Member States shall ensure that legal entities in the private and public sector establish channels and procedures for internal reporting and for follow-up that enable the entity's workers (and other persons) to report information on breaches.
In the private sector this obligation is determined by the number of employees of the entity, 50 or more, or the activities carried out (Article 8.3 and 8.4). The provision of article 8.7 must be taken into account. In the public sector, the obligation is imposed on all legal entities of the public sector, although Member States may exempt certain municipalities and entities from the obligation; Member States may also foresee that several municipalities share internal complaint channels or that these channels are managed by joint municipal authorities (Article 8.9).
Article 8 of the Directive
