Alerting the Competition Authority

Whistleblowers who report breaches of legal rules are protected against all forms of retaliation.

A uniform European legal framework has been created to protect whistleblowers in certain fields of action of the European Union.

Luxembourg has 22 competent authorities, including the Competition Authority.

You can approach the Office for Whistleblowers (Office des signalements), to be set up in December 2023, in order to obtain general information concerning the competent authority that can be notified depending on the type of reporting involved.

The Competition Authority gathers reports concerning breaches:

Persons who take retaliatory measures or who bring vexatious proceedings against whistleblowers are liable to a fine of between EUR 1,250 and EUR 25,000.

Who is concerned

Whistleblowers working in the private or public sector who have acquired information concerning breaches in a work-related context (current, past or future employment relationship), such as:

  • salaried workers (including civil servants and State employees);
  • self-employed persons;
  • shareholders and persons belonging to the administrative, management or supervisory body of an undertaking, including non-executive members;
  • volunteers and paid or unpaid trainees; and
  • any persons working under the supervision and direction of contractors, subcontractors and suppliers.

The protection also extends to:

  • facilitators (natural persons assisting whistleblowers on a confidential basis);
  • colleagues or relatives of the whistleblower who could suffer retaliation;
  • legal entities that the whistleblower owns, works for or is otherwise connected with in a work-related context;
  • persons who have reported or disclosed information on breaches anonymously, but who are subsequently identified and suffer retaliation;
  • persons reporting breaches to relevant institutions, bodies, offices or agencies of the European Union.

The protection in question does not apply to:

  • reporting of breaches relating to national security; and
  • whistleblowers whose relationships are covered by:
    • medical confidentiality;
    • the confidentiality of lawyer-client relations;
    • the professional confidentiality binding on notaries and court bailiffs;
    • the secrecy of judicial deliberations;
    • rules on criminal procedure.

How to proceed

What can be reported?

As a whistleblower, you can report any breach of national law and/or European Union law, that is to say, acts or omissions that:

  • are unlawful; or
  • defeat the object or the purpose of the directly applicable rules of national law or European law.

You can communicate any information, including reasonable suspicions, concerning:

  • actual or potential breaches; and/or
  • attempts to conceal such breaches,

which have occurred or are very likely to occur:

  • in the organisation in which you work or have worked; or
  • with which you are or have been in contact through your work.
Please note: You may not disclose information which you have acquired or to which you have gained access by committing a criminal offence.

What are the conditions for protection?

In order to qualify for protection against all forms of retaliation, you must:

  • have had reasonable grounds to believe that the information on breaches reported was true at the time of reporting and that such information fall within the scope of the law; and
  • have made a report:
    • either internally: through the reporting channels of your undertaking or administration;
    • or externally: through the reporting channels of the competent authority;
    • or by way of public disclosure: following external reporting that yielded no satisfactory result.

Internal reporting

If you wish to report breaches of the law, you are encouraged, preferably, to report the breaches in question through internal channels before resorting to external reporting, unless internal reporting may have negative consequences for you (in the form of retaliation by your employer, for example).

Each private sector entity (upwards of 50 employees) and every public sector body (apart from communes with fewer than 10,000 inhabitants and entities employing fewer than 50 workers) is required to provide internal reporting channels and procedures and to ensure that reports are followed up.

Private sector entities employing between 50 and 249 workers may share resources for receiving and following up reports made internally. Their reporting channels must be operational by 17 December 2023 at the latest.

The Office for Whistleblowers, to be set up in December 2023, will be pleased to provide information and assistance to anyone wishing to make a report.

External reporting

If you wish to report breaches of the law, you can do so externally by approaching the competent authority:

  • either directly;
  • or after reporting the same internally.

Reporting to the Competition Authority

If, as a whistleblower, you wish to report breaches falling within the ambit of the competences of the Competition Authority, you can approach the Authority in French, Luxembourgish, German or English:

  • via the secure platform 'Report to the Competition Authority' (Alerter l’Autorité de concurrence) on MyGuichet. This is a procedure requiring no authentication (see under 'Forms / Online services');
  • by email to:;
  • by telephone at: (+352) 247 84484;
  • in person at the registered office of the Competition Authority.

The platform for reporting to the Competition Authority guarantees the comprehensiveness, integrity and confidentiality of the information provided. Only duly authorised members of staff of the Competition Authority have access to it, and they are bound by the duty of professional secrecy.

The Competition Authority does not make recordings of reports made to it over the telephone, but it may draw up accurate minutes setting out the main elements of the conversation which you can subsequently check, rectify and sign by way of approval.

By the same token, the Competition Authority takes care, with your consent, to keep full and accurate accounts of reports made in person, by way of recordings or minutes.

Where reporting is done through other channels or via other members of staff of the Authority, the latter are likewise bound to respect confidentiality concerning your identity or that of the person concerned, and will forward the report without delay to the staff members responsible for handling it.

Follow-up and handling of the report by the Competition Authority

The Competition Authority receives reports falling within its area of competence and ensures that these are followed up.

It may ask the entity to which the report relates, in writing, to provide all such information as it deems necessary, whilst strictly respecting the confidentiality of your identity as the whistleblower.

The Competition Authority takes care, in particular, to:

  • acknowledge receipt of the report within 7 days from receipt thereof, unless:
    • you explicitly request otherwise; or
    • there are reasonable grounds to believe that acknowledging receipt of the report would jeopardise the protection of your identity;
  • ensure that it is diligently followed up;
  • provide you with feedback within 3 months, or 6 months in duly justified cases;
  • communicate to you the final outcome of the steps taken in consequence of the reporting, subject to any information falling within the scope of a legal obligation to observe confidentiality, breach of which is punishable under criminal law.
Where the Competition Authority receives a report which it is not competent to handle, it will forward it within a reasonable time and in a confidential and secure manner to the competent national authority. You will thereafter be kept informed by the latter authority.

Decisions taken, and penalties imposed, by the Competition Authority

After assessing the matter, the Competition Authority:

  • may decide to close the procedure:
    • where the breach is clearly minor (even though other obligations or other procedures may be applied to address the reported breach);
    • in the case of repetitive reports which do not contain any meaningful new information compared to a past report in respect of which the procedure has been closed.

The Competition Authority will then notify you of its decision and of the reasons therefor.

The Competition Authority may impose penalties on the entities (legal persons) to which the report relates.


The Reporting Office may, for its part, impose fines on persons who fail to observe the law on the protection of whistleblowers:

  • of between EUR 1,250 and EUR 25,000 if they take retaliatory measures or bring vexatious proceedings against whistleblowers;
  • of between EUR 1,500 and EUR 250,000 in particular if they impede the making of a report, refuse to remedy a breach or have failed to put in place the required internal reporting channels (the fine may be doubled if the offence is repeated).

A whistleblower who knowingly reports or publicly discloses false information may be sentenced to a term of imprisonment of between 8 days and 3 months and a fine of between EUR 1,500 and EUR 50,000.

A person making a false report may incur civil liability. An entity suffering damage in consequence of this may claim compensation for the prejudice suffered before a court of law.

Public disclosures

Where, as a whistleblower, you publicly disclose a breach, you are entitled to protection under the law if:

  • you have first reported it internally and externally or directly externally, but no appropriate action was taken in response to the report within 3 months from your so doing; or
  • you have reasonable grounds to believe that:
    • the breach may constitute an imminent or manifest danger to the public interest (such as where there is an emergency situation or a risk of irreversible damage); or
    • in the case of external reporting, there is a risk of retaliation or there is a low prospect of the breach being effectively addressed, due to the particular circumstances of the case (such as those where evidence may be concealed or destroyed, or where an authority may be in collusion with the perpetrator of the breach or involved in the breach).

Protection against retaliation

No liability attaching to whistleblowers

If you fulfil the conditions for protection of whistleblowers, you will not be breaking the law when you disclose information, and you will not incur any liability:

  • as regards the reporting (done internally and/or externally) or the public disclosure, provided you had reasonable grounds to believe that the reporting or public disclosure was necessary in order to reveal a breach of the law;
  • as regards the way in which the information reported or publicly disclosed, or access to that information, was acquired (provided that such acquisition or access did not constitute a self-standing criminal offence);
  • on account of reports or public disclosures made, including in legal proceedings for defamation, breach of copyright, breach of secrecy, breach of data protection rules or disclosure of trade secrets, or for compensation claims based on private, public, or collective labour law.

In such cases, you may rely on that reporting or public disclosure to seek dismissal of the proceedings.

Prohibited retaliation measures

All forms of retaliation against you as a whistleblower on account of the report made by you, including threats of retaliation and attempts at retaliation, are prohibited.

The following, in particular, are prohibited and automatically null and void:

  • suspension of an employment contract, lay-off, dismissal, failure to renew or early termination of a fixed-term employment contract, or equivalent measures;
  • demotion or withholding of promotion;
  • transfer of duties, change of location of place of work, reduction in wages, change in working hours;
  • withholding of training;
  • imposition or administering of any disciplinary measure, reprimand or other penalty, including a financial penalty;
  • failure to convert a fixed-term employment contract into a permanent one, where you had legitimate expectations that you would be offered permanent employment;
  • a negative performance assessment or employment reference;
  • early termination or cancellation of a contract for goods or services;
  • cancellation of a licence or permit.

The following are likewise prohibited:

  • coercion, intimidation, harassment or ostracism;
  • discrimination, disadvantageous or unfair treatment;
  • harm, including to the person's reputation, particularly in social media, or financial loss, including loss of business and loss of income;
  • blacklisting on the basis of a sector- or industry-wide informal or formal agreement, which may entail that the person will not, in the future, find employment in the sector or industry;
  • psychiatric or medical referrals.

Action against retaliation measures

As a whistleblower suffering retaliation measures, you have the right, within 15 days following notification of the measures, to apply to the relevant court of competent jurisdiction for a ruling declaring the measures to be null and void and ordering their cessation.

A person who has not pleaded nullity of the retaliation measures, or who has already obtained an order declaring them to be null and void, may still bring a claim for damages.

The Competition Authority recommends that, if you intend to bring legal proceedings, you should instruct a lawyer to act for you.

Reversal of the burden of proof

As a whistleblower suffering detrimental measures, you are automatically entitled to the benefit of a presumption that the measures in question have been taken against you as retaliation for the reporting.

Consequently, it is for the person who has taken the measures to establish the grounds therefor.

Confidentiality and data processing


The Competition Authority handles all reports in strict confidence as regards the identity of the whistleblower.

The Authority will never disclose:

  • either your identity without your explicit consent;
  • or any other information from which your identity as a whistleblower may be directly or indirectly deduced.

Where applicable, the Competition Authority will not use or disclose trade secrets for purposes going beyond what is necessary for proper follow-up.

Confidentiality regarding a whistleblower's identity may only be lifted in the case of a necessary and proportionate obligation in the context of investigations by national authorities or judicial proceedings, including with a view to safeguarding the rights of defence of the person concerned.
In such a case, the Competition Authority will inform the whistleblower in writing, with an explanation of the reasons, before disclosing the latter's identity, unless such information would jeopardise the related investigations or judicial proceedings.

Processing personal data

In order to carry out the tasks assigned to it by law, the Authority may need to process personal data concerning you.

All processing of personal data carried out pursuant to the law on the protection of whistleblowers, including the exchange or transmission of personal data by the competent authorities, is done in accordance with Regulation (EU) 2016/679, hereinafter referred to as the 'General Data Protection Regulation' or the 'GDPR'.

As a public authority processing personal data, the Authority is bound to respect the obligations incumbent on it in its capacity as a data controller.

If you have any questions concerning the processing of your personal data by the Authority, you can contact the Authority's data protection officer (DPO) by letter marked for the attention of the DPO, by telephone (+352 247 84728) or by email at the following address:

Purpose and legal basis for processing

The Authority may be contacted by any whistleblower wishing to report a breach externally, i. e. outside the company where they work. Following an assessment, where necessary, and subject to the obligations in respect of confidentiality, the personal data thus obtained may be processed in the context of the performance of the tasks or investigations falling within the ambit of the Authority's competence.

In that context, the processing of your data is necessary for the performance of a task carried out in the public interest in the exercise of the powers vested in the Authority (Article 6(1)(e) of the GDPR).

Data processed

Reporting can be done via the secure platform In such cases, for the report to be processed, an email address must be provided, thereby enabling the Authority to give feedback and to ensure that the reports are followed up. Potential whistleblowers must also provide a description of the alleged breach and state who has committed it. It is therefore possible that information relating to the behaviour of other persons, and in particular the perpetrator of the breach or witnesses, are processed.

It is preferable, when describing the breach, to mention only information which is needed in order for the report to be dealt with and, in particular, to refrain from including in it, unless absolutely necessary, sensitive data (within the meaning of Article 9 of the GDPR) concerning the whistleblower or third persons (for example data concerning their health, political opinions or religious beliefs).

Reporting can also be done by telephone or in person. In such cases, other contact details may be collected and the provision of an email address is not necessary.

Categories of recipients


Only duly authorised members of staff of the Competition Authority have access to the Authority's secure reporting platform or to the minutes, as the case may be.

In the case of reporting through other channels or via other members of staff of the Authority, the latter are likewise bound to observe confidentiality concerning the identity of the whistleblower or of the person concerned, and will forward the report without delay to the members of staff assigned to handle it.

As regards reporting via the platform, for which the Government IT Centre, (hereinafter referred to as the 'CTIE') is responsible (the latter body acting in the capacity of processor), personal data provided by the whistleblower will be accessible only to persons designated by the CTIE in the context of a request for support or technical assistance.

Potential recipients

Where a report does not fall within the scope of the Competition Authority's competence, the data collected may be forwarded to other competent national authorities or to institutions, bodies, offices or agencies of the European Union having competence within the framework of the cooperation provided for by the law.

Where a report addressed to the Authority is the subject of an investigation into the facts alleged, the persons authorised to access reports will, according to the subject-matter thereof (Digital Markets Act, P2B, anti-competitive practices), forward the report in question to the competent departments within the Authority. If anonymisation is not possible without compromising the Authority's investigation and inspection activities, only the personal data needed for the purposes of the investigation will be transmitted.

Data retention period

Personal data which are manifestly not relevant for the handling of a specific report will not be collected or, if accidentally collected, will be deleted without undue delay.

Personal data obtained via a report which is held by the duly authorised staff to be unfounded and which falls outside the ambit of the Authority’s competence will be deleted without delay.

Personal data obtained via a report shall be kept for 2 months following the closure of the investigation carried out by the Authority in the performance of its respective tasks or of the procedure concerning the facts alleged in the report until the end of the period allowed for lodging an appeal.

Files having a significant heritage value are to be kept for archiving purposes, in the public interest, for longer than those periods of administrative usefulness.

Rights of the persons concerned

Under the GDPR, you have the right:

  • to access data concerning you and obtain a copy thereof;
  • to obtain rectification of incorrect or incomplete data;
  • to object, subject to conditions, to the processing of your data;
  • to obtain, subject to conditions, the erasure thereof;
  • to obtain, subject to conditions, restrictions of processing.

If you have any questions concerning the processing by the Authority of your personal data, or wish to make any request regarding the exercise of your rights, you can contact the Competition Authority's DPO.


If you consider that the processing of your data by the Authority constitutes a breach of the General Data Protection Regulation, you may lodge a complaint with the CNPD.

Forms / Online services

Report to the Competition Authority

To complete your application, the information about you collected from this form needs to be processed by the public administration concerned.

That information is kept by the administration in question for as long as it is required to achieve the purpose of the processing operation(s).

Your data will be shared with other public administrations that are necessary for the processing of your application. For details on which departments will have access to the data on this form, please contact the public administration you are filing your application with.

Under the terms of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, you have the right to access, rectify or, where applicable, remove any information relating to you. You are also entitled to withdraw your consent at any time.

Additionally, unless the processing of your personal data is compulsory, you may, with legitimate reasons, oppose the processing of such data.

If you wish to exercise these rights and/or obtain a record of the information held about you, please contact the administration in question using the contact details provided on the form. You are also entitled to file a claim with the National Commission for Data Protection (Commission nationale pour la protection des données), headquartered at 15, boulevard du Jazz L-4370 Belvaux.

By submitting your application, you agree that your personal data may be processed as part of the application process.

Alerter l'Autorité de la concurrence

Les informations qui vous concernent recueillies sur ce formulaire font l’objet d’un traitement par l’administration concernée afin de mener à bien votre demande.

Ces informations sont conservées pour la durée nécessaire par l’administration à la réalisation de la finalité du traitement

Les destinataires de vos données sont les administrations compétentes dans le cadre du traitement de votre demande. Veuillez-vous adresser à l’administration concernée par votre demande pour connaître les destinataires des données figurant sur ce formulaire. Conformément au règlement (UE) 2016/679 relatif à la protection des personnes physiques à l'égard du traitement des données à caractère personnel et à la libre circulation de ces données, vous bénéficiez d’un droit d’accès, de rectification et le cas échéant d’effacement des informations vous concernant. Vous disposez également du droit de retirer votre consentement à tout moment.

En outre et excepté le cas où le traitement de vos données présente un caractère obligatoire, vous pouvez, pour des motifs légitimes, vous y opposer.

Si vous souhaitez exercer ces droits et/ou obtenir communication de vos informations, veuillez-vous adresser à l’administration concernée suivant les coordonnées indiquées dans le formulaire. Vous avez également la possibilité d’introduire une réclamation auprès de la Commission nationale pour la protection des données ayant son siège à 15, boulevard du Jazz L-4370 Belvaux.

En poursuivant votre démarche, vous acceptez que vos données personnelles soient traitées dans le cadre de votre demande.

Die Wettbewerbsbehörde alarmieren

Ihre in diesem Formular erfassten personenbezogenen Informationen werden von der zuständigen Verwaltungsbehörde verarbeitet, um Ihren Antrag erfolgreich abzuschließen.

Diese Informationen werden von der Behörde für den zur Verarbeitung erforderlichen Zeitraum gespeichert.

Die Empfänger Ihrer Daten sind die im Rahmen Ihres Antrags zuständigen Verwaltungsbehörden. Um die Empfänger der in diesem Formular erfassten Daten zu erfahren, wenden Sie sich bitte an die für Ihren Antrag zuständige Behörde.

Gemäß der Verordnung (EU) 2016/679 zum Schutz natürlicher Personen bei der Verarbeitung personenbezogener Daten und zum freien Datenverkehr haben Sie das Recht auf Zugang, Berichtigung und gegebenenfalls Löschung Ihrer personenbezogenen Informationen. Sie haben zudem das Recht, Ihre erteilte Einwilligung jederzeit zu widerrufen.

Weiterhin können Sie, außer in Fällen, in denen die Verarbeitung Ihrer Daten verpflichtend ist, Widerspruch einlegen, wenn dieser rechtmäßig begründet ist.

Wenn Sie diese Rechte ausüben und/oder Einsicht in Ihre Informationen nehmen möchten, können Sie sich unter den im Formular angegebenen Kontaktdaten an die zuständige Verwaltungsbehörde wenden. Sie haben außerdem die Möglichkeit, bei der Nationalen Kommission für den Datenschutz Beschwerde einzulegen (Commission nationale pour la protection des données, 15, boulevard du Jazz L-4370 Belvaux).

Wenn Sie Ihren Vorgang fortsetzen, akzeptieren Sie damit, dass Ihre personenbezogenen Daten im Rahmen Ihres Antrags verarbeitet werden.

Who to contact

Double click to activate the map

We are interested in your opinion

How would you rate the content of this page?

Last update