Whistleblowing in Italy 2026: Employer Compliance Under Legislative Decree 24/2023

Whistleblowing Italy employers must now treat as a core compliance discipline, not an optional box-ticking exercise, because Legislative Decree 24/2023 has entered a phase of active enforcement. The decree transposes the EU Whistleblowing Directive into Italian law and imposes concrete, auditable obligations on private employers above defined size thresholds, public bodies and organisations operating a Model 231 compliance programme. For HR directors, in-house counsel and company owners with Italian operations, 2026 marks the point at which the Autorità Nazionale Anticorruzione (ANAC) and the Garante per la protezione dei dati personali expect mature, operational reporting channels backed by documented procedures.

This guide translates the statute into practical steps, explains when to use an internal channel versus the ANAC national portal, and maps the sanctions and data-protection risks that follow non-compliance.

Quick summary for employers

Under the whistleblowing framework in Italy, employers in the private sector that have employed an average of 50 or more workers over the previous year, all public-sector bodies, and organisations that have adopted an organisational and management model under Legislative Decree 231/2001 must establish secure internal reporting channels, guarantee the confidentiality of the reporting person, and prohibit any form of retaliation. Whistleblowing Italy employers face a layered reporting architecture: an internal channel operated by the organisation itself, the ANAC national portal as an external reporting route, and, in defined circumstances, public disclosure. Failure to implement compliant channels, obstructing reports, breaching confidentiality or retaliating against a reporting person can trigger administrative fines imposed by ANAC and aggravate corporate liability exposure.

The practical priorities for employers are clear: build a compliant internal channel, document every procedural step, align processing with the GDPR, and train the people who receive and investigate reports.

What is Legislative Decree 24/2023? A statute overview for whistleblowing Italy employers

Legislative Decree 24/2023 (D.Lgs. 24/2023, Normattiva) is the Italian measure that implements Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law. The decree was published in the Gazzetta Ufficiale and consolidates what had previously been a fragmented set of rules into a single, cross-sector regime covering both the public and private sectors.

The purpose of the legislation is twofold: to channel information about unlawful conduct through protected routes so that it reaches those able to act on it, and to shield the people who come forward from reprisals. The decree defines the categories of persons protected, the breaches that may be reported, the reporting channels that must be made available, and the confidentiality and anti-retaliation safeguards that attach to a report. For whistleblowing Italy employers, the decree is the single most important reference point, and every internal policy should map directly onto its provisions.

The decree does not operate in isolation. It sits alongside the GDPR and the guidance of the Garante, the Workers’ Statute (Statuto dei Lavoratori) and national collective agreements (CCNL), and, for many companies, the Model 231 compliance architecture. International best-practice benchmarks published through the OECD provide a useful comparator for employers that want to build channels resilient to cross-border scrutiny.

Scope and applicability for whistleblowing Italy employers

The decree applies across the public and private sectors, but the trigger for mandatory internal channels in the private sector is the number of employees. Private employers that have employed an average of 50 or more workers over the previous year must set up an internal reporting channel. Below that threshold, private employers are generally not obliged to create a channel unless another trigger applies, for example, operating in a regulated sector, or having adopted a Model 231. Public-sector administrations are covered regardless of size.

Two additional triggers frequently catch private employers off guard. First, organisations that fall within the scope of specific EU acts (such as financial services, anti-money-laundering, product safety and environmental protection) may be obliged to maintain channels even where they employ fewer than 50 people. Second, and critically, any private employer that has adopted an organisational model under Legislative Decree 231/2001 must provide a reporting channel in connection with that model, irrespective of headcount. The practical lesson for whistleblowing Italy employers is to assess applicability against every trigger, not headcount alone.

Key definitions employers must know

• Reporting person. The individual who makes a report. Protection extends beyond employees to self-employed workers, collaborators, freelancers, consultants, volunteers, trainees, shareholders and persons with administrative or supervisory functions. It also reaches people whose working relationship has ended, job applicants and, in defined circumstances, facilitators and colleagues connected to the reporting person.
• Reporting channels. The secure routes through which reports may be made, internal (operated by the organisation), external (the ANAC national portal) and, as a last resort, public disclosure.
• Confidentiality. The obligation to protect the identity of the reporting person, the person concerned and any third party named in the report, and to shield the content of the report from unauthorised access.
• Retaliation. Any direct or indirect act or omission, prompted by a report, that causes or may cause unjustified harm to the reporting person, including dismissal, demotion, disciplinary measures, non-renewal of contracts, and more subtle forms of professional detriment.

Which employers must act: thresholds and timelines

The applicability thresholds determine both whether an internal channel is mandatory and the compliance posture an employer should adopt. Private employers with an average of 50 or more employees, public-sector bodies and Model 231 adopters sit squarely within the mandatory scope. Employers near the threshold should monitor their average workforce over the reference year, because crossing 50 employees converts a best-practice recommendation into a statutory obligation.

On timelines, whistleblowing Italy employers should treat the obligations as already live rather than prospective. The internal channel must be operational, documented and communicated to the workforce. Employers that have not yet implemented a channel should prioritise three immediate actions: designate a channel manager or committee, publish an internal reporting policy, and ensure staff know how to make a report. Multinationals with Italian subsidiaries should resist the temptation to rely solely on a global group hotline; a group channel can supplement but cannot by itself discharge the Italian internal-channel obligation unless it meets the decree’s confidentiality, access and follow-up requirements for the Italian entity.

Internal reporting channels: design and minimum requirements

The internal channel is the backbone of compliance. It must be designed so that any eligible person can report a breach securely and confidentially, receive confirmation that the report has been received, and be told the outcome within defined timeframes. The decree requires that the identity of the reporting person be protected and that access to reports be strictly limited to authorised personnel.

The channel may be managed internally, typically by a dedicated person, office or committee with adequate autonomy and training, or outsourced to a qualified external provider. Whoever manages it must be independent from the operational areas most likely to be implicated in reports, and must handle the process with impartiality. Reports must be accepted in writing and, at the reporting person’s request, orally, including through a meeting arranged within a reasonable period.

Two procedural deadlines anchor the workflow. The channel manager must issue an acknowledgement of receipt to the reporting person within seven days of receiving the report, and must provide feedback on the follow-up given to the report within three months of the acknowledgement (or, absent acknowledgement, within three months of the expiry of the seven-day period). Missing these deadlines undermines the integrity of the channel and exposes the employer to criticism in any ANAC inspection.

The following eight-point checklist can be lifted directly into an internal reporting policy:

• Eligible reporters and subject matter. State clearly who may report and what breaches fall within scope.
• Channels available. Provide at least a written channel and, on request, an oral channel, plus the option of an in-person meeting.
• Confidentiality guarantee. Commit expressly to protecting the identity of the reporting person, the person concerned and third parties named.
• Acknowledgement within seven days. Confirm receipt to the reporting person within seven days.
• Feedback within three months. Provide an update on follow-up within three months.
• Access controls. Restrict access to the report and supporting material to authorised, named individuals.
• Anti-retaliation statement. Prohibit retaliation and explain remedies and reporting routes for suspected reprisals.
• Retention and data protection. Define retention periods and align processing with the GDPR and Garante guidance.

Minimum tech and access controls

Technology choices directly affect confidentiality compliance. The reporting platform, whether a dedicated software tool, a secure web form or an encrypted mailbox, must prevent unauthorised persons from identifying the reporting person. Encryption in transit and at rest, strict role-based access, audit logging of who viewed each report, and segregation of whistleblowing data from general HR systems are all practical baselines.

Where an oral channel is offered by telephone or voice messaging, the recording or documentation of the conversation must be handled with equal care. Reports should never be stored on shared drives, circulated by ordinary email, or discussed outside the authorised circle. For whistleblowing Italy employers using an external provider, the contract must impose the same confidentiality, security and access standards and be backed by a data-processing agreement under the GDPR.

Investigation workflow and documentation

A defensible investigation follows a repeatable workflow: triage the report to confirm it falls within scope; acknowledge receipt within seven days; assess whether the matter requires internal investigation, escalation to another function, or referral to an authority; gather evidence proportionately and lawfully; interview relevant parties while preserving confidentiality; reach reasoned conclusions; and communicate feedback to the reporting person within three months. Every step should be documented contemporaneously, with decisions and their rationale recorded, so that the organisation can demonstrate that reports were handled diligently and impartially.

A common failure identified by practitioners advising on D.Lgs. 24/2023 implementation is not the absence of a channel but the absence of a documented process behind it, organisations that cannot show how a report was received, assessed and closed are the ones most exposed during an inspection. Treating documentation as part of the compliance product, rather than an afterthought, is among the most effective risk-reduction steps employers can take.

ANAC national whistleblowing portal: when and how to use it

The Autorità Nazionale Anticorruzione (ANAC) operates the national external reporting channel through its dedicated online platform, and publishes operational guidance on how the system works. The external channel is not a substitute for the internal channel; it is an alternative route that reporting persons may choose in defined circumstances. A reporting person may use the ANAC portal where no internal channel exists, where the internal channel does not comply with the requirements, where an internal report has not been acted upon, or where the reporting person reasonably believes that an internal report would not be effective or would expose them to retaliation.

For whistleblowing Italy employers, the key point is that reports may bypass the internal channel entirely and land directly with ANAC. This makes the quality of the internal channel a direct determinant of reputational and regulatory exposure: a well-run internal channel reduces the likelihood of external escalation, while a deficient one invites it.

Practical steps for portal submission

From the reporting person’s perspective, the ANAC portal process generally follows a clear sequence:

1. Access the portal. The reporting person navigates to ANAC’s dedicated whistleblowing platform via the authority’s website.
2. Submit the report. The report is entered through a secure interface that protects the reporter’s identity and allows supporting documents to be attached.
3. Receive a unique identifier. The platform typically issues a confidential code that allows the reporter to track the status of the report and communicate further without disclosing their identity.
4. Acknowledgement and follow-up. ANAC acknowledges receipt and processes the report, which may involve assessment, requests for further information, or referral to the competent authority.
5. Feedback. The reporter is given feedback on the handling of the report within the timeframes set by the framework.

Where a report concerns matters outside ANAC’s direct competence, ANAC may forward it to the relevant authority. Employers cannot access the ANAC portal to see reports made against them; the authority controls the process and may contact the organisation as part of its assessment. The practical implication is that employers should maintain clean, well-documented internal records so that they can respond credibly if ANAC makes contact.

Recordkeeping and notifications

Whether a report arrives through the internal channel or via ANAC, disciplined recordkeeping is essential. Employers should keep a secure register of reports handled internally, record the dates of acknowledgement and feedback, and retain investigation files for only as long as necessary. Reports and related documentation must be retained in line with data-protection principles and deleted when they are no longer needed for the purposes for which they were collected. If ANAC or another authority requests information, the organisation should route the response through its compliance or legal function to preserve confidentiality.

Data protection and confidentiality: GDPR and Garante guidance

Whistleblowing processing is personal-data processing, and the GDPR applies in full. The Garante per la protezione dei dati personali has made clear that organisations must identify a lawful basis for processing whistleblowing data, apply data minimisation, provide appropriate privacy information, implement robust security, and limit retention. The processing of reports frequently involves special-category data or data relating to criminal matters, which raises the bar for safeguards.

Practical compliance for whistleblowing Italy employers involves several concrete steps. The internal reporting policy should articulate the purposes of processing and the lawful basis relied upon. A data protection impact assessment should be considered given the sensitivity of the data. The Data Protection Officer, where one is appointed, should be involved in the design of the channel without being given routine access to the content of individual reports in a way that would compromise confidentiality. Privacy notices should explain how whistleblowing data is handled, while being careful not to undermine the confidentiality of reporters. Data should be stored securely, access logged, and retention periods defined and enforced.

How to redact and share investigation reports safely

Sharing investigation outputs, with management, disciplinary panels or external advisers, is a frequent point of data-protection failure. Reports should be redacted to remove the identity of the reporting person and any detail that could reveal it, unless disclosure is strictly necessary and permitted under the decree. Only the minimum information required for a legitimate purpose should be shared, and only with recipients who genuinely need it. Where cross-border transfers to a foreign headquarters are involved, employers must apply an appropriate transfer mechanism under the GDPR and ensure that the receiving entity maintains equivalent confidentiality and security. Pseudonymisation, access controls and clear handling instructions should accompany any shared material.

Protections for whistleblowers and anti-retaliation measures

The decree provides strong protections for reporting persons who act on reasonable grounds. Retaliation is prohibited, and the protection extends not only to the reporting person but also to facilitators, colleagues and relatives connected to them, and to entities owned by or linked to the reporting person. Prohibited retaliation covers dismissal, suspension, demotion, non-promotion, changes of duties or location, disciplinary sanctions, negative performance assessments, harassment and the early termination or non-renewal of contracts.

A crucial feature of the regime is the shifting of the burden of proof. Where a reporting person demonstrates that they made a protected report and subsequently suffered a detriment, it falls to the employer to prove that the detrimental measure was based on grounds unrelated to the report. This is a significant practical risk for employers: any adverse action taken against someone who has recently reported must be supported by robust, documented, independent justification. Remedies for retaliation can include reinstatement, compensation for damages and the nullity of retaliatory measures, and labour disputes are heard by the labour court (Giudice del Lavoro).

To prevent and detect retaliation, whistleblowing Italy employers should put monitoring in place: flag HR decisions affecting recent reporters for additional scrutiny, require documented justification for adverse measures, train managers on the prohibition, and give reporters a clear route to raise concerns about reprisals. A proactive anti-retaliation posture is both a legal safeguard and a cultural signal that reports are taken seriously.

Sanctions and enforcement risk

ANAC is the authority responsible for imposing administrative sanctions under the framework. Penalties can be imposed for retaliation against a reporting person, for obstructing or attempting to obstruct a report, for breaching confidentiality, and for failing to establish reporting channels or to adopt procedures for making and handling reports, or for adopting procedures that do not conform to the decree. Sanctions may also apply where the reporting person is found to have made a report with malice or gross negligence that turns out to be unfounded. The specific amounts are set by the decree and applied by ANAC; employers should confirm the current ranges, which are subject to the framework in force.

Beyond administrative fines, the enforcement risk is broader. The arrival of a report at ANAC, an inspection, or a publicised retaliation claim carries reputational consequences that can outweigh the financial penalty. For organisations operating a Model 231, deficiencies in the whistleblowing channel can weaken the defensibility of the entire compliance model. The mitigation strategy is straightforward in principle: implement a compliant channel, keep it demonstrably operational, act promptly on reports, correct deficiencies as soon as they are identified, and maintain evidence of training and oversight.

Interaction with Model 231 and corporate liability

Legislative Decree 231/2001 establishes the administrative liability of entities for certain offences committed in their interest or to their advantage by persons in positions of responsibility. A well-functioning whistleblowing channel is an integral part of a credible organisational model, because it provides the early-warning mechanism through which the organisation can detect and prevent predicate offences. The decree requires that the reporting channel be integrated with the Model 231 where one exists. For employers, this means the whistleblowing policy, the supervisory body’s role and the disciplinary system under the model must be aligned.

A channel that is neglected or circumvented not only attracts standalone sanctions but can also undermine the organisation’s ability to rely on its model as a defence to corporate liability.

Practical compliance checklist and templates

The following copy-ready checklist captures the essentials for whistleblowing Italy employers assembling or auditing a programme:

• Applicability assessment. Confirm whether the 50-employee threshold, a sectoral trigger or Model 231 adoption applies.
• Internal reporting policy. Publish a policy covering eligible reporters, subject matter, channels, confidentiality, deadlines and anti-retaliation.
• Channel manager. Appoint an independent, trained person, office or external provider to receive and handle reports.
• Secure platform. Deploy a confidential written channel, an oral option on request, encryption and role-based access.
• Procedural deadlines. Build in seven-day acknowledgement and three-month feedback steps.
• Data-protection alignment. Define lawful basis, retention, security and DPO involvement in line with Garante guidance.
• Anti-retaliation controls. Monitor HR decisions affecting reporters and document justifications for adverse measures.
• Training and audit. Train staff and managers, and schedule periodic audits of the channel.

A one-page version of this checklist can be circulated to HR and compliance teams as a quick-reference audit tool. The comparison table below contrasts the three reporting routes employers must understand.

Next steps for employers: audit, training and integration

A phased implementation plan keeps the programme on track. In the first 90 days, confirm applicability, publish the internal reporting policy, appoint the channel manager and deploy a secure platform. By 180 days, complete staff and manager training, finalise the data-protection documentation with the DPO, and integrate the channel with any Model 231 and disciplinary systems. Within 365 days, run a full audit of the channel, testing acknowledgement and feedback timeliness, access controls, retention compliance and anti-retaliation monitoring, and refresh training. Training should be repeated periodically and whenever the policy or channel changes, and audit KPIs should track response times, case outcomes and the absence of confidentiality breaches.

Conclusion

Whistleblowing Italy employers now operate in a mature enforcement environment where Legislative Decree 24/2023 is actively supervised by ANAC and intersects with GDPR obligations overseen by the Garante. The obligations are concrete: a compliant internal channel, confidentiality safeguards, strict adherence to the seven-day acknowledgement and three-month feedback deadlines, a robust anti-retaliation posture, and integration with Model 231 where relevant. Employers that treat compliance as a documented, audited process, rather than a static policy, will substantially reduce their exposure to administrative fines, reputational harm and corporate liability. For a tailored review of your reporting channels, policies and data-protection alignment, consult the Practice area, Employment (Italy) page or find a specialist through the GLE lawyer directory, Employment lawyers in Italy.

Sources

1. Legislative Decree 24/2023 (Normattiva)
2. EUR-Lex, Directive (EU) 2019/1937
3. ANAC, Autorità Nazionale Anticorruzione
4. Gazzetta Ufficiale
5. Garante per la protezione dei dati personali
6. OECD