Whistleblower law in Italy #
Italy implemented Directive (EU) 2019/1937 through Legislative Decree No. 24 of 10 March 2023. Italy’s framework is commercially important because it combines the standard 50-worker threshold with a separate rule for organisations that have adopted a Model 231 compliance model.
Applicable law #
Who must establish an internal channel #
Private entities with at least 50 workers must establish an internal reporting channel. Italy also requires channels for entities that have adopted a Model 231 organisational and management model, even where they are smaller. Entities in the financial-services and anti-money-laundering, transport-safety, and environmental sectors are in scope regardless of headcount.
External reporting authority #
The official external authority is ANAC — when external reporting is available at all, the deadlines, and the fines it can impose.
Data protection authority #
For GDPR complaints relating to the handling of whistleblower data, the relevant authority is the Garante per la protezione dei dati personali .
Key compliance points #
- Italy’s Model 231 overlap means the market expects precise legal positioning rather than a generic “50-plus employees” message.
- The Italian regime is documentation-heavy: companies need a clear internal procedure, a designated handler setup and compliant privacy information.
- ANAC remains the central official reference point even when the report concerns a private entity.
Official sources #
- Legislative Decree No. 24 of 10 March 2023 — official text
- Normattiva — Italian legal text database
- ANAC — whistleblowing
- Garante privacy