The internal reporting channel duty in Lithuania
Lithuania transposed Directive (EU) 2019/1937 with Lietuvos Respublikos pranešėjų apsaugos įstatymas, 2017 m. lapkričio 28 d. Nr. XIII-804 (Vilnius). Nauja redakcija nuo 2022 m. vasario 15 d. (TAR, 2021-12-28, Nr. 2021-27360). Įgyvendinantis poįstatyminis aktas: Lietuvos Respublikos Vyriausybės 2018 m. lapkričio 14 d. nutarimas Nr. 1133 "Dėl Lietuvos Respublikos pranešėjų apsaugos įstatymo įgyvendinimo", kuriuo patvirtintas "Vidinių informacijos apie pažeidimus teikimo kanalų įdiegimo ir jų funkcionavimo užtikrinimo tvarkos aprašas". (Law of the Republic of Lithuania on the Protection of Whistleblowers No XIII-804 of 28 November 2017, in its new wording in force from 15 February 2022; implemented by Government Resolution No 1133 of 14 November 2018 approving the Description of the Procedure for Implementing Internal Channels for Reporting Information about Breaches and Ensuring Their Functioning). Below is what the national act itself says, with the sources, so your counsel can check every line.
2019-01-01 (original Act and Government Resolution No 1133); the restated version transposing Directive 2019/1937 entered into force on 15 February 2022
They exist. Aprašas para 7: private legal persons, other organisations and branches of foreign legal persons/organisations whose activity falls within the list of EU acts (and the Lithuanian acts implementing them) approved by the Minister of Justice, the list transposing Part I(B) and Part II of the Annex to Directive 2019/1937, must implement internal channels, with no headcount threshold. Also delete the research note itself: it must never appear on a public page.
No separate deadline. Lithuania did not use the Directive's 17 December 2023 deferral: the 50-or-more-employees duty has applied since 1 January 2019 under Government Resolution No 1133, and the restated Act has applied it since 15 February 2022.
Not the statutory route, and anonymous reporting does not attract protection. Article 4(8)(4) requires the person providing information about a breach to state "savo vardą, pavardę, asmens kodą arba gimimo datą, jeigu asmens kodo neturi, kontaktinius duomenis" (name, surname, personal identification number or date of birth, and contact details). What the Act guarantees is confidentiality, not anonymity (Article 2(5), Article 8(1)(2)). An organisation may technically receive an anonymous submission, but the person will not be recognised as a pranešėjas and the Act's guarantees will not apply. Article 4(4)(5) treats a risk that anonymity or confidentiality will not be ensured internally as a ground for going straight to the prosecutor.
Article 2(4) only defines the term 'kompetentinga institucija'. The designation of the Prosecutor's Office is Article 5(2): "Šiame įstatyme nustatytas kompetentingos institucijos funkcijas įgyvendina Lietuvos Respublikos prokuratūra." Its functions are listed in Article 5(1); the handling procedure and deadlines are in Article 6.
The provision is ANK Article 555¹ (555 with a superscript 1), a standalone article with four paragraphs, inserted by Law No XIII-1843 of 20 December 2018 (TAR 2018-12-28, i.k. 2018-21872). The amounts quoted are right for its paragraphs 1, 4 (140, 300; repeat 300, 500; identity disclosed or ban on detriment breached 1,000, 2,000; repeat 2,000, 4,000).
Yes, expressly, Aprašas para 15: an institution may purchase internal-channel administration services from other institutions providing such services or from external third parties (reporting-platform providers, auditors, trade union representatives or employee representatives), provided they ensure independence, confidentiality and data-protection compliance. Important limit: the third party's administration services do not extend to examining the reported information or taking decisions on it, and the institution must set up a clear internal system for examining reports and inform its employees about it.
Three reporting routes: the institution's internal channel, a direct report to the competent institution (the prosecutor), or public disclosure (Article 4(1)). Direct reporting to the prosecutor is permitted where any of seven grounds in Article 4(4) applies, including where the institution has no functioning internal channel (point 6). Internal deadlines are shorter than the Directive's minimum: the institution must acknowledge receipt within 2 working days and inform the reporter about the handling of the information, or refusal to handle it, within 10 working days of that acknowledgement (Article 4(2)); an institution not competent to assess the information must forward it to the prosecutor within 2 working days (Article 4(3)). Protection measures include a reward for valuable information and compensation for detriment, which are only available once whistleblower status is granted (Article 8(2)). The current consolidated wording of the Act is in force from 21 May 2025.
One channel for a group that operates in more than one member state
A group with entities in Lithuania and elsewhere in the EU does not get one law, it gets one per country: different rules on anonymous reports, different authorities, different deadlines and penalties. We set the channel up once and configure it per entity against each national act, from the same verified reference you are reading.