Whistleblowing Policy + Reporting Procedure Template 2026 – Word/PDF

Whistleblowing Policy + Reporting Procedure 2026 – Complete Template Package

A professional package for Swedish employers needing to introduce, document, or update their internal whistleblowing function. The package is designed for practical use and combines a whistleblowing policy, internal reporting procedure, reporting form, investigation protocol, and operational checklist.

The documents have been legally reviewed against the applicable Whistleblowing Act (2021:890), Ordinance (2021:949), GDPR, current guidance from the Swedish Work Environment Authority and the Swedish Authority for Privacy Protection (IMY), and the EU Whistleblowing Directive.

You will receive 4 professionally designed documents in both Word and PDF formats, totaling 15 A4 pages, as well as a separate README with recommended implementation steps and key legal sources.

Included

• Whistleblowing Policy + Internal Reporting Procedure – master template for the organization's governance and process
• Whistleblowing Report – Form – structured template for those who wish to report
• Investigation and Case Protocol – internal working document for the authorized whistleblowing function
• Checklist for Authorized Function – brief operational guidance from receipt to closure

The main policy contains

• applicability control and the 50-employee threshold
• purpose, principles, and responsibilities
• what can be covered by whistleblowing
• which categories of persons are eligible to use the channel
• written, oral, and physical reporting
• customization fields for the organization's actual channels
• independent and autonomous authorized persons or units
• conflicts of interest and alternative reporting channels
• receipt and statutory deadlines
• preliminary assessment and triage
• investigation principles and investigation plan
• prohibition of obstructive measures and retaliation
• confidentiality and protection of identity
• personal data, GDPR, and access restrictions
• documentation of oral reports
• retention and disposal
• feedback to the reporting person
• external reporting to competent authorities
• internal information, training, and annual review
• implementation checklist
• legal sources and document control

Key legal requirements built into the template

Operators who had 50 or more employees at the start of the calendar year must have internal reporting channels and procedures. The internal channels must, among other things, enable written and oral reporting as well as physical meetings upon request. Authorized recipients must be independent and autonomous.

The template incorporates the procedural points that receipt must normally be acknowledged within seven days and that the reporting person must receive feedback on the follow-up within three months, subject to the exceptions and limitations provided by law.

GDPR and whistleblowing cases

The package contains a specific section for personal data processing. Only necessary personal data shall be processed in the follow-up case, access shall be restricted to authorized persons, and clearly irrelevant personal data shall be deleted as soon as possible. As a general rule, personal data in a follow-up case may not be processed for longer than two years after the case has been closed.

The template also notes that organizations with fewer than 50 employees that voluntarily implement a whistleblowing system need to conduct a specific data protection assessment, including when processing data regarding criminal offenses.

Reporting Form

The separate form makes it easier to obtain sufficient and relevant information without the reporting person needing to be familiar with legal terms. The form includes, among other things:

• contact details and request for feedback
• incident, location, and time period
• description of the malpractice
• sources and possible evidence
• immediate risk, ongoing damage, and risk of retaliation
• other relevant information

Investigation and Case Protocol

The internal protocol helps authorized persons work consistently and in a documented manner. It contains fields for:

• case ID and date of receipt
• 7-day acknowledgment and deadline for feedback
• conflict of interest and authorization check
• preliminary legal and factual assessment
• investigation plan
• action and contact log
• personal data and access
• assessment and conclusion
• feedback
• closure and disposal date

Checklist for Authorized Function

The short checklist serves as an operational support for the most important steps during the first 24 hours, by day 7, during the follow-up, by the three-month mark, and upon case closure.

Who is this package for?

The package is suitable for, among others, limited companies, corporate groups, industrial firms, e-commerce companies, SaaS and IT companies, consulting firms, staffing agencies, non-profit organizations, and other employers needing a clear system for internal whistleblowing.

Legal status reviewed 2026

Version 1.0 has been legally reviewed on September 27, 2026, against, among others:

• the Whistleblowing Act (2021:890)
• the Whistleblowing Ordinance (2021:949), amended up to and including SFS 2025:1157 at the time of review
• Directive (EU) 2019/1937 of the European Parliament and of the Council
• the General Data Protection Regulation (EU) 2016/679
• the Supplementary GDPR Act (2018:218)
• the Swedish Work Environment Authority's current guidance on internal reporting channels
• IMY's guidance on personal data processing in whistleblowing cases

Important regarding customization

Every organization must customize the template to its actual whistleblowing function, technical reporting channels, authorized persons, conflict of interest procedures, collective agreements, public access and secrecy regulations, and any sector-specific regulation. For public sector activities and certain regulated sectors, special requirements may apply.

The template is a professional working document and does not replace individual legal advice in a specific case.

Digital delivery

The product is delivered digitally as Word (DOCX) and PDF. No physical product is sent.

Frequently asked questions

Must all employers have a whistleblowing function?

No. The general obligation under the Whistleblowing Act applies to operators who had at least 50 employees at the start of the calendar year. However, special rules may apply in certain sectors.

Must it be possible to report anonymously?

The law sets extensive requirements for the protection of identity and confidentiality, but the template makes anonymous reporting a choice that the organization must decide upon and configure based on its channel. If contact details are missing, providing feedback and requesting additional information may be more difficult.

Can reporting take place via email?

The organization is responsible for ensuring that the reporting channel is secure and appropriate. Ordinary, unprotected email may involve risks of identity disclosure and should be carefully risk-assessed.

How long can a whistleblowing case be kept?

As a general rule, personal data in a follow-up case may not be processed for longer than two years after the case has been closed. Irrelevant information should be deleted earlier.