The internal reporting channel duty in Belgium
Belgium transposed Directive (EU) 2019/1937 with Loi du 28 novembre 2022 sur la protection des personnes qui signalent des violations au droit de l'Union ou au droit national constatées au sein d'une entité juridique du secteur privé / Wet van 28 november 2022 betreffende de bescherming van melders van inbreuken op het Unierecht of het nationale recht vastgesteld binnen een juridische entiteit in de private sector, Moniteur belge / Belgisch Staatsblad 15 December 2022, p. 97213 (numéro 2022042980); modified by the laws of 9 February 2024 and 15 July 2026. (Act of 28 November 2022 on the protection of persons who report breaches of Union or national law established within a private sector legal entity). Below is what the national act itself says, with the sources, so your counsel can check every line.
2023-02-15 (article 57: two months after publication in the Moniteur belge on 15 December 2022)
50 or more workers. Article 11(2): paragraph 1 does not apply to private sector legal entities with fewer than fifty workers („qui comptent moins de cinquante travailleurs“). Headcount is the average number of workers employed in the undertaking, calculated each year on 1 January using the social-elections method (art. 7 §§1-2 of the Act of 4 December 2007), with the four quarters of the preceding calendar year as reference period (inserted by the Act of 9 February 2024, in force 31 March 2024). The under-50 exception does not apply to entities within the scope of the provisions on financial services, products and markets or the provisions listed in article 4, 1° (AML/CTF, including the Act of 18 September 2017 and Regulation (EU) 2015/847), those have no threshold. Article 11(5) lets the King impose the duty on entities with fewer than fifty workers by decree after a risk assessment.
17 December 2023. Article 57 paragraph 2: the provisions of Chapter 3 apply to private sector legal entities with 50 to 249 workers from 17 December 2023. Paragraph 3 excludes from that deferral entities falling within the financial services, products and markets provisions and the article 4, 1° provisions, which were bound from 15 February 2023.
Mandatory at 250+ workers, optional below. Article 8(2): „Les entités juridiques du secteur privé, les autorités compétentes et le coordinateur fédéral acceptent les signalements anonymes de violations et en assurent le suivi. Par dérogation à l'alinéa 1er, les entités juridiques du secteur privé qui comptent moins de 250 travailleurs ne sont pas tenues d'accepter les signalements anonymes.“ So entities with 250 or more workers must accept anonymous reports and follow them up; entities with fewer than 250 workers are not obliged to accept them. Article 12 confirms that diligent follow-up by the reporting manager includes anonymous reports. Article 8(3) protects anonymous reporters who are later identified and retaliated against. This is the strictest anonymity rule.
Not confirmed from a primary source. We check this before you sign anything.
The statutory base of EUR 600 to EUR 6,000 in art. 33 § 2 is correct and unamended. The ×8 conversion is not. For offences committed between 1 February and 31 August 2026 the multiplier was 10 (EUR 6,000 to EUR 60,000). For offences committed from 1 September 2026 the position is unresolved, see the unverifiable entry. Publish the statutory range EUR 600 to EUR 6,000 plus the words "increased by the décimes additionnels", and drop the converted figure.
Yes, expressly. Article 11(4): reporting channels may be managed internally by a reporting manager („gestionnaire de signalement“) or provided externally by a third party („fournis en externe par un tiers“). In both cases the private sector legal entity remains the data controller, and the safeguards and requirements of article 12 apply equally to third parties mandated to run the channel on its behalf.
Belgium-specific procedural trap: article 11(1) requires internal channels and procedures to be established AFTER consultation of the social partners (works council, or failing that the trade union delegation, the CPPT, or the workers). Skipping that consultation is itself a Chapter 3 defect. Resource sharing: article 11(4) permits entities with fewer than 250 workers to share resources for receiving reports and conducting investigations, without prejudice to their own duties on confidentiality, feedback and remedying the breach. Article 58: pre-existing alert systems set up under the article 4 legislation remained valid but had to be brought into conformity by the date of entry into force. Feedback deadline is three months from acknowledgement, or three months from the expiry of the seven-day acknowledgement window. Separate legislation covers the public sector (notably the Act of 8 December 2022 for federal public bodies and the integrated police), so the 28 November 2022 Act is private sector only. Practical point to verify per client: Belgian language legislation governs employer communications with staff and differs by region, so the channel's working language should be checked against the applicable regional regime rather than assumed.
One channel for a group that operates in more than one member state
A group with entities in Belgium and elsewhere in the EU does not get one law, it gets one per country: different rules on anonymous reports, different authorities, different deadlines and penalties. We set the channel up once and configure it per entity against each national act, from the same verified reference you are reading.