What must be included in a whistleblower policy?

These elements should be included in a policy

A whistleblower policy describes how a report is received, who handles it, and what steps follow. The core is the internal reporting procedure: who can make a report, in what manner (in writing, orally, or by request in a conversation), and to whom it is submitted. It describes who receives and assesses the report — usually a designated official or an independent department — and how the confidentiality of the reporter's identity is protected. It must also state that an acknowledgment of receipt is provided within seven days, and that the reporter is informed within three months of that acknowledgment what has happened or will happen with the report.

A policy also describes the option to report without the reporter disclosing their name, even though this is not mandatory to offer in the Netherlands. What is also often included in a policy: which topics fall under the policy, how a reporter stays informed of progress, what happens if a report is also made externally, and how the organisation handles protection against retaliation against the reporter. A policy that only mentions a mailbox or email address without these elements does not meet the legal requirements.

The basis: Article 2 Wbk and Article 9 of the Directive

These elements follow directly from Article 2 of the Whistleblower Protection Act, which prescribes the content of the internal reporting procedure, including the seven-day deadline for acknowledgment of receipt (paragraph 2 point h) and the three-month deadline for information on the assessment (paragraph 2 point i). This provision is the Dutch implementation of Article 9 of Directive (EU) 2019/1937, which requires Member States to ensure the same elements — receipt, follow-up and feedback within a reasonable timeframe — in national legislation.