I have received a whistleblower report, what must I do now?

Confirm receipt within seven days, provide feedback within three months

When a report is received, the first step is clear: receipt is confirmed, and this must happen within seven days of the day the report is made. This is followed by the phase of assessment and, if necessary, further investigation. The person handling the report looks at what has been reported, gathers relevant information and determines what follow-up steps are appropriate given the nature of the report. From the moment the receipt confirmation is sent, a three-month period begins during which the reporter receives information about the assessment of their report — not three months from the report itself, but from the confirmation.

Who handles the report and how it is done is set out in the organization's internal reporting procedure. This procedure describes who has access to the report, how the confidentiality of the reporter's identity is maintained, and the steps by which a report is assessed. If a report is made anonymously, under Dutch law its handling is not mandatory; if a response is provided anyway, it proceeds via the case code with which the reporter can return if desired to follow progress. What does not change is that the assessment of the report remains with the employer itself: a hosted reporting channel registers, monitors deadlines and provides a handling environment, but does not qualify conduct and makes no judgment on the report.

Article 9 of the Directive and Article 2 WbK

This follows from Article 9 of EU Directive 2019/1937, which describes the procedure following receipt of a report, and from Article 2 of the Whistleblower Protection Act, which sets out receipt confirmation within seven days and information about the assessment within three months of that confirmation. The House for Whistleblowers provides guidance on its employers' page on what these steps involve in practice.