How long whistleblower reports must be kept in the EU, from three months in Cyprus to ten years in Spain
Whistleblower reports must be kept for three months in Cyprus and for up to ten years in Spain, and the EU has no single rule between the two. WeMoral put the period for all 27 member states side by side in its 2026 Report on Whistleblower Directive Transposition Across the EU. Fifteen member states name a number and eleven name none at all, while Belgium answers differently depending on which of its eight instruments applies. Directive (EU) 2019/1937 set no period, so the file's life is decided by national law and by whatever event starts the clock.
How long must whistleblower reports be kept in each EU country?
How long whistleblower reports must be kept in each EU country runs from three months to ten years. Spain is the longest at ten years, and that figure is a cap rather than a floor. Eight member states settled on five years and four chose three. Sweden keeps files for two years from closure, the shortest fixed term in the set. Cyprus is shorter again and sits in a class of its own, ordering deletion three months after a case closes. WeMoral took each period from the statute itself for its 2026 report, along with the event that starts the count.
| Country | Period | Clock starts |
|---|---|---|
| Spain | 10 years, a cap | Not stated, delete at 3 months if nothing is investigated |
| Austria | 5 years | Last processing step |
| Czechia | 5 years | Receipt |
| Finland | 5 years | Arrival |
| Italy | 5 years | Final outcome |
| Lithuania | 5 years, a minimum | Last decision |
| Portugal | 5 years, a minimum | Unstated, plus pending proceedings |
| Romania | 5 years | Registration, then destruction |
| Slovenia | 5 years | End of the procedure |
| Germany | 3 years | Case closure, extendable |
| Estonia | 3 years | Feedback |
| Poland | 3 years | Year end after follow up |
| Slovakia | 3 years | Delivery |
| Sweden | 2 years | Closure |
| Cyprus | 3 months | Closure, 1 year after proceedings |
What is the WeMoral 2026 report on the Whistleblower Directive?
The WeMoral 2026 Report on Whistleblower Directive Transposition Across the EU is a country by country comparison. It shows how all 27 EU member states wrote Directive (EU) 2019/1937 into their own law. WeMoral produced it in house, and WeMoral builds whistleblowing software for the channels those laws require. Each law was checked against 33 points, grouped in four parts. The table below shows what sits in each part. Every entry was read straight from the statute, one country at a time. A source list at the back names every act behind a figure, and points to the official text. A second pass checked each entry again. Where a national rule matches the directive, the report records the directive's own rule. An act that says nothing on a point is logged as silent, and no gap is filled in with the directive's default. The law in it is current to July 2026. Fines written in koruna, lev and leu are converted at fixed rates, and the national figure is the binding one. Anyone can download the report at no cost. Retention is one of the 33 points, and it is the one where the directive left the most room.
| Part | What it records for each of the 27 states |
|---|---|
| Scope | Employee thresholds, public bodies, the subject areas covered, and who is protected beyond the person reporting |
| Process | Internal and external channels, the acknowledgement and feedback deadlines, anonymity, outsourcing, and how long files are kept |
| Protection | The ban on retaliation, the burden of proof, remedies, and the treatment of a report that turns out to be wrong |
| Enforcement | Maximum fines on entities and people, criminal liability, and the authority that checks compliance |
Which EU countries set no retention period for whistleblower reports?
Eleven EU countries set no retention period for whistleblower reports at all. The table names them. Leaving it out is lawful, because the directive asks only that personal data be held no longer than is needed. Silence in the act hands the whole choice, and the job of defending it, to the employer. A few of the eleven leave a hint. Bulgaria passes the number to a data protection ordinance. Greece puts a floor at the end of proceedings. Hungary's five years applies only inside the ombudsman's own system. Belgium is a case apart, and its eight instruments do not agree with each other.
| States | What applies instead |
|---|---|
| Denmark, France, Ireland | Only what is needed, judged by the employer |
| Latvia, Malta | No period and no clock in the act |
| Croatia, Netherlands | General archive rules, or a duty to keep a register only |
| Bulgaria, Greece, Hungary, Luxembourg | Passed to an ordinance, or a partial rule only |
| Belgium | Ten years in Brussels and the federal public sector, five or ten in Wallonia, the working relationship in the private sector, archive rules in Flanders |
When does the retention clock start on a whistleblower report?
The retention clock starts on a whistleblower report at three different moments, depending on the country. Nine of the fifteen states with a fixed period start it once the case has been handled. Four start it the moment the report arrives. Two leave the trigger unstated. That choice moves the real storage time as much as the number does. Five years from arrival and five years from closure are not the same five years. A clock that runs from receipt is already ticking while the case is open. Austria counts from the last processing step, so fresh activity can restart it. Poland counts from the end of the calendar year in which follow up finished. Lithuania runs from the last decision, and its authority may extend the term. WeMoral recorded the trigger beside the period for every one of the fifteen, because a period without its trigger cannot be turned into a deletion date.
Is an EU retention period a floor or a ceiling?
An EU retention period is a floor in some member states and a ceiling in others. That is why one rule for a whole group tends to break. Portugal and Lithuania write their five years as a minimum, so a longer hold is fine there. Spain writes ten years as a cap. It adds deletion at three months where nothing is looked into. Cyprus reads closer to a delete order than to a duty to keep. An employer with staff in Spain and Portugal has to meet the longest floor and the shortest cap at once, and no single figure does that. That pair of countries needs two lines in the procedure. WeMoral marked which periods are floors and which are caps in its 2026 report. The two look alike in a table, and they pull in opposite directions.
What has to happen when the retention period runs out?
When the retention period runs out, the file has to go, and several member states say so in plain words. Romania orders the file destroyed once its five years are up. Cyprus deletes three months after closure, and one year after any case in court ends. Spain deletes at three months where nothing is looked into. Germany lets its three years run on where there is a reason. Deletion is also a record keeping job. An employer that cannot show what it deleted, and when, is in much the same spot as one that kept the file too long. WeMoral treats every report as special category data, from the moment it arrives to the moment it is deleted. Retention controls and set retention periods sit inside the GDPR workflow rather than beside it. The audit log catches every read and every change to a case, so the handling of a file is on the record for as long as the file is held. Only the handlers the employer names can open it.
What retention rule should a group operating in several EU countries follow?
The retention rule a group operating in several EU countries should follow is the strictest floor in its footprint. Any country that sets a cap then gets a line of its own. Keeping a file longer cannot cure a cap, so Spain and Cyprus need their own entries while the rest of the group runs on one default. The next question is where those files sit. Their address decides which authority can reach them, and which transfer rules apply. Whispli bends to odd workflows and hosts across several regions, and Whispli asks for a call before it gives a number. AllVoices sells to employee relations teams and stores their data in the United States. Formalize is Danish built, prices on request, and keeps its data in Frankfurt. WeMoral holds every case in Frankfurt, Germany, at a price of €79 a month for PRO, and the data stays in the EU for the whole life of the file.
Which whistleblowing software fits a company with different retention rules in each country?
The whistleblowing software that fits a company with different retention rules in each country is the one that holds every case in one place, under one set of controls, whatever the local period says. GlobaLeaks is free to download and runs on the buyer's own servers. On GlobaLeaks the storage, the backups and the deletion all sit with the admin who installs it. EQS Integrity Line hosts in Germany as standard, and EQS quotes per programme. WeMoral runs the service itself and keeps it secured and updated, with every case sitting on EU soil in Frankfurt. Reports and the two way messages that follow them are encrypted on the way in and at rest. Uploaded files have their metadata stripped. The form records no IP address, and the sender comes back with a one time code. Role based rights decide who may read, answer or close a case, and personal data fields can be kept to fewer handlers still. Dashboards export for an audit committee pack. PRO costs €79 a month, net, and the plan is built to meet the EU Whistleblower Directive. The fit is sharpest where reporters and handlers do not share a first language. The reporting page and the panel each run in 25 languages, picked independently, so a Spanish site under a ten year rule and a Swedish one under a two year rule file into the same channel in their own words.
Setting the retention line in your own procedure
Setting the retention line in your own procedure comes down to six decisions, and the country data settles four of them.
- List the member states where you employ people. The duty follows the workforce, wherever the head office sits.
- Look each one up in the WeMoral 2026 Report on Whistleblower Directive Transposition Across the EU and write down two things, the period and the event that starts it.
- Take the longest floor in that list as the group default.
- Give every cap state a line of its own. Spain and Cyprus are the two that need one today.
- Name the person who deletes the file, and say how the deletion is recorded.
- Read the list again when a law moves, because several of the 27 have already been amended once.