Why the Whistleblowing Act matters now
Whistleblowing is no longer a nice-to-have policy; for many employers it is a legal obligation. Sweden’s Whistleblowing Act (lag 2021:890 om skydd för personer som rapporterar om missförhållanden) implements the EU Whistleblowing Directive and requires organisations of a certain size to set up secure internal reporting channels. Employers that get this right protect their people, catch problems early and avoid the reputational and legal fallout of a mishandled report. Those that ignore it risk supervisory action and lost trust.
What is the Whistleblowing Act?
The Act gives legal protection to people who report suspected serious wrongdoing they encounter in a work-related context – employees, but also job applicants, contractors, trainees, volunteers and others. It protects them from reprisals such as dismissal, demotion or harassment, and it obliges many employers to provide a safe, confidential way to raise concerns internally. It came into force on 17 December 2021.
Who must have reporting channels?
Private and public employers with 50 or more employees must establish internal reporting channels and procedures. The threshold is assessed at the start of each calendar year. The obligation was phased in: employers with 250 or more employees have had to comply since 17 July 2022, and employers with 50 to 249 employees since 17 December 2023. If your headcount has crossed 50, the requirement now applies to you.
The most important requirements
Secure and confidential channels
You must offer channels that allow reports in writing, orally, or both, and that protect the identity of the reporter and anyone named. Access to reports must be limited to authorised, independent staff or an external partner.
Strict timelines for follow-up
You must acknowledge receipt of a report within seven days and provide feedback to the reporter within a reasonable time – at the latest three months from the acknowledgement. Someone impartial must be designated to handle reports and follow up diligently.
Protection against reprisals
Reporters who have reasonable grounds to believe the information is true are protected from retaliation. Any measure that disadvantages a person because they reported can expose the employer to damages.
Documentation and data protection
Reports must be documented and handled in line with GDPR, with personal data kept no longer than necessary and access tightly controlled.
Can smaller companies share resources?
Yes. Employers with 50 to 249 employees are allowed to share internal reporting channels and the resources for investigating reports, although contact with the whistleblower and the duty to give feedback must remain with each individual employer. Many organisations outsource the channel and case handling to an independent external partner, such as a law firm, to guarantee impartiality and confidentiality.
Practical example
A Swedish company grows from 45 to 60 employees during the year. At the start of the next calendar year it crosses the threshold and must have a functioning internal reporting channel. It engages an external provider to receive reports, appoints an impartial internal contact, and sets up a process to acknowledge reports within seven days and give feedback within three months. When an employee later reports a suspected procurement irregularity, the process ensures the matter is investigated properly and the reporter is protected.
Common mistakes companies make
The most common error is treating a generic HR email inbox as a compliant channel – it rarely meets the confidentiality and independence requirements. Others miss the seven-day acknowledgement and three-month feedback deadlines, appoint someone with a conflict of interest to handle reports, or fail to align retention and access with GDPR. Some assume the rules only apply to large corporations and overlook that the 50-employee threshold captures many mid-sized businesses.
Recommended actions
Confirm your employee count at the start of the year and whether you are in scope. Establish a secure channel that supports written and oral reports, and designate an impartial person or external partner to handle cases. Document your procedures, train managers on the ban on reprisals, and align your handling with GDPR. If you are between 50 and 249 employees, consider sharing resources or outsourcing the channel to keep it independent and cost-effective.
Frequently asked questions
Which employers must have a whistleblowing channel?
Employers with 50 or more employees, assessed at the start of each calendar year. The duty has applied to those with 250+ since July 2022 and to those with 50–249 since December 2023.
How quickly must we respond to a report?
You must acknowledge receipt within seven days and give the reporter feedback within a reasonable time, at the latest three months after the acknowledgement.
Can we outsource the reporting channel?
Yes. You may use an independent external partner, such as a law firm, to receive and handle reports. This can help guarantee impartiality and confidentiality, but you remain responsible for compliance.
Conclusion
Sweden’s Whistleblowing Act turns a good governance practice into a legal duty for employers with 50 or more staff. A well-designed channel protects your people, surfaces problems early and shields your organisation from liability and reputational harm. At Lawgent we help employers build compliant whistleblowing channels, draft the underlying policies and act as an impartial external handler of reports. Contact Lawgent to make sure your whistleblowing setup meets the law.
