A new chapter for Dutch whistleblowing
Since the Dutch Whistleblower Protection Act (Wet bescherming klokkenluiders, Wbk) came into force in 2023, some of its most significant provisions have yet to be enforced, but this is about to change.
The Dutch government is preparing an amendment bill that will introduce mandatory anonymous reporting and give the Huis voor Klokkenluiders (Dutch Whistleblowers Authority) the power to supervise compliance and sanction organizations that fail to meet key whistleblowing obligations. Until the bill is published, employers with 50 or more employees will have time to review their whistleblowing arrangements before enforcement begins.
Why the law is changing
The Dutch Whistleblower Protection Act entered into force on 18 February 2023, replacing the previous whistleblower legislation and implementing the EU Whistleblower Directive. Two important elements, however, were deliberately left dormant: mandatory anonymous internal reporting and the supervisory powers of the Huis voor Klokkenluiders.
A 2024 legal review commissioned by the government concluded that the second of these, the supervisory and sanctioning provisions, was not legally tenable in its current form. The amendment bill is intended to resolve this while activating the enforcement framework that has remained dormant since the Act came into force.
If the amendment bill is adopted, the Huis voor Klokkenluiders could begin supervising compliance and imposing sanctions from late 2027. For employers, the challenge is no longer simply implementing a whistleblowing procedure, but being able to demonstrate that it works.
What will change for organisations?
Enforcement becomes a practical reality
Until now, compliance has relied largely on organisations implementing the rules themselves. Employees and works councils can already ask the sub-district court to order an employer to establish a compliant reporting procedure, but enforcement currently depends on someone bringing a claim. No regulator can act on its own initiative. Once the amendments take effect, failing to meet key requirements could lead to administrative enforcement by the Huis voor Klokkenluiders.
Although sanction levels have not yet been published, enforcement is expected to focus on the fundamentals of an effective whistleblowing program: a compliant internal reporting procedure, compliance with statutory information duties, protection against retaliation and safeguarding the confidentiality of a reporter’s identity. The expectation is shifting from having policies in place to demonstrating that reports are handled consistently, confidentially and within the statutory deadlines.
Preparing for anonymous reporting
One of the most significant changes is the proposed requirement for employers to accept internal reports from individuals who choose not to identify themselves. The detail of that requirement was first published as draft secondary legislation. Following feedback from the Advisory Board on Regulatory Burden, its final form is now expected in the upcoming amendment bill itself.
Many organisations already allow anonymous reporting, but accepting anonymous reports is only the first step. Effective investigations still depend on being able to continue the conversation. Follow-up questions, requests for supporting evidence and clarification are often essential to establishing what happened. Without secure, confidential two-way communication, investigations become more difficult and valuable information may never come to light.
The amendments are also expected to require organisations to appoint an independent officer responsible for receiving anonymous reports, reinforcing the need for strong governance alongside appropriate technology.
Reviewing a reporting channel should involve more than confirming that anonymous reports can be submitted. They should also consider whether they can maintain secure, confidential communication throughout an investigation while preserving the reporter’s anonymity.
Technology alone won’t be enough
Preparing for the new requirements is not simply a technology project. Responsibility for whistleblowing often spans compliance, legal, HR, internal audit and senior management. Clear ownership, well-defined responsibilities and consistent decision-making are just as important as the reporting platform itself.
Changes to whistleblowing procedures may also require consultation with the Works Council (Ondernemingsraad). Factoring this into implementation plans early can help avoid delays once the legislation is finalised.
What good preparation looks like
Although the amendment bill has not yet been published, organisations do not need to wait before reviewing their whistleblowing arrangements. The strongest programs will be those that focus on effectiveness, not simply legal compliance.
Look at the process through the employee’s eyes
How easy is it for someone to raise a concern? Can reports be submitted anonymously? Can investigators continue communicating securely if additional information is needed? A reporting channel only creates value if employees trust it enough to use it.
Know who owns what
Effective whistleblowing programs depend on clear accountability. Review who receives reports, conducts investigations, protects confidentiality, communicates with reporters and oversees the program as a whole. That clarity will become even more important if organisations are required to appoint an independent officer to receive anonymous reports.
Engage the Works Council early
Changes to whistleblowing procedures may require Works Council consent under Article 27(1)(m) of the Dutch Works Councils Act (WOR). Early engagement helps build consensus, reduces implementation delays and makes organizational change easier to manage.
Prepare for regulatory scrutiny
As supervision increases, organizations may need to evidence more than the existence of a whistleblowing policy. They should be able to evidence how reports are acknowledged within the required seven days, how investigations are managed, how feedback is provided within the statutory three-month timeframe, how confidentiality is protected and how decisions are documented throughout the process.
They should also be prepared for retaliation claims, where Dutch law already places the burden on employers to demonstrate that any disadvantage suffered by a reporting person is unrelated to the report.
When enforcement begins, organisations will need evidence, not simply policies. Robust documentation and audit trails will make compliance easier to demonstrate and investigations easier to defend.
Key implementation timeline
| Date | Milestone | Status |
|---|---|---|
| 18 February 2023 | Dutch Whistleblower Protection Act enters into force | Completed |
| 17 December 2023 | Compliance deadline for employers with 50–249 employees | Completed |
| May 2024 | Government legal review submitted to Parliament | Completed |
| August 2024 | Consultation on draft secondary legislation on anonymous reporting | Completed |
| 21 January 2025 | Parliament adopts motions encouraging earlier activation of enforcement provisions | Completed |
| 3 March 2025 | Implementation review of the Act submitted to Parliament | Completed |
| 10 July 2025 | Government confirms amendment bill is being prepared | Completed |
| 2026 | Statutory evaluation of the Act and support schemes | Ongoing |
| Not yet scheduled | Amendment bill expected to consultation and Parliament | Expected |
| 2027 | Huis voor Klokkenluiders expected to begin supervision and enforcement | Expected |
Looking ahead
The proposed amendments do not change the purpose of the Dutch Whistleblower Protection Act. They do, however, mark the beginning of a more active enforcement regime and raise expectations around how organizations implement and manage their whistleblowing programs.
As the legislation progresses, organizations should continue monitoring the outcome of the 2026 statutory evaluation and the publication of the amendment bill, which are expected to provide greater clarity on the final implementation requirements.
For Dutch employers, the real shift lies in the move from voluntary compliance to active regulatory scrutiny. Regulators are likely to look beyond the existence of policies and focus on how effectively concerns are received, investigated and resolved. Organisations that strengthen their governance, reporting processes and documentation now will be well placed when enforcement begins.
