — and whether what happens after a report protects the person who made it. A procedure that satisfies the 7-working-day acknowledgment and 3-month feedback timeline but leaves a reporter exposed to retaliation fails on the axis the Défenseur des droits actually reports on.

Official sources #

• Loi Waserman — official text
• Service Public — lancer une alerte
• Loi Sapin II (Loi 2016-1691) — official text
• Décret 2022-1284 (internal/external reporting procedures)
• Défenseur des droits — orienter et protéger les lanceurs d’alerte
• Défenseur des droits — rapport bisannuel sur la protection des lanceurs d’alerte (28 May 2026)
• Agence Française Anticorruption — les contrôles de l’AFA
• CNIL — adresser une alerte

Deploy your reporting channel →