The Swedish Whistleblowing Act (2021:890) requires companies to set up an internal channel where employees can safely report suspected wrongdoing, without risk of retaliation. Since December 2023 the requirement has applied to every employer with at least 50 employees, private and public alike. Plenty of growing companies pass that line without noticing, and only discover the requirement when a customer or a tender asks about it. This guide covers whether it applies to you, what the channel has to do, and how to get started without unnecessary bureaucracy.
This is practical guidance rather than legal advice: always check what applies to your particular operation.
Does it apply to you?
The threshold is 50 employees. At 50 or more, you are required to have an internal reporting channel in place. The requirement was introduced in stages, larger employers first, and from 17 December 2023 companies with 50 to 249 employees as well.
Below 50 you do not need your own channel, but the Act’s protection against retaliation still covers anyone who reports. Some sectors, financial services and anti-money-laundering work among them, can be caught whatever their size. Count permanent, fixed-term and part-time staff when working out whether you reach 50. The 50 mark is also only one of several thresholds that arrive as a company grows, which we set out in what lands at 10, 25 and 50 employees.
What the channel has to do
The Act is specific about what the channel must deliver:
- Independent handling. Appoint named people or a function to receive and follow up cases independently, with no conflict of interest. Many companies solve this with an external service.
- Confidentiality. The person reporting is protected: their identity is confidential and may only be disclosed in exceptional cases.
- Acknowledgement within 7 days. Receipt of the report has to be confirmed within seven days.
- Feedback within 3 months. Within three months the person reporting has to be told what action has been taken.
- More than one way to report. It has to be possible to report both in writing and verbally, and the option to be anonymous strengthens trust in the channel.
- Documentation and data protection. Cases have to be documented and personal data handled under the GDPR. The groundwork is in the GDPR for smaller companies.
Checklist: are you ready?
The Whistleblowing Act: a quick check
Getting started
You do not need to build a department for this. Start by settling the channel: an internal function or an external service that receives cases impartially. Then write a short whistleblowing policy covering who can report, how it works, what protection applies and which deadlines you keep. Appoint case handlers who are independent, and tell everyone that the channel exists and how it is used. Finally, set a routine for deadlines and documentation so the seven-day and three-month limits are met every time.
The whistleblowing channel belongs with the rest of your HR documentation. How to lay that foundation as you grow is covered in HR compliance for growing companies, and where the rules are communicated in practice in the Employee Handbook.
Is your whistleblowing channel in place?
You get a position per area, including whistleblowing and the documentation the Act requires.
