> France's whistleblower framework under Loi Waserman: who needs an internal channel, how external reporting works, and which official authorities matter.

Source: https://ethicsportal.eu/whistleblower-laws/france/
Updated: 2026-08-19

---

# Whistleblower law in France

France implemented Directive (EU) 2019/1937 through **Loi n° 2022-401 du 21 mars 2022** ("Loi Waserman"), with the October 2022 decree setting the practical framework for internal and external reporting procedures. For most employers, the central threshold remains **50 employees**.

## Applicable law

- [Loi n° 2022-401 du 21 mars 2022 (Loi Waserman)](https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000045388745)
- [Service Public explainer for whistleblowers](https://www.service-public.gouv.fr/particuliers/vosdroits/F32031)

## Who must establish an internal channel

- **Private employers with 50 or more employees** must establish an internal reporting procedure (headcount assessed over two consecutive years).
- **Public legal entities and state administrations with at least 50 agents** — excluding municipalities under 10,000 inhabitants.
- Some entities with fewer than 250 workers may pool the collection and processing arrangement.

The obligation has applied since **1 September 2022** (implementing décret 2022-1284 of 3 October 2022). This 50-employee channel duty is separate from the Sapin II anti-corruption *compliance-programme* obligation (500 employees / €100M turnover, Art. 17), which the AFA enforces with much larger sanctions.

## Penalties and enforcement

France's framework is unusual: **there is no direct fine for simply failing to establish a channel.** The current Sapin II / Loi Waserman text imposes no sanction on a company for not setting one up, and the implementing decree contains no penalty provisions. Instead, penalties attach to specific *conduct*:

| Conduct | Individuals | Legal entities |
| --- | --- | --- |
| Obstructing the transmission of a report ("in any way whatsoever") | 1 year imprisonment + **€15,000** | **€75,000** |
| Discrimination / retaliation based on whistleblower status (Code pénal arts. 225-1/225-2) | 3 years imprisonment + **€45,000** | **€225,000** |
| Abusive or dilatory ("SLAPP") proceedings against a whistleblower | civil fine up to **€60,000** (plus damages) | — |

Verbatim, Article 13, I of [Loi 2016-1691](https://www.legifrance.gouv.fr/loda/id/JORFTEXT000033558528/): *"Toute personne qui fait obstacle, de quelque façon que ce soit, à la transmission d'un signalement … est punie d'un an d'emprisonnement et de 15 000 euros d'amende."* The same Article 13 (II) raises the *amende civile* for an abusive or dilatory action against a whistleblower to **60 000 euros**. There is **no article anywhere in the Sapin II / Waserman framework that fines an employer for failing to establish a channel** — confirmed against the consolidated Légifrance text and décret 2022-1284.

**An honest assessment of enforcement.** Not having a channel is not directly fined — but it is far from risk-free. A missing or defective channel creates **indirect exposure**: it strengthens a retaliation or wrongful-dismissal claim before the Conseil de prud'hommes, and feeds AFA scrutiny for large firms under the anti-corruption regime. Enforcement of whistleblower protection is primarily **reactive and judicial**: retaliatory dismissals are null and void by operation of law, and the labour court's summary judge can order reinstatement (Cass. soc., 1 Feb 2023, *Thales*, n°21-24.271, with the burden of proof shifting to the employer). The Défenseur des droits oversees protection. The practical lesson: the real cost of not having a proper channel shows up as litigation and reinstatement liability, not a fixed administrative fine.

## External reporting authority

France does not rely on one universal whistleblowing authority. The [Défenseur des droits](https://www.defenseurdesdroits.fr/orienter-et-proteger-les-lanceurs-dalerte-180) helps orient and protect whistleblowers, while competent sectoral authorities may receive external reports in their own remit.

## Data protection authority

For concerns about unlawful processing of personal data or confidentiality failures in the reporting process, the relevant authority is the [CNIL](https://www.cnil.fr/fr/saisir-la-cnil/lanceurs-dalerte-adresser-une-alerte-la-cnil).

## Key compliance points

- France no longer requires whistleblowers to report internally before using an external channel.
- The procedure must keep the identity of the reporting person, the person concerned, and named third parties confidential.
- French official guidance points to acknowledgment within 7 working days and feedback within 3 months as the standard operating timeline.

## The framework in practice

The Défenseur des droits — France's designated external reporting authority — published its first two-yearly review of the regime, *La protection des lanceurs d'alerte en France : un dispositif à l'épreuve de son appropriation*, on 28 May 2026. Two of its findings bear directly on how an internal procedure should be run:

- **External reporting has grown roughly fivefold.** The review records **more than 10,000 signalements in 2025**, against about **2,000 in 2023** — reports made to external authorities rather than through an employer's internal procedure.
- **Retaliation, not intake, is the recurring failure.** The Défenseur des droits reports witnessing frequent breaches of the statutory prohibition on retaliation, particularly in the employment relationship.

Reports cluster in health and medico-social services, environmental matters, and public integrity.

The practical inference for a French employer: since 2022 a reporter may go straight to an external authority, and the volume figures show they increasingly do. The question is no longer whether people will report, but whether the internal procedure is credible enough to be used first — and whether what happens after a report protects the person who made it. A procedure that satisfies the 7-working-day acknowledgment and 3-month feedback timeline but leaves a reporter exposed to retaliation fails on the axis the Défenseur des droits actually reports on.

## Official sources

- [Loi Waserman — official text](https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000045388745)
- [Service Public — lancer une alerte](https://www.service-public.gouv.fr/particuliers/vosdroits/F32031)
- [Loi Sapin II (Loi 2016-1691) — official text](https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000033558528)
- [Décret 2022-1284 (internal/external reporting procedures)](https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000046357368)
- [Défenseur des droits — orienter et protéger les lanceurs d'alerte](https://www.defenseurdesdroits.fr/orienter-et-proteger-les-lanceurs-dalerte-180)
- [Défenseur des droits — rapport bisannuel sur la protection des lanceurs d'alerte (28 May 2026)](https://www.defenseurdesdroits.fr/rapport-bisannuel-la-protection-des-lanceurs-dalerte-en-france-un-dispositif-lepreuve-de-son-1150)
- [Agence Française Anticorruption — les contrôles de l'AFA](https://www.agence-francaise-anticorruption.gouv.fr/fr/controles-lafa)
- [CNIL — adresser une alerte](https://www.cnil.fr/fr/saisir-la-cnil/lanceurs-dalerte-adresser-une-alerte-la-cnil)

---

[Deploy your reporting channel →](/pricing/)