Italy’s Legislative Decree 24/2023 marks a significant shift in corporate compliance, introducing strict new obligations for public and private organizations regarding whistleblowing procedures. Effective from March 30, 2023, the decree enforced mandatory internal reporting channels for companies with 250 or more employees by July 15, 2023, and extended the same requirement to companies with 50 to 249 employees by December 17, 2023. These channels must protect confidentiality, support both written and oral reports (including anonymous submissions), and guarantee protection against retaliation. Organizations are required to acknowledge reports within 7 days and provide a follow-up within 3 months, with dedicated staff or third-party services managing the entire process. The system must also comply with GDPR rules, offering limited data access, secure storage, and deletion within a maximum of five years. Companies that fail to implement compliant systems risk fines up to €50,000, reputational damage, and legal consequences. Beyond avoiding sanctions, the decree promotes a culture of transparency and accountability—transforming whistleblowing from a risk into a tool for ethical improvement and internal trust.
