Whistleblower law in France #
France implemented Directive (EU) 2019/1937 through Loi n° 2022-401 du 21 mars 2022 (“Loi Waserman”), which amended the existing Loi Sapin 2 framework, with the October 2022 decree setting the practical framework for internal and external reporting procedures. For most employers, the central threshold remains 50 employees.
Loi Sapin 2 or Loi Waserman? #
They are one framework, not two competing laws.
Loi n° 2016-1691 du 9 décembre 2016 (“Loi Sapin 2”, also written Sapin II) created France’s first whistleblower statute. Loi Waserman did not replace it — it amended it, in order to transpose Directive (EU) 2019/1937. The protections in force today therefore sit in Sapin 2 as amended, which is why the penalty provisions below cite Article 13 of the 2016 text rather than the 2022 one.
One distinction does real work in practice. Sapin 2 Article 17 imposes an anti-corruption compliance-programme duty on companies with 500 or more employees and €100M+ turnover, enforced by the Agence française anticorruption (AFA). That is a different obligation from the reporting-channel duty described on this page, it catches far fewer companies, and satisfying one does not satisfy the other. A 60-person firm has the channel duty and not the Article 17 duty; a 900-person firm has both.
What Loi Waserman protects, and whom #
Loi Waserman protects whistleblowers: natural persons who report or disclose, in good faith and without direct financial reward, information about a crime, an offence, a threat or harm to the public interest, or a breach of French, European or international law. It widened the earlier Sapin 2 framework:
- A wider definition: in a work context, the whistleblower no longer needs to have personal knowledge of the facts reported.
- No duty to report internally first: the whistleblower may go straight to an external authority (see below).
- Protection for people around the whistleblower: “facilitators”, including legal persons such as trade unions and associations, and colleagues and relatives exposed to retaliation are now covered.
What can be reported #
A report may concern a crime, an offence, a threat or harm to the public interest, or a breach of law: French law, EU law, or an international commitment ratified by France (Article 6, I of Loi Sapin 2). The whistleblower must act in good faith and without direct financial reward.
Some facts are excluded from the regime, whatever their form or medium (Article 6, II): those covered by
- national defence secrecy;
- medical secrecy;
- the secrecy of judicial deliberations;
- the secrecy of judicial investigations;
- lawyer–client privilege.
In practice, a breach of an internal rule alone, with no breach of law and no harm to the public interest, does not give whistleblower status. A company may still open its channel to such reports.
Anonymous reports #
A report may be made anonymously. If the reporter’s identity is revealed later, they receive the same protections as any whistleblower (Article 7-1 of Loi Sapin 2). The statutory duty to give feedback does not apply to anonymous reports.
The internal procedure must state how anonymous reports are handled (décret n° 2022-1284, art. 4). On the difference between anonymity and confidentiality, see anonymous vs confidential reporting.
What the internal procedure must include #
The content of the procedure is set by décret n° 2022-1284 du 3 octobre 2022. The procedure is adopted after consulting the staff representative bodies (Article 8, I, B of Loi Sapin 2).
| Requirement | Rule | Source |
|---|---|---|
| Reporting channel | In writing or orally. Orally: by telephone or voicemail and, at the reporter’s request, by video call or in-person meeting no later than 20 working days after the request. | Decree, art. 4 I |
| Acknowledgement | In writing, within 7 working days. | Decree, art. 4 I |
| Feedback | In writing, within a reasonable time not exceeding 3 months from the acknowledgement (or, without one, from the end of a 7-working-day period). | Decree, art. 4 III |
| People who receive reports | Sufficient competence, authority and means; guarantees of impartiality. Receiving reports may be entrusted to a third party, for example an external provider. | Decree, arts. 5 and 7 |
| Oral reports | Recording, transcript or minutes as applicable, with the required consent; the reporter can check and sign. | Decree, art. 6 II |
| Confidentiality | Strict confidentiality of the identity of the reporter, the people named in the report and third parties mentioned. | Law, art. 9 I |
| Retention | Only as long as strictly necessary and proportionate to handle the report and to protect the reporter, the people named and third parties mentioned. After that, only if the data no longer identifies anyone. | Law, art. 9 III |
| Publication | By any means that gives sufficient publicity (notification, posting, publication, website), permanently and accessibly, with information on external reporting procedures. | Decree, art. 8 |
Groups and small employers. One procedure may cover several or all companies in a group (Article 8, I, C of the law). Employers with fewer than 250 employees may, after matching decisions by their competent bodies, pool the channel and the assessment of reports; their other obligations stay with each employer (decree, art. 7 II).
Applicable law #
- Loi n° 2016-1691 du 9 décembre 2016 (Loi Sapin 2) — the framework Loi Waserman amends
- Loi n° 2022-401 du 21 mars 2022 (Loi Waserman)
- Service Public explainer for whistleblowers
Who must establish an internal channel #
- Private employers with 50 or more employees must establish an internal reporting procedure (headcount assessed at the close of two consecutive financial years).
- Public legal entities and state administrations with at least 50 agents — excluding municipalities under 10,000 inhabitants.
- Some entities with fewer than 250 workers may pool the collection and processing arrangement.
- Financial / AML, transport-safety, and environmental entities — regardless of headcount.
The obligation has applied since 1 September 2022 (implementing décret 2022-1284 of 3 October 2022). This 50-employee channel duty is separate from the Sapin II anti-corruption compliance-programme obligation (500 employees / €100M turnover, Art. 17), which the AFA enforces with much larger sanctions.
Penalties and enforcement #
France’s framework is unusual: there is no direct fine for simply failing to establish a channel. The current Sapin II / Loi Waserman text imposes no sanction on a company for not setting one up, and the implementing decree contains no penalty provisions. Instead, penalties attach to specific conduct:
| Conduct | Individuals | Legal entities |
|---|---|---|
| Obstructing the transmission of a report (“in any way whatsoever”) | 1 year imprisonment + €15,000 | €75,000 |
| Discrimination / retaliation based on whistleblower status (Code pénal arts. 225-1/225-2) | 3 years imprisonment + €45,000 | €225,000 |
| Disclosing confidential information (identity of the reporter, the people named, third parties), Article 9, II of Loi Sapin 2 | 2 years imprisonment + €30,000 | €150,000 |
| Abusive or dilatory (“SLAPP”) proceedings against a whistleblower | civil fine up to €60,000 (plus damages) | — |
Verbatim, Article 13, I of Loi 2016-1691: “Toute personne qui fait obstacle, de quelque façon que ce soit, à la transmission d’un signalement … est punie d’un an d’emprisonnement et de 15 000 euros d’amende.” The same Article 13 (II) raises the amende civile for an abusive or dilatory action against a whistleblower to 60 000 euros. There is no article anywhere in the Sapin II / Waserman framework that fines an employer for failing to establish a channel — confirmed against the consolidated Légifrance text and décret 2022-1284.
An honest assessment of enforcement. Not having a channel is not directly fined — but it is far from risk-free. A missing or defective channel creates indirect exposure: it strengthens a retaliation or wrongful-dismissal claim before the Conseil de prud’hommes, and feeds AFA scrutiny for large firms under the anti-corruption regime. Enforcement of whistleblower protection is primarily reactive and judicial: retaliatory dismissals are null and void by operation of law, and the labour court’s summary judge can order reinstatement (Cass. soc., 1 Feb 2023, Thales, n°21-24.271, with the burden of proof shifting to the employer). The Défenseur des droits oversees protection. The practical lesson: the real cost of not having a proper channel shows up as litigation and reinstatement liability, not a fixed administrative fine.
External reporting authority #
France does not rely on one universal whistleblowing authority. Décret n° 2022-1284 du 3 octobre 2022 publishes a schedule of competent external authorities — twenty-three sectoral headings — each receiving reports within its own remit.
The Défenseur des droits sits alongside that schedule with a different role: it orients a whistleblower to the right authority, issues an opinion on whistleblower status within six months, and protects against retaliation. That page covers what it can and cannot do, the external deadlines, and how a report reaches it. The practical consequence for an employer is that there is no single regulator to name in an internal procedure.
Data protection authority #
For concerns about unlawful processing of personal data or confidentiality failures in the reporting process, the relevant authority is the CNIL.
Key compliance points #
- France no longer requires whistleblowers to report internally before using an external channel.
- The procedure must keep the identity of the reporting person, the person concerned, and named third parties confidential.
- Décret 2022-1284 (art. 4) sets acknowledgement within 7 working days and feedback within 3 months.
The framework in practice #
The Défenseur des droits — France’s designated external reporting authority — published its first two-yearly review of the regime, La protection des lanceurs d’alerte en France : un dispositif à l’épreuve de son appropriation, on 28 May 2026. Two of its findings bear directly on how an internal procedure should be run:
- External reporting has grown roughly fivefold. The review records more than 10,000 signalements in 2025, against about 2,000 in 2023 — reports made to external authorities rather than through an employer’s internal procedure.
- Retaliation, not intake, is the recurring failure. The Défenseur des droits reports witnessing frequent breaches of the statutory prohibition on retaliation, particularly in the employment relationship.
Reports cluster in health and medico-social services, environmental matters, and public integrity.
The practical inference for a French employer: since 2022 a reporter may go straight to an external authority, and the volume figures show they increasingly do. The question is no longer whether people will report, but whether the internal procedure is credible enough to be used first — and whether what happens after a report protects the person who made it. A procedure that satisfies the 7-working-day acknowledgment and 3-month feedback timeline but leaves a reporter exposed to retaliation fails on the axis the Défenseur des droits actually reports on.
Official sources #
- Loi Waserman — official text
- Service Public — lancer une alerte
- Loi Sapin II (Loi 2016-1691) — official text
- Décret 2022-1284 (internal/external reporting procedures)
- Défenseur des droits — orienter et protéger les lanceurs d’alerte
- Défenseur des droits — rapport bisannuel sur la protection des lanceurs d’alerte (28 May 2026)
- Agence Française Anticorruption — les contrôles de l’AFA
- CNIL — adresser une alerte
Frequently asked questions #
What is the difference between Loi Sapin 2 and Loi Waserman? #
They are two texts of one framework, not two competing regimes. Loi Sapin 2 (Loi n° 2016-1691 of 9 December 2016) created the French whistleblower status; Loi Waserman (Loi n° 2022-401 of 21 March 2022) amended it to transpose Directive (EU) 2019/1937. The protections in force today sit in Sapin 2 as amended. Do not confuse this with the anti-corruption compliance-programme duty in Article 17 of Sapin 2, which applies only to companies with at least 500 employees and more than €100M turnover.
From how many employees is a whistleblowing channel mandatory in France? #
From 50 employees, with headcount assessed at the close of two consecutive financial years. The threshold also applies to public legal entities with at least 50 agents, except municipalities under 10,000 inhabitants. Entities in financial services and AML, transport safety and the environment must comply regardless of headcount. The duty has applied since 1 September 2022.
What is the penalty for having no whistleblowing channel? #
No direct fine. This is particular to France: neither Sapin 2 as amended nor décret 2022-1284 penalises an employer only for not having an internal procedure. Penalties target specific conduct: obstructing a report (1 year in prison and €15,000 for an individual, €75,000 for a legal entity) and retaliation (3 years and €45,000, €225,000 for a legal entity). An employer without a channel is therefore exposed through litigation: it strengthens a retaliatory-dismissal claim before the Conseil de prud’hommes, where any retaliatory dismissal is void.
Must an employee report internally before going to an external authority? #
No. Since Loi Waserman, a whistleblower may go straight to an external authority without first using the employer’s internal procedure. This is a real change from the earlier regime, and it is why an internal procedure only helps if it is credible enough to be used first.
What deadlines must the internal procedure meet? #
An acknowledgement within 7 working days of the report, and feedback to the reporter within no more than 3 months of the acknowledgement (décret n° 2022-1284, art. 4). These deadlines follow the model of Directive (EU) 2019/1937.
Who is the competent external authority in France? #
France has no single external authority. The Défenseur des droits orients and protects whistleblowers, and the sectoral authorities listed in décret n° 2022-1284 receive reports within their remit. The Défenseur des droits counted more than 10,000 external reports in 2025, against about 2,000 in 2023.
Can a whistleblower stay anonymous? #
Yes. A report may be made anonymously, and if the reporter’s identity is revealed later, they receive the same protections (Article 7-1 of Loi Sapin 2). The employer’s internal procedure must state how anonymous reports are handled.
Which facts are excluded from protection? #
Facts covered by national defence secrecy, medical secrecy, the secrecy of judicial deliberations, the secrecy of judicial investigations, and lawyer–client privilege (Article 6, II of Loi Sapin 2).
How do you set up the whistleblowing procedure? #
First consult the staff representative bodies. Then appoint the people who will receive reports, with sufficient competence, authority and means, or entrust this to a third party. Open a written or oral reporting channel, with a meeting within 20 working days if the reporter asks. Plan acknowledgement within 7 working days and feedback within 3 months. Finally, publish the procedure permanently and accessibly (décret n° 2022-1284).
Does the GDPR apply to reports? #
Yes. A report contains personal data about the reporter, the person concerned and third parties mentioned, and processing it falls under the GDPR. The procedure must keep all three categories confidential. The competent authority for problems is the CNIL.