Yes, if you employ at least 50 people; public authorities are covered from five employees, and employers in financial services, transport safety or environmental services regardless of size. The system requires a designated responsible person, published reporting channels, an internal policy and a register of reports. Receipt must be acknowledged within seven days and investigation results communicated within 90 days. The Whistleblower Protection Office may impose a fine of up to EUR 50,000, or EUR 100,000 for employers with at least 250 employees.
The company has passed fifty employees, HR is asking about whistleblowing, and management is unsure whether this means another document for the drawer or an obligation backed by fines. The answer depends on employee numbers and the sector.
Who is subject to the obligation
Act No. 54/2019 Coll. on the Protection of Whistleblowers requires an internal system for investigating reports:
An employer employing at least 50 employees, an employer providing financial services, transport safety services or environmental services, and an employer that is a public authority employing at least five employees shall designate an organisational unit or a person within its organisation to perform the employer’s duties under paragraphs 5 to 8 and Section 11(1) (the “responsible person”).
— Section 10(1) of Act No. 54/2019 Coll. (unofficial English translation)
For an ordinary company, employee numbers are the only criterion; in the listed sectors, the obligation applies regardless of size. An external person may receive and acknowledge reports under a contract and, for an employer with fewer than 250 employees that is not a public authority, also investigate them (Section 10(2)). This does not remove the obligation to designate a responsible person.
What the system must contain
An internal system is more than a box in the corridor. It comprises a suitably qualified responsible person performing their duties independently (Section 10(1) and (4)), published reporting channels, an internal policy and a register of reports. The law requires a continuously available reporting method:
The identity of the responsible person and the methods for submitting reports must be published and accessible to all employees in a customary and readily available manner, with at least one reporting method accessible continuously.
— Section 10(5) of Act No. 54/2019 Coll. (unofficial English translation)
The internal policy sets out the details of submitting and investigating reports, confidentiality, recordkeeping, informing whistleblowers of the outcome, personal data processing and measures against obstruction of reporting (Section 10(9)). Reports must be kept on record for three years (Section 11(1)), and a whistleblower’s identity must not be disclosed without their written consent (Section 10(7)).
Deadlines run from day one
Receipt of a report must be acknowledged within seven days (Section 10(6)). The law allows 90 days to investigate and communicate the outcome:
An employer under paragraph 1 shall investigate the report and inform the whistleblower of the outcome and any measures adopted following the investigation within 90 days of acknowledging receipt, or, if receipt was not acknowledged, within 90 days after seven days have elapsed from receipt of the report.
— Section 10(8) of Act No. 54/2019 Coll. (unofficial English translation)
If the matter is referred to law enforcement or an administrative authority, the employer informs the whistleblower in advance and communicates the outcome within ten days of receiving it (Section 10(8)). Deadlines continue during holidays, so responsibility for receiving reports must be clear in advance.
What happens if the system is missing or ineffective
The Whistleblower Protection Office supervises compliance. For breaches of internal system duties, it may fine a company with at least 50 but fewer than 250 employees up to EUR 50,000, or up to EUR 100,000 where it has at least 250 employees (Section 19(2) and (3)). If an inspection identifies deficiencies and the employer fails to take corrective measures or submit a report on them, a further fine of up to EUR 30,000 may follow (Section 19(1)). For a repeated breach within two years, the Office may double the fine (Section 19(4)). Retaliation carries a separate fine of up to EUR 100,000 (Section 19(3)), and breaching confidentiality concerning a whistleblower’s identity is an administrative offence (Section 18).
How we can help
Our whistleblowing and reporting system service covers assessment of whether and to what extent you are a covered employer, an internal policy, reporting channel and the role of an external person. If other policies are also missing, we coordinate them through our internal regulations and policies service. Our external legal department can take over ongoing system administration and investigation of reports.
If a report has already arrived and deadlines are running, contact us today. Seven days to acknowledge receipt pass quickly.
This answer provides general information on the law as at 5 September 2026. It does not constitute legal services or replace an assessment of an individual case. The details of your situation may differ. Book a consultation to discuss them.
