Whistleblowing legislation

NIS 2 (EU Directive) tightens the cyber security of essential service providers.

It entered into force already in January 2023, but it came into force in Estonia from October 2025.

In 2019, the EU adopted the Whistleblowers (Whistleblower Protection) Directive.

Its purpose is to ensure protection for whistleblowers of violations that have occurred in their professional activities.

On May 15, 2024, the Whistleblower Protection Act was adopted.

It is also called the whistleblower protection act, and it requires bodies to establish a confidential reporting channel.

Data protection and whistleblowing channels

What GDPR requires for sensitive reporting data and which requirements follow indirectly from Estonian law.