EU Whistleblower Directive: the 7-day and 3-month clocks, explained

The EU Whistleblower Directive (2019/1937) sets two deadlines that most HR teams know exist and few have a reliable system for actually meeting. Missing either one isn't usually a decision anyone made - it's a report that sat in an inbox for two weeks while everyone assumed someone else was handling it.

The two clocks

Seven days to acknowledge. From the moment a report is filed, the organization has seven days to acknowledge receipt to the reporter. Not seven days to investigate, not seven days to respond substantively - seven days to say, in effect, "this reached us, and it's being handled." It's a low bar procedurally, and a surprisingly easy one to miss when reports arrive through inboxes, shared drives, or a manager who forwards something three days later because they weren't sure who should see it.

Three months to provide feedback. From acknowledgment, the organization has three months to give the reporter meaningful feedback on what's being done - not necessarily a final outcome, but a substantive update, not a form letter. This is the clock that tends to slip quietly, because three months feels like a long runway right up until it isn't.

Both clocks apply regardless of whether the report is anonymous. A reporter without a name or email address still has a right to that acknowledgment and that feedback - which is exactly why the case ID and passcode system exists: it gives an anonymous reporter a way to actually receive that update without ever creating an identifying trail back to them.

Where these deadlines actually get missed

Almost never because someone decided to ignore them. Nearly always because:

• The report arrived somewhere without a clear owner - a shared inbox, a manager's forwarded email, a conversation that never got formally logged as a report.
• Nobody was tracking the clock in a way visible to more than one person, so the deadline lived in someone's head, and that someone was on leave when it came due.
• The three-month window looked comfortable in week one and became a scramble in week eleven, because there was no earlier checkpoint flagging that it was approaching.

None of these are compliance failures in the legal sense at the moment they happen. They become compliance failures four months later, when a reporter who never heard back escalates externally - which the Directive explicitly permits them to do once internal channels have failed to respond in time.

How Rectifia tracks it

The acknowledgment and feedback clocks start automatically the moment a report is filed - not when someone remembers to start a timer, not when a case gets manually assigned. Every case shows its countdown directly, so a handler opening a case sees exactly how much runway is left, not a due date they have to cross-reference against a policy document.

Cases approaching either deadline are surfaced to HR before they lapse, not after. The difference between "we're going to miss this" and "we already missed this" is usually a matter of days of advance notice, and that's the entire point of building the countdown into the case itself rather than relying on someone's calendar reminder.

It's not just an EU problem

The same underlying mechanism - a deadline clock computed automatically at case creation, tracked per case, surfaced before it lapses - is how Rectifia handles reasonable-time tracking under the UK's Public Interest Disclosure Act, the named-handler and confidentiality requirements under Japan's Whistleblower Protection Act, and the configurable timelines organizations need under US frameworks like SOX and state law. The EU Directive just happens to be the one with the most explicit, numeric deadlines, which makes it the clearest example of why a countdown beats a calendar reminder every time.

If your organization operates across more than one of these frameworks, the deadline that matters on any given case is whichever one is strictest - and that's computed automatically too, not something a handler has to figure out manually before every acknowledgment.

Rectifia is designed to support these obligations. It isn't legal advice - confirm your specific requirements with counsel.