The government proposal for the whistleblower legislation obligates large and medium-sized enterprises as well as public sector actors to establish an internal reporting channel through which, for example, the personnel can report suspected misconduct. The legislation is based on the EU Whistleblowing Directive.
11.10.2022
It is advisable to start preparing a whistleblowing channel now
Eija Warma-Lehtinen & Ville Kukkonen
Related services
As a general rule, the whistleblowing channel must be established in companies that employ at least 50 people
The new whistleblower legislation that is being drafted mainly obligates companies or public sector actors that employ at least 50 people to establish an internal reporting channel. Through the channel, the company’s employees, for example, can report suspected misconduct that concerns the violation of certain legislation, such as consumer protection, environmental protection, data protection or public procurement. When submitting a report, the whistleblower is protected in the manner required by the Act. The Act also provides a period during which the company can exclusively examine the reports.
At the moment, the Act is being discussed by Parliament, and it is to enter into force within three months from its approval. By then, companies that employ at least 250 people will have to adopt an internal whistleblowing channel. The government bill, however, includes a transitional period under which private sector organisations that regularly employ 50–249 people must adopt a whistleblowing channel by 17 December 2023 at the latest.
The whistleblower legislation is based on the EU Whistleblowing Directive, which must be implemented into national legislation by the EU Member States. In Finland, the drafting of the whistleblower legislation has been delayed from the original timetable. In some EU Member States, the Directive has already been implemented into national legislation.
Establishing an internal whistleblowing channel
The main purpose of the new regulation is to protect the whistleblower from retaliation and to provide the organization receiving the report an opportunity to appropriately investigate the suspected misconduct internally. Furthermore, the new legislation will set minimum requirements for the establishment of the whistleblowing channel and for the procedures for processing notifications, such as the processing times and confidentiality. The organisation can largely decide the technical implementation itself, and under certain boundary conditions, it is also possible to outsource the maintenance of the channel to a service provider. According to the proposal, companies that belong to the same group can under certain conditions establish a common reporting channel.
The regulation also creates new obligations to inform for the organisations. Stakeholders that are entitled to report suspected misconduct must, among other things, be informed of the internal whistleblowing channel, the possibility to report through an external reporting channel maintained by the authorities and of the requirements for protecting the whistleblower. In addition, the persons responsible for processing the reports must be appointed and trained in the processing.
Data protection obligations must be taken into account
Requirements based on data protection legislation and, with respect to the personnel, also on the Co-operation Act, must be taken into account so that the reports submitted through the reporting channel and personal data included in them can legally be processed. A whistleblowing channel that meets data protection obligations along with proper data protection documentation are key tools for an organisation to demonstrate that they are in compliance with legislation.
The processing of personal data collected through the whistleblowing channel is subject to the same privacy obligations as the processing of other personal data. For example, the legal basis and purposes for processing personal data as well as how long the data is stored must be defined in accordance with statutory requirements and any unnecessary personal data must be deleted. The individuals whose data is processed must also be informed of the processing, and the organisation must make sure that the statutory data subjects’ rights are respected. It is important to keep in mind that the new legislation sets certain exceptional limits to the rights of the data subjects. In addition, the Finnish data protection authority: Data Protection Ombudsman has ruled that controllers must conduct a data protection impact assessment on data processing relating to whistleblowing channels.
How to prepare for the new obligations?
A whistleblowing channel that meets the requirements of the new legislation protects the company as well as the whistleblower, because a whistleblowing channel makes it possible for the company to uncover misconduct and provides a period during which the company can exclusively process reports. Though the legislation is still being drafted, it is advisable to prepare for the adoption of a channel now. First, it is advisable to make an assessment of the necessary measures.
Latest insights
Article published 6.5.2024 – Employment
Outsourcing company functions – four key points for success
Article published 15.3.2024 – Employment
Five questions concerning industrial actions
Article published 29.11.2023 – Employment
Whistleblowing and data protection – frequently asked questions
Article published 22.2.2023 – Employment
Temporary agency work – 5 things all employers should be aware of
Tomi Kemppainen, Kim Parviainen & Eija Warma-Lehtinen
Mikko Hanni & Outi Tähtinen
Eija Warma-Lehtinen & Ville Kukkonen
Suvi Kettunen
Latest references
Merger of Oomi and Lumme Energia
We are acting as the joint legal advisor to Oomi Oy and Lumme Energia Oy in a transaction whereby Lumme Energia will merge with Oomi. As from the completion of the merger, the combined entity will be the largest electricity retail and service company in the Finnish market. In 2024, Oomi reported a turnover of EUR 373.9 million and had approximately 110 employees. Lumme Energia’s turnover for the same year was approximately EUR 314.6 million and it had approximately 50 employees. The transaction is primarily driven by the recent developments in the electricity market and the strategic goal to develop competitive products and services. Another key objective is to further enhance the customer experience, which is a shared value between the two companies. As a result of the merger, Lumme Energia’s customers will transfer to Oomi, and Lumme Energia will become one of Oomi’s shareholders. The completion of the transaction is subject to an approval by the Finnish Competition and Consumer Authority.
Case published 29.8.2025
HANZA – Acquisition of Milectria
We acted as Finnish legal advisor to HANZA AB in connection with its acquisition of the contract manufacturing division of Milectria, a group of companies specialising in electrical systems for the defence industry. The transaction comprises 100% of the shares in Milectria Oy (Finland), Milectria OÜ (Estonia), and the real estate company Kiinteistö Oy Kanungin Karhu. The transaction is expected to close in September 2025, subject to customary closing conditions, including regulatory approvals. Founded in 2008, HANZA is a Swedish mechanical engineering and electronics contract manufacturing company listed on the Nasdaq Stockholm main list. The company operating in seven countries currently has annual sales of approximately SEK 6 billion and approximately 3,100 employees. Milectria is a Finnish contract manufacturer of electrical systems for the defence industry.
Case published 21.7.2025
Nevel – Acquisition of Labio’s business
We advised Nevel Oy in its acquisition of the business of Labio Oy. Lahti Aqua Oy and Salpakierto Oy sold their entire shareholdings in Labio to Nevel, expanding Nevel’s already significant biogas portfolio. The transaction will have no impact on Lahti Aqua’s water utility operations or Salpakierto’s municipal waste management responsibilities. Labio’s operations and customer relationships will continue as before. ‘This partnership is a natural next step for us as we continue investing in sustainable material efficiency and renewable energy solutions. By integrating Labio’s comprehensive offerings and expertise, we can provide customers with a strong platform for material circularity. We are also strengthening our market position as one of Finland’s leading material efficiency solution providers,’ says Ville Koikkalainen, Director of Industrial and Biogas Business at Nevel. Nevel is an energy infrastructure company offering advanced, climate-positive solutions for industry and real estate. It operates more than 130 energy production plants and manages over 40 district heating networks. Nevel’s annual turnover is EUR 150 million, and it employs 190 experts in Finland, Sweden and Estonia.
Case published 16.7.2025
Pihlajalinna – Sale of special housing services
We advised Pihlajalinna Plc on an arrangement whereby Pihlajalinna Terveys Oy and Ikipihlaja Setälänpiha Oy sold their special housing services business to Esperi Care Oy. The transaction involved three Pihlajalinna Uniikki units in Hämeenlinna, Lohja and Riihimäki as well as Ikipihlaja Oiva in Raisio. As a result of the arrangement, more than 100 employees transferred to Esperi. Pihlajalinna is one of Finland’s leading private providers of social and healthcare services, offering a wide range of services to both private and public sector clients. Pihlajalinna has more than 160 locations across Finland.
Case published 2.6.2025