Whistleblowing policy – which companies need one and what should it contain?

By Mallbutiken · Facts checked 30 September 2026 · Approximately 9 minutes reading time

Operators who had 50 or more employees at the beginning of the calendar year must have internal reporting channels and procedures for reporting and follow-up in accordance with the Whistleblowing Act. The law does not require the document to be titled "Whistleblowing Policy," but the procedures must be documented in writing, and the business needs clear information on how the system functions.

Which companies must have internal whistleblowing channels?

According to Chapter 5, Section 2 of the Act (2021:890) on the protection of persons who report misconduct, the obligation applies to an operator that had at least 50 employees at the beginning of the calendar year.

The Swedish Work Environment Authority (Arbetsmiljöverket) states that all forms of employment are counted when determining the number of employees. It is therefore important to make the assessment based on the actual workforce at the beginning of the year, and not only the number of permanent employees.

50–249 employees

Private operators with 50–249 employees may, under certain conditions, share internal reporting channels and certain procedures with each other. This does not remove the individual business's responsibility to fulfill the requirements of the law.

Fewer than 50

The general obligation in Chapter 5, Section 2 does not affect businesses below the threshold. A smaller company may still voluntarily have a reporting channel or be subject to other specific rules depending on the business. If a system is introduced voluntarily, it should be clear how reports are handled and which rights and limitations apply.

Whistleblowing policy and reporting routine serve different functions

The law focuses on ensuring that channels and procedures function and are documented – not on the exact document name. For the user, it often becomes clearer if the policy and the internal handling routine are kept separate.

How should internal reporting channels function?

The channels must make it possible to report both in writing and orally, and, if the reporting person requests it, at a physical meeting within a reasonable time.

Acknowledgment within seven days

As a main rule, the reporting person must receive acknowledgment that the report has been received within seven days. Exceptions apply if, among other things, the person has waived the acknowledgment or if the recipient has reason to assume that an acknowledgment would reveal the person's identity.

Feedback within three months

Feedback must be provided to a reasonable extent regarding follow-up measures and the reasons for them within three months from the acknowledgment. If no acknowledgment has been provided and this is not due to the reporting person, the deadline is calculated according to the law's specific rule from seven days after receipt.

Who may handle whistleblowing reports?

The operator must appoint independent and autonomous persons or units authorized to receive reports, maintain contact with reporting persons, follow up on the reported matter, and provide feedback.

These can be internal persons or an external party hired for the task. At the same time, the organization needs to plan for conflicts of interest. A report about the person who normally handles cases must be capable of being directed to someone else.

Limit access

Identity information and other sensitive case data should not be accessible to the entire HR, management, or IT organization. Access must be limited to authorized personnel, and systems need to be designed so that confidentiality and traceability can be maintained.

Whistleblowing and personal data

Whistleblowing cases often contain information about the reporting person, persons who are identified, and other affected parties. The Whistleblowing Act contains specific rules on personal data processing that interact with the GDPR.

The Swedish Authority for Privacy Protection (IMY) states, among other things, that only personal data necessary for the follow-up case may be processed, that data that is clearly not relevant must be deleted as soon as possible, and that personal data, as a main rule, may not be processed for more than two years after the case has been closed. Specific archival rules may affect public operations.

If an external provider operates the channel and processes personal data on your behalf, the roles according to the GDPR need to be assessed. Read when a data processor agreement is needed.

What should a whistleblowing policy and routine contain?

• Purpose and which reports are covered.
• Who can use the channels.
• How written, oral, and physical reporting is carried out.
• Contact methods and technical channels.
• Which persons/units are authorized.
• How independence and conflicts of interest are handled.
• Acknowledgment, follow-up, and feedback.
• How identity and other information are protected.
• Rules against reprisals and information about the protection.
• Personal data, access, deletion, and documentation.
• How external reporting channels at competent authorities can be used.
• How cases are closed, reported internally, and followed up at an aggregated level.

Inform about more than just the internal link

The law requires clear and easily accessible information on how internal reporting is conducted, how reporting can be done to the external channels of competent authorities, and relevant information about, among other things, the freedom of communication and the freedom of acquisition where applicable.

Common mistakes

• A general HR inbox is used as a channel. Authorization and independence can become unclear.
• Only web forms are offered. The law requires more reporting methods.
• No one owns the deadlines. The seven days and three months must be operationally manageable.
• Too many people have access to the case. Limit access and document responsibility.
• The policy promises total anonymity in all situations. Formulate protection and confidentiality correctly based on the actual system and the law.
• Personal data is saved without a plan. Define deletion and legal handling from the start.

Do you need to document policy and handling?

Mallbutiken's package includes a whistleblowing policy, reporting and follow-up routine, reporting form, investigation protocol, and implementation checklist in Word/PDF. Price in store: 199 SEK.

See the whistleblowing package

Frequently asked questions

Must the company have a policy if it has 50 employees?

The law requires internal reporting channels and procedures as well as written documentation of the procedures. It does not require a specific document to bear the heading "policy".

Can HR alone handle all reports?

Not automatically. The authorized persons or units must be independent and autonomous in the sense of the law. The organization also needs to handle conflicts of interest.

Is it allowed to use an external whistleblowing service?

Yes, the law allows authorized persons to be employed by someone hired for the handling. The operator still needs to ensure that the law's requirements and data protection are met.