The internal reporting channel duty in Slovakia
Slovakia transposed Directive (EU) 2019/1937 with Zákon č. 54/2019 Z. z. o ochrane oznamovateľov protispoločenskej činnosti a o zmene a doplnení niektorých zákonov, v znení zákona č. 189/2023 Z. z. (transpozičná novela), zákona č. 157/2025 Z. z. a zákona č. 44/2026 Z. z. (Act No. 54/2019 Coll. on the Protection of Whistleblowers of Anti-Social Activity and on amendments to certain acts, as amended by Act No. 189/2023 Coll. (the Directive 2019/1937 transposing amendment), Act No. 157/2025 Coll. and Act No. 44/2026 Coll.). Below is what the national act itself says, with the sources, so your counsel can check every line.
Base Act No. 54/2019 Coll.: 1 March 2019. The Directive 2019/1937 transposing amendment, Act No. 189/2023 Coll.: 1 July 2023, except amendment points 19, 20, 27, 28, 42, 43 and 46, which include the rewritten § 10(1) scope provision and the § 19 penalty provisions, which entered into force on 1 September 2023.
§ 10(1) sets three parallel triggers: (a) an employer employing at least 50 employees; (b) no THRESHOLD, an employer providing financial services, services in the field of transport safety, or services in the field of the environment, whatever its headcount; (c) an employer that is a public authority employing at least five employees. § 10(3) extends a public authority's duty to budgetary and contributory organisations under its founding competence, state enterprises it founded, funds it administers, and 100% state-owned joint stock companies in which it exercises shareholder rights, where that legal person employs fewer than 50. In municipalities and higher territorial units the responsible person must be the chief controller (hlavný kontrolór).
No separate deadline. Slovakia required an internal reporting channel for employers with 50+ employees long before the directive, first under Act No. 307/2014 Coll., then under Act No. 54/2019 Coll. from 1 March 2019 (with a transitional duty in § 25(9) to align pre-existing systems by 30 September 2019). The directive-aligned version of § 10 applies to every covered employer, including the 50-249 band, from 1 September 2023. The directive's 17 December 2023 date has no counterpart in Slovak law.
Permitted and expressly contemplated, but NOT expressly mandatory. Nothing in § 10 obliges an employer to offer an anonymous reporting option or to investigate an anonymous report. The Act does recognise anonymity in two places: § 2(a) point 3 extends protection to a person who made a report anonymously and whose identity was subsequently revealed (added by Act No. 189/2023 Coll.), and § 11(1)(b) requires the report register to record the reporter's name, surname and residence "unless it is an anonymous whistleblower", wording that presupposes anonymous reports being received and registered within the internal system. The safe statement for a buyer: Slovak law protects anonymous whistleblowers once identified and clearly permits anonymous channels, but does not impose an express statutory duty to accept and follow up anonymous reports.
Úrad na ochranu oznamovateľov (Whistleblower Protection Office). Renamed from "Úrad na ochranu oznamovateľov protispoločenskej činnosti" by Act No. 189/2023 Coll. with effect from 1 July 2023; § 25a(2) confirms the two names denote the same body. The Office inspects compliance with §§ 10 and 11, grants or withholds consent to employment acts against protected whistleblowers, and imposes the fines under §§ 18-19. Reports may also be made to the body competent to receive them (prosecutor, administrative-offence authorities).
Obstruction is a direct, separately named offence in Slovak law. § 18(1)(c): "Priestupku sa dopustí ten, kto... sa pokúsi zabrániť alebo bráni urobeniu alebo zverejneniu oznámenia." § 18(2): the Office may impose a fine of up to EUR 6,000, and up to EUR 12,000 for a repeat offence committed within two years of a final decision on a prior one. § 10(10) is an additional employer duty layered on top of that, not the only route.
Yes, but only partly, and the split matters commercially. § 10(2): under a contract with the employer, a person who is not its employee may receive and acknowledge reports on the employer's behalf; the same person may ALSO investigate reports on behalf of an employer that is not a public authority and employs fewer than 250 employees. For employers with 250 or more employees, investigation must stay in-house, only intake and acknowledgement can be outsourced. In every case § 10(1) still requires the employer to designate its own responsible person (zodpovedná osoba) with the professional qualifications for the role, and § 10(2) states that outsourcing does not affect that duty.
Publication and 24/7 availability: § 10(5) requires the designation of the responsible person and the reporting methods to be published and accessible to all employees in the usual and readily available manner, with AT LEAST ONE REPORTING METHOD ACCESSIBLE CONTINUOUSLY, a de facto always-on channel requirement that suits an operated web or phone line. The employer must also make available, in concise, comprehensible, clearly formulated and easily accessible form, information about how to report to the competent external authority, about the protection available under §§ 3, 5 and 12, and about the internal verification system, and must facilitate the making of reports. Mandatory internal regulation: § 10(9) requires a written internal rule covering eight listed matters, including confidentiality of the identity of the reporter and of the person concerned, record keeping, processing of personal data in reports, remedial measures, and measures against obstruction of reporting. Independence: § 10(4) requires the responsible person to be able to act independently, bound only by the instructions of the employer's or the parent company's statutory body, protected from being penalised for performing the role, with adequate resources, access to personal data and documents, and ongoing maintenance of professional competence. Timelines: acknowledge within 7 days; verify and inform the reporter of the outcome and any measures within 90 days of acknowledgement. Records under § 11 are kept for three years.
One channel for a group that operates in more than one member state
A group with entities in Slovakia and elsewhere in the EU does not get one law, it gets one per country: different rules on anonymous reports, different authorities, different deadlines and penalties. We set the channel up once and configure it per entity against each national act, from the same verified reference you are reading.