Amendments to the Law on the Protection of Persons Reporting Breaches
In the State Gazette, Issue No. 38 of 2025, amendments and supplements to the Law on the Protection of Persons Reporting or Publicly Disclosing Information on Breaches were promulgated. These changes further develop the national framework for the protection of reporting persons and refine a number of practical aspects related to the application of the Law.The amendments aim to enhance the effectiveness of protection mechanisms, eliminate ambiguities identified in practice, and ensure greater legal certainty for both reporting persons and entities subject to obligations under the Law.
Key Highlights of the Amendments
Among the most significant changes are:
- Expansion and clarification of the categories of protected persons, including individuals who obtained information about breaches in the context of pre-contractual relationships, terminated employment or contractual relationships, internships, or other forms of professional engagement.
- Clarification of the rules for handling reports, including the treatment of anonymous reports and the conditions under which follow-up actions may be undertaken.
- Refinement of the requirements for internal reporting channels, aimed at ensuring greater independence, confidentiality, and effectiveness in the processing of submitted information.
- Expansion and specification of protection measures against retaliation, as well as the introduction of clearer rules regarding liability for breaches of the Law.
- Supplementation of the sanctioning provisions, targeting actions that obstruct the submission of reports or violate the confidentiality and protection of reporting persons.
Significance for Organisations
The amendments require employers and other obligated entities to review and update their internal rules and procedures, as well as to assess the compliance of existing internal reporting channels with the new legal requirements.
In this context, particular importance is placed on:
- clearly defining the responsibilities of persons involved in the receipt and handling of reports;
- ensuring adequate protection of personal data and confidentiality;
- informing employees and related persons about their rights and the protection mechanisms available under the Law.
How CONSEJO Can Assist
The CONSEJO team closely monitors developments in the regulatory framework and provides expert support in the implementation of the amendments, including:
- compliance analysis in line with the updated legal requirements;
- updating internal rules and procedures;
- establishment and optimisation of internal reporting channels;
- implementation of the new requirements in personal data protection and information security systems.
Implementation of management standards
CONSEJO Ltd. is a consulting company with over 20 years of practical experience in the development, implementation and maintenance of management systems in accordance with international standards and regulatory requirements. The company provides consulting services in the areas of quality management, environmental management, occupational health and safety, food safety, information security, cybersecurity, risk management and sustainable development. Our expertise covers standards and schemes such as ISO 9001, ISO 14001, ISO 45001, ISO 22000, ISO/IEC 27001, IFS Food, BRCGS and HACCP, as well as consulting services related to NIS2, DORA, GDPR and EcoVadis.
The CONSEJO team has been involved in over 1,500 projects for organizations across various sectors of the economy, including manufacturing, construction, energy, information technology, transport, trade, the food industry and services. Our approach focuses on developing management systems that work effectively in practice, tailored to the specific characteristics and needs of each organization. We work closely with our clients, providing consulting support, staff training and assistance during implementation. We strive to deliver high-quality services within the agreed deadlines and solutions that support successful certification and create long-term value for businesses.
