The new Whistleblower Protection Act was approved on 20 December 2022 and will enter into force in the beginning of 2023. Pursuant to the new Act, organisations that regularly employ over 249 people must establish an internal reporting channel within three months of the act entering into force. Companies and some other organisations, mainly in the private sector, employing 50–249 people have until 17 December 2023 to establish a reporting channel. Organisations employing fewer than 50 people can adopt a reporting channel voluntarily.
24.1.2023
The new Whistleblower Protection Act is approved – here’s how to prepare for investigating reports
Eija Warma-Lehtinen, Rickard Langenskiöld & Ville Kukkonen
Related services
The Act is based on the EU Whistleblower Directive. It obligates large and medium-sized enterprises as well as public sector actors to establish an internal reporting channel through which the personnel, for example, can report suspected misconduct.
We discussed the basis and scope of application of the Act as well as establishing a reporting channel in our earlier blog. In this blog, we will focus on how companies should process the reports.
Confidentiality and time limits for acknowledgement of receipt
An organisation must acknowledge to the whistleblower that a report has been received within three days of receiving the report. It must also inform the whistleblower of the measures the report will lead to within three months of receiving the report. When providing this information to the whistleblower, the time and manner of reporting on measures must be evaluated on a case-by-case basis. In addition to the confidentiality obligations, any detriment to the internal enquiry or investigation, among other things, must be taken into account while also keeping the rights of the reported person in mind.
The identity of the whistleblower, the reported person and any information from which their identity can be deduced must generally be kept confidential. However, this may be deviated from in the situations and in the manner referred to in the Act. Organisations must be familiar with the confidentiality and data protection obligations set forth in the Act and the deviations thereof in order to ensure that reports are processed and investigated in accordance with the confidentiality and data protection regulations.
Investigating reports requires resources and expertise
The person in charge of the investigation can spend a considerable amount of time on even a simple report: the more complex and extensive the report, the more time it takes to carry out a thorough investigation.
Organisations should allocate sufficient resources for the investigation and assess in advance the situations in which external resources should be used in order to avoid bottlenecks. Insufficient resources may lead to a delay in the investigation. In a worst-case scenario, the whistleblower might become frustrated and report the issue through a reporting channel maintained by the authorities or even disclose the information publicly, in which case the organisation no longer has the opportunity to conduct an internal enquiry first.
Resourcing consideration should also include ensuring sufficient expertise. The investigators should be well-versed in the regulatory environment with respect to the content of the report. In addition to applicable legislation, the organisation’s own internal guidelines are essential. Although the requirements set for expertise vary and are dependent on the content of any individual report, organisations should consider in advance what expertise they have internally and where they can find the expertise they lack in specific cases. The key here is to consider these matters before adopting a reporting channel.
Plan the investigation process in advance
An effective and reliable internal investigation process requires clear rules. Organisations should analyse the investigation process by way of its main stages and draft a clear description of the process in advance, all the way from the pre-investigation stage to reporting and decision-making.
The process description should be flexible enough to adapt to investigating various issues but also sufficiently detailed and practical to be of use for the investigators. The process plan should also account for the documentation of the different stages and the investigation measures, so that in the event of a follow-up inspection, the measures taken and the grounds for the results of the investigation are clear.
The practical aspects of planning may include drafting task-specific checklists, for example. It may not be possible to estimate the extent of an investigation at the early stages, which is why the initial practical measures are often quite similar. On the other hand, any errors made at an early stage may affect the integrity of the entire investigation and the credibility of its conclusions. It may be impossible to correct these at the later stages of the investigation if the errors concern, for example, securing the material subject to the investigation or ensuring the integrity of said material. Checklists significantly decrease the risk of crucial measures not being taken or being taken too late.
Latest insights
Article published 3.3.2026 – Employment
The threshold for dismissal is lowered: what should be taken into account in practice?
Article published 6.5.2024 – Employment
Outsourcing company functions – four key points for success
Article published 15.3.2024 – Employment
Five questions concerning industrial actions
Article published 29.11.2023 – Employment
Whistleblowing and data protection – frequently asked questions
Tomi Kemppainen, Kim Parviainen & Eija Warma-Lehtinen
Mikko Hanni & Outi Tähtinen
Eija Warma-Lehtinen & Ville Kukkonen
Latest references
Aurevia and Labquality – Strategic reorganisation
We advised Aurevia Oy, a portfolio company of French private equity sponsor Mérieux Equity Partners, in a strategic reorganisation that involved splitting Aurevia and its parent companies into two independent groups of companies and reorganisation of its existing debt-financing arrangements. Following the reorganisation, the newly formed Aurevia continues as a leading provider of Contract Research Organization (CRO) and Quality Assurance and Regulatory Affairs (QARA) services, while the newly formed Labquality focuses on delivering External Quality Assessment (EQA) services. Aurevia serves operators in the medical devices, in vitro diagnostics and pharmaceutical sectors. Labquality’s customers include clinical laboratories and social and healthcare organisations. The reorganisation positions Aurevia and Labquality to allocate investments more effectively, accelerate growth within their respective customer segments, and respond to evolving market and client needs. The transaction was implemented through multiple parallel demergers and required comprehensive legal and tax structuring across several jurisdictions. Our team supported Aurevia throughout the planning and implementation phases, covering corporate, tax, employment law, and regulatory matters, as well as the optimisation of each group’s financing structure.
Case published 7.4.2026
VR – Supreme Court decision clarifies working time practices
We successfully represented VR Group before the Supreme Court in a case concerning the meal break practice of commuter train drivers. On 6 February 2026, the Supreme Court ruled in VR’s favour (decision KKO:2026:12), confirming that VR had the right to amend the commuter train drivers’ meal break practice in 2021 by rendering the break unpaid in accordance with the applicable collective agreement. This decision clarifies the interpretation of collective agreements and employment legislation as well as the limits of the employer’s right to direct work. Over 250 commuter train drivers challenged the unpaid meal break practice which VR introduced in April 2021. Before the change, meal breaks had a long history of being paid. The change was based on the train drivers’ collective agreement, which allows for meal breaks to be organised either as paid or unpaid time. The Supreme Court ruled that the scheduling and managing of breaks falls within the core area of the employer’s right to direct work. This increases the threshold for an established practice becoming a binding condition for the parties. Merely following a practice consistently and over a long period of time does not make the practice binding; instead, the employer’s intent to commit to the practice must be clearly evident from the employer’s conduct or other circumstances. As both alternatives – paid and unpaid – for organising meal breaks had been retained in the collective agreement despite other amendments over the years, it could not be considered that VR had intended to commit to the paid break practice and waive its right to direct work as regards break scheduling. It was also significant that the employment contracts explicitly referred only to the collective agreement as regards working time. The Supreme Court deemed that the employees’ paid meal break was not an established term of employment and that VR was entitled to change the practice based on the collective agreement. The employer had the right, by virtue of its right to direct work, to unilaterally change the meal break practice by choosing to apply the other arrangement permitted by the collective agreement.
Case published 3.3.2026
Life Finland – Administration of bankruptcy estate
Life Finland Oy, a retailer of natural products, other health-related products and cosmetics, filed for bankruptcy on its own initiative in June 2025, and our attorney, counsel Elina Pesonen was appointed administrator of the bankruptcy estate. Life Finland Oy was part of the international Life Group, and its parent company Life Europe AB was declared bankrupt in Sweden in June 2025. When declared bankrupt, Life Finland Oy had over 30 operational stores and almost 170 employees across Finland. In addition to the premises of the operational stores, the company had several other leased premises, such as retail premises it was vacating as well as office and warehouse spaces. The bankruptcy estate organised clearance sales in all of the company’s stores. The shutdown of the stores and the clearance sales were efficiently carried out in approximately two weeks in cooperation with the company’s country manager, regional managers and sales staff. The clearance sales yielded a significant liquidation result, and consumers bought nearly the entire inventory. The administration of the bankruptcy estate has required expertise in many areas. The proceedings have dealt with specialised issues such as cash pooling arrangements, intellectual property, franchising agreements, employment relationships and consumer creditors. In addition, the proceedings are notably international, as the estate administrator has organised the shutdown of operations and the liquidation of assets in close cooperation with the estate administrators of the Swedish Group companies. The cooperation has included, among other things, exploring opportunities for selling the business, the sale of intangible rights and the coordination of intra-group agreements.
Case published 9.12.2025
Merger of Oomi and Lumme Energia
We are acting as the joint legal advisor to Oomi Oy and Lumme Energia Oy in a transaction whereby Lumme Energia will merge with Oomi. As from the completion of the merger, the combined entity will be the largest electricity retail and service company in the Finnish market. In 2024, Oomi reported a turnover of EUR 373.9 million and had approximately 110 employees. Lumme Energia’s turnover for the same year was approximately EUR 314.6 million and it had approximately 50 employees. The transaction is primarily driven by the recent developments in the electricity market and the strategic goal to develop competitive products and services. Another key objective is to further enhance the customer experience, which is a shared value between the two companies. As a result of the merger, Lumme Energia’s customers will transfer to Oomi, and Lumme Energia will become one of Oomi’s shareholders. The completion of the transaction is subject to an approval by the Finnish Competition and Consumer Authority.
Case published 29.8.2025