• EU Directive 2019/1937
• Amended Sapin II Law (Waserman Law 2022)
• Decree No. 2022-1284
• CNIL Professional Alerts Framework

Variation Callouts:

• Public Sector: Coordination with Art. 40 CPP
• Duty of Vigilance: Companies with ≥ 5,000 / 10,000 employees

Template_Politique_Lanceur_Alerte.docx

IMPORTANT: The template must be used EXACTLY as provided. Only variable elements should be adapted.

• Legal form and headcount (threshold ≥ 50 employees/agents?)
• Business sector and status (private/public/mixed)
• Group structure (pooling possible?)
• Existing system: implementation date, post-Waserman update?

• Internal reporting procedure
• Employee communication materials
• Templates used (acknowledgment, feedback, closure)
• Job description / designated officer appointment
• GDPR register / DPIA if existing

• Pooling with other entities considered?
• Outsourcing of reception channel?
• Coordination with other systems (duty of vigilance)?

1. Executive Summary (1 page)
2. Phase-by-Phase Assessment Table (8 phases)
3. Recommended Action Plan

• Overall compliance: Compliant / Partially Compliant / Non-Compliant
• Top 5 gaps identified (ranked by priority)
• Recommendation: "Compliant" / "Correct before deployment" / "Escalate"

IS THE ORGANIZATION SUBJECT TO THE OBLIGATION?

• Private legal entity ≥ 50 employees → YES
• Public legal entity ≥ 50 agents → YES
• Municipality ≥ 10,000 inhabitants → YES
• State administration → YES
• Other → CHECK sector-specific regulations

Pooling possible (< 250 employees/agents): See Art. 8 I. B. and C. of the amended Sapin II Law + Art. 7 II of the Decree

IMPORTANT - MANDATORY READING: Before any assessment, read IN FULL the file

assets/Decret_2022_1284.pdf

(Articles 1 to 8 + annex). Do not rely solely on summaries—the exact decree text is authoritative.

assets/Decret_2022_1284.pdf

1. Read Decree 2022-1284 in full before starting the assessment
2. Verify that all mandatory elements are present (completeness)
3. Verify that each clause is compliant with the legal and regulatory framework (no contradictions)
4. Use the Section 6 checklist to structure the assessment by phase
5. When in doubt, always return to the exact text of the decree

See Art. 8 I. B. amended Sapin II Law + Art. 1 and 2 of the Decree

• Organization subject to obligation (threshold met)
• Entity type identified (private/public/mixed)
• Pooling compliant if applicable (< 250, concurrent decision)

→ Detailed reference: DECRET_PROCEDURE.md - Section 1

• Written OR oral channel provided (entity's choice - Art. 4 I decree)
• If oral provided: telephone or voicemail mentioned
• If oral provided: video/in-person meeting on request (20 business days)
• Ability to transmit any type of document
• Written acknowledgment within 7 business days provided

→ Detailed reference: DECRET_PROCEDURE.md - Section 3

• Formal designation in procedure (receipt AND processing)
• Sufficient competence, authority, and resources
• Impartiality safeguards in place
• If pooling (< 250 employees): Art. 7 II conditions met
• If outsourced: third-party obligations compliant with Art. 7 I

→ Detailed reference: DECRET_PROCEDURE.md - Section 2

• Admissibility criteria defined (Art. 6 and Art. 8 I.A.)
• Reporter notification in case of inadmissibility provided
• Follow-up for non-compliant reports specified
• Follow-up for anonymous reports specified

• Written feedback within 3 months maximum provided
• Feedback content compliant (measures considered/taken + reasons)
• Reasoned closure provided (unfounded or moot allegations)
• Written closure notification to reporter provided

→ Detailed reference: DECRET_PROCEDURE.md - Section 4

• Information integrity and confidentiality guaranteed
• Identity protection: reporter, persons concerned, third parties mentioned
• Access prohibited to unauthorized persons
• Prompt transmission to designated persons provided
• If oral: recording procedures defined
• Retention period limited to strict necessity

→ Detailed reference: DECRET_PROCEDURE.md - Section 6

• Procedure disseminated with sufficient publicity
• Permanently accessible to eligible persons
• Complete information content (see Section 7 of decree)
• Information on external channels available

→ Detailed reference: RGPD_CNIL.md

• Legal basis identified (legal obligation or legitimate interest)
• Purposes defined, no incompatible reuse
• Data minimization by phase (collection, investigation, post-decision)
• Anonymous reports possible, no re-identification
• Authorized users documented, access logged
• Disclosure rules followed (reporter: consent / subject: after substantiation)
• Retention periods defined by phase and communicated
• Data subject notification compliant (reporter at acknowledgment, subject within 1 month)
• Data subject rights guaranteed (access, objection, rectification, restriction)
• Security measures compliant (17 CNIL categories)
• Processing register updated
• DPIA completed (recommended)

→ Public sector → FONCTION_PUBLIQUE.md

• Coordination with Art. 40 CPP documented
• Designated officer informed of Art. 40 obligations

→ Duty of vigilance → VIGILANCE.md

• Mechanism established in consultation with representative unions
• Extended scope (subsidiaries, subcontractors, suppliers)
• External stakeholders eligible

→ Regulated sectors (financial, healthcare, etc.)

• Coordination with sector-specific obligations documented

┌──────────────────────────────────────────────────────────────────────────────┐
│  CHANNEL 1: INTERNAL REPORTING (Art. 8 I)                                    │
│  ────────────────────────────────────────                                    │
│  WHEN: Can be used directly, without prior condition                         │
│                                                                              │
│  ELIGIBLE PERSONS (Art. 8 I.A. 1° to 5°):                                    │
│  → Staff members (current or former)                                         │
│  → Job applicants                                                            │
│  → Shareholders, partners, voting rights holders                             │
│  → Members of administrative, management, supervisory bodies                 │
│  → External and occasional collaborators                                     │
│  → Contractors, subcontractors and their bodies/staff                        │
├──────────────────────────────────────────────────────────────────────────────┤
│  CHANNEL 2: EXTERNAL REPORTING (Art. 8 II)                                   │
│  ─────────────────────────────────────────                                   │
│  WHEN: Can be used in two ways                                               │
│    ✓ EITHER after making an internal report                                  │
│    ✓ OR directly (without going through internal)                            │
│                                                                              │
│  POSSIBLE RECIPIENTS:                                                        │
│  1° Competent authority (list in annex to Decree No. 2022-1284)              │
│  2° Defender of Rights                                                       │
│  3° Judicial authority (Public Prosecutor)                                   │
│  4° Competent EU institution, body or agency                                 │
├──────────────────────────────────────────────────────────────────────────────┤
│  CHANNEL 3: PUBLIC DISCLOSURE (Art. 8 III)                                   │
│  ─────────────────────────────────────────                                   │
│  WHEN: Protection granted only in the following cases                        │
│                                                                              │
│  CASE 1 (Art. 8 III 1°) - Ineffective reports:                               │
│    → After external report (preceded or not by internal)                     │
│    → AND no appropriate measure taken at deadline expiry                     │
│                                                                              │
│  CASE 2 (Art. 8 III 2°) - Serious and imminent danger                        │
│                                                                              │
│  CASE 3 (Art. 8 III 3°) - Risks related to external reporting:               │
│    → Risk of retaliation                                                     │
│    → OR impossibility of effective remedy                                    │
│                                                                              │
│  DEROGATORY CASE (Art. 8 III penultimate paragraph):                         │
│    → IMMINENT or MANIFEST danger to the public interest                      │
│                                                                              │
│  ⚠️ EXCLUSION: Cases 2°, 3° and derogatory do NOT apply if                   │
│     disclosure harms national defense/security                               │
└──────────────────────────────────────────────────────────────────────────────┘

NOTE: Since the Waserman Law (2022), whistleblowers can freely choose between internal and external channels. They are no longer required to go through internal channels first.

• Reports or discloses WITHOUT DIRECT FINANCIAL CONSIDERATION
• In GOOD FAITH
• Information concerning:
  • A crime or offense
  • A threat or harm to the public interest
  • A violation OR an attempt to conceal a violation of:
    • an international commitment
    • European Union law
    • a law or regulation

→ Detailed reference: TEXTES_LEGAUX.md - Article 10-1

Template_Politique_Lanceur_Alerte.docx

IMPORTANT: The template must be used EXACTLY as provided. Only variable elements should be adapted to the client's situation. Do not rephrase, delete, or reorganize template clauses.

• Legal form and headcount
• Channels chosen (written, oral, both)
• Identity of designated officer(s)
• Reporting channel contact details
• Scope of eligible persons
• Coordination with other systems (duty of vigilance)

• Open Template_Politique_Lanceur_Alerte.docx
• Complete ONLY the variable elements
• Do NOT rephrase existing clauses
• Do NOT delete sections
• Add the mandatory clause on external channels

Independently of this system, any person may submit an external report
directly to the Defender of Rights, the judicial authority, or the
competent authority according to the relevant domain. The list of
external authorities is set by the annex to Decree No. 2022-1284 of
October 3, 2022, available at:
https://www.legifrance.gouv.fr/loda/id/JORFTEXT000046357368

• Have management review
• Consult the works council if applicable (≥ 50 employees)
• If duty of vigilance: consultation with representative unions

• Choose dissemination channels (see Section 6 - Phase 6)
• Ensure permanent accessibility
• Train designated officers