FAQ

Frequently Asked Questions

What is the Whistleblower Protection Act (commonly known as the Complaints Act)?

The Whistleblower Protection Act refers to Act XXV of 2023 on complaints, public interest disclosures, and rules related to the reporting of abuses, which serves to implement Directive (EU) 2019/1937 of the European Parliament and of the Council in Hungary.
According to the law, employers who employ more than 50 persons (employee means natural persons who perform activities for and under the direction of the employer within the framework of an employment relationship for remuneration, including temporary agency workers) are obliged to establish and operate an internal whistleblowing system.
The law sets out several important requirements regarding internal whistleblowing systems and stipulates that potential whistleblowers must be provided with clear and easily understandable information about the system’s operation. A crucial element of the law is the strict regulations enacted to protect whistleblowers, ensuring that they do not suffer employment-related or other disadvantages due to making reports.

Besides fulfilling their legal obligations, why is an effective whistleblowing system advantageous for companies?

An effective and secure system encourages individuals considering reporting to first use the company’s internal reporting channels rather than initiating procedures against the company with authorities. If reporting channels are available that whistleblowers trust and that operate effectively, individuals are generally more inclined to resort to internal channels. This is particularly true if the whistleblower believes that the infringement can be effectively addressed within the organization, even completely anonymously, and there is no risk of exposure or retaliation.
A well-functioning system is also beneficial for company managers and owners, as it can provide them with important information about problems and risks affecting the business’s operation. Through appropriate and prompt measures, the company can mitigate significant legal risks and, in some cases, save unnecessary expenses simply by reorganizing its processes, restructuring its personnel, introducing additional controls, etc. Consequently, the proper operation of a whistleblowing system can also lead to cost reduction and optimization of the company’s expenses.

Who is obliged to establish a whistleblowing system?

According to the Whistleblower Protection Act, every company with at least 50 employees is obliged to operate an internal whistleblowing system. Employee means natural persons who perform activities for and under the direction of the employer within the framework of an employment relationship for remuneration. Importantly, temporary agency workers must also be included in the employee count.

Other companies performing specific activities defined by law (including credit institutions, financial service providers, auditors, accountants, tax advisors, law firms, companies involved in real estate transactions, oil and gas industry companies) are obliged to operate a whistleblowing system regardless of their size.

Which companies with fewer than 50 employees are obliged to establish a whistleblowing system?

In certain cases, operating a reporting system is mandatory even if the number of employees does not reach 50. The Whistleblower Protection Act does not contain this list; the list can be found in Act LIII of 2017 on the Prevention and Combating of Money Laundering and Terrorist Financing (known abbreviation: Pmt.) Section 1 (1) and (1a).

This includes, among others, credit institutions, financial service providers, auditors, accountants, tax advisors, law firms, companies involved in real estate transactions, and oil and gas industry companies.

Since when has the Whistleblower Protection Act been in effect?

The Whistleblower Protection Act entered into force on July 24, 2023, and became applicable immediately from the date of entry into force for companies employing 250 or more persons. For companies employing fewer than 250 persons, the legislation provided a grace period: the law applies from December 17, 2023, for organizations with an employee count between 50 and 249.

What happens if my company (or any other employer) does not comply with the provisions of the Whistleblower Protection Act?

Compliance with the Whistleblower Protection Act is monitored by the employment supervisory authority. If it determines that the whistleblowing system does not meet the requirements set out in the legislation, it may issue a warning as a sanction or, if the violation is discovered during an official procedure, it may oblige the employer to cease the violation or establish the fact of the violation in a decision.

Proof of an adequate whistleblowing system can also be significant in many other areas, e.g., in relation to ESG regulatory compliance, supplier qualification, and customer qualifying audits. The use of systems and solutions that are questionable from a data security perspective or do not meet the fundamental principles of GDPR (e.g., purpose limitation principle, data minimization principle, limited storage period, integrity, and confidentiality) carries a risk of significant data protection fines.

How should potential whistleblowers be informed about the whistleblowing system, and what must the information contain?

Clear and easily accessible information must be provided on the operation of the internal whistleblowing system, the procedure related to reporting, and the whistleblowing systems and procedures in general. It is important that the information is made accessible not only to employees, as the company also has an obligation to inform other potential whistleblowers. Information is considered easily accessible if, for example, the company places it on its website.

The information must cover not only the operation of the internal whistleblowing system but also the operation of separate (i.e., external) whistleblowing systems established by various state bodies. Furthermore, the data processing information required by GDPR must not be forgotten.

The Reportee team helps prepare information compliant with the legislation.

Who can make a report regarding abuses?

Reports can be made by employees, self-employed individuals and sole proprietorships in a contractual relationship with the company, persons with an ownership interest in the company, and persons belonging to the company’s administrative, management, or supervisory body (including if the procedure for establishing the contractual relationship has begun, or the contractual relationship has already ended), interns and volunteers working at the company.

Furthermore, reports can be made by contractors, subcontractors, suppliers in a contractual relationship with the company, and persons working under their direction. These persons can also make reports if the procedure for establishing the legal relationship is still ongoing, or if their legal relationship has already ended.

What can be the subject of a report in the whistleblowing system?

According to the Whistleblower Protection Act, reports can be made regarding any unlawful or suspected unlawful act or other abuse. For example, data protection violations, infringements threatening cybersecurity, suspected fraud, economic corruption, violation of tax rules, competition law infringements, suspected cartel agreements, discrimination, workplace harassment, etc., can be reported. Regarding product safety, suppliers can play a key role in uncovering potentially unfair and prohibited manufacturing, import, and distribution practices related to unsafe products.

A peculiarity of the Hungarian legal regulation is that it allows reporting in a much broader scope than the European Union regulation. Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law applies only to reports concerning breaches of certain areas of Union law (e.g., product safety, product liability, transport safety, environmental protection, consumer protection, protection of privacy and personal data, cybersecurity, corporate tax).

The different scope of reports is one of the many reasons why it is advisable for Hungarian companies to establish a separate, independent reporting system distinct from other foreign companies within the same group.

Can a group-level, common whistleblowing system be operated? Can the parent company be involved in the investigation of reports?

Employers employing at least 50 but no more than 249 persons under an employment relationship may establish the internal whistleblowing system jointly. However, an entity employing more than 249 persons must establish its own whistleblowing system, regardless of whether the legal entity belongs to a group of companies.

Although a third company could theoretically be involved in the investigation as an external service provider, due to the strict conflict of interest rules – the exclusion of any mandate relationship within the preceding five years – this does not offer a realistic alternative for most company groups.

What does ESG mean?

The abbreviation “ESG” refers to “Environment, Social, Governance,” which denote the three main areas of sustainability. “Environment” covers environmental factors, “Social” covers social and human factors, while “Governance” concerns corporate governance issues.

The purpose of the ESG regulatory framework is to track sustainability, environmental, social, and corporate governance risks beyond narrowly defined financial risks during the operation of large corporations. In Hungary, Act CVIII of 2023 (commonly known as the ESG Act) and Act C of 2000 on Accounting contain the obligations falling within the scope of ESG.

Who does ESG apply to?

ESG applies to large corporations for which at least two of the following criteria are true: the company’s balance sheet total reaches 10 billion HUF, its annual net revenue reaches 20 billion HUF, the average number of employees reaches 250.

Different rules apply to large corporations of public interest. ESG may also affect companies that are contractual partners or suppliers of large corporations falling under the scope of ESG, as these large corporations are obliged to screen their suppliers according to the specified sustainability criteria.

What do we mean by complaint handling according to ESG regulation?

As part of ESG compliance, the affected companies must establish an internal or external complaint handling system that allows anyone to report social responsibility and environmental risks, as well as violations of obligations related to social responsibility or environmental protection.

According to the ESG Act, the internal whistleblowing system under Act XXV of 2023 can also be used as a complaint handling system. The company can operate the complaint handling system itself or use an external, independent service provider. If the company opts for an internal complaint handling system, an employee or internal organizational unit must be designated to perform this task, who/which cannot be instructed in this capacity.

The operator of the internal complaint handling system must handle matters within its scope of duties separately from other organizational units. Reportee offers solutions for both cases. In the case of establishing an internal system, Reportee helps your company easily and effectively manage reports made regarding ESG topics.

By simply and quickly establishing the ESG complaint handling system, Reportee relieves the burden from the affected companies in this matter, allowing the company to focus more energy on fulfilling further obligations within the scope of ESG data reporting requirements.

If your company wishes to operate an external complaint handling system, our contracted service providers can also assist in performing this task.

What can be the subject of a report under ESG regulation?

At companies falling under the scope of ESG regulation, anyone can make a report concerning social responsibility and environmental risks, as well as violations of obligations related to social responsibility or environmental protection.

What is an ESG score?

The ESG score evaluates a given company’s performance regarding sustainability issues based on objective criteria. In Hungary, ESG scores can be prepared by ESG certifiers accredited by the Supervisory Authority for Regulated Activities. ESG scores are essential tools for large corporations and investors to assess the sustainability and ethical performance of potential suppliers and companies.

Based on foreign experiences, scores generally range from 0 to 100; a score below 50 is considered relatively low, while a value above 70 typically represents a good rating. The existence and proper operation of a complaint handling system helps achieve a higher ESG score, as establishing a complaint handling system is considered a fundamental ESG obligation.

What should be done if an anonymous report is received?

The company is not obliged to investigate anonymous reports substantively, but it may choose to investigate them anyway. If the identity of the anonymous whistleblower is later revealed, they are also entitled to protection under the law.

What should be included in the report?

The greatest help to the company is if the report describes the alleged legal violation or abuse in as much detail as possible.

However, for effective investigation, it is also important that the information provided is truly relevant and necessary for investigating and assessing the reported act or omission. If the report contains a lot of information whose knowledge is not necessarily required for conducting the investigation, it can slow down the process and even affect the outcome of the investigation.

Therefore, it is important that the report presents the violation or abuse concerned and the underlying evidence in as much detail as possible, while containing as little superfluous information as possible.

What should be attached to the report?

It is advisable to attach all available evidence to the report. If possible, it is recommended to redact any data from the attached documents that is not important for the investigation of the report.

Frequently Asked Questions

Try Reportee for free!

Try Reportee for free!

Frequently Asked Questions

Try Reportee for free!

Join our waitlist!

Form styling

Try Reportee for free!