Seaduse kontekst ja taust
Rikkumisest teavitaja kaitse seadus (edaspidi RTKS) võeti vastu Riigikogu poolt ja jõustus 1. veebruaril 2024. Seadus ühtlustab Eesti õiguse Euroopa Liidu vilepuhuja kaitse direktiiviga (EU) 2019/1937, mis kohustab kõiki liikmesriike tagama teavitajate tõhusa kaitse.
Eesti valis välise teavituskanali haldajaks Õiguskantsleri (Chancellor of Justice), kes võtab vastu teavitusi juhul, kui isik ei soovi või ei saa kasutada sisemist teavituskanalit. Õiguskantsler hindab teavitusi, edastab need vajadusel pädevale asutusele ja jälgib, et teavitajat ei diskrimineeritaks.
Seaduse eesmärk on luua turvaline keskkond, kus töötajad, koostööpartnerid ja muud isikud saavad teatada rikkumistest, mis kahjustavad avalikku huvi, ilma et nad peaksid kartma tööalast kättemaksu, vallandamist või muud ebasoodsat kohtlemist. RTKS hõlmab mitmesuguseid valdkondi, sealhulgas riigihanked, finantsteenused, rahapesu tõkestamine, tooteohutus, keskkonnakaitse, tarbijakaitse, andmekaitse ja toiduohutus. Seaduse kohaldamisala on lai ja vastab EL-i direktiivis sätestatud minimaalnõuetele.
Important:
Kellele seadus kehtib
Private
Public
Peamised nõuded
Ettevõtted peavad looma sisemise teavituskanali, mis võimaldab rikkumisest teavitamist nii kirjalikult kui ka suuliselt. Kanal peab olema turvaline, konfidentsiaalne ja ligipääsetav kõikidele isikutele, kellel on õigus teavitada.
Tähtajad ja ajakava
| Action | Deadline |
|---|
Karistused ja sanktsioonid
Teavitaja kaitse
RTKS keelab igasuguse kättemaksu teavitaja vastu. Keelatud on teavitaja vallandamine, alandamine, distsiplinaarkaristuse kohaldamine, tööülesannete muutmine, töötasu vähendamine või muu ebasoodne kohtlemine, mis on seotud teavitamisega.
Sammud vastavusse viimiseks
Appoint a compliance officer or designated person
Designate an impartial individual or team to manage incoming reports. This can be an internal compliance officer, an ethics committee, or a member of senior management with no conflict of interest. Alternatively, the function may be outsourced to a qualified external provider such as a law firm or compliance consultancy. The key requirement is independence — the designated person must be able to act without interference from the subjects of reports.
Choose your reporting platform
The directive requires channels for both written and oral reporting. A secure, web-based platform such as WhistleBox satisfies both requirements by offering encrypted form submission and secure messaging capabilities. The platform must guarantee end-to-end encryption, GDPR-compliant data processing, confidentiality of the reporter's identity, and — ideally — anonymous reporting with bidirectional communication so that follow-up questions can be asked without compromising anonymity.
Configure your reporting channel
Customise the platform with your organisation's branding, define reporting categories aligned with your specific risk areas (fraud, corruption, health and safety, environmental violations, data breaches, etc.), and configure automated acknowledgment messages, feedback templates, and escalation rules. With WhistleBox, the entire configuration process takes under 5 minutes and requires no IT department involvement.
Inform all employees and relevant stakeholders
Distribute the reporting channel link and instructions via company-wide email, the corporate intranet, physical posters in common areas, onboarding materials for new hires, and any relevant supplier or contractor portals. The directive explicitly requires that information about how to make an internal report be provided in a clear, easily accessible manner. Consider including the information in employment contracts and staff handbooks.
Adopt and publish internal procedures
Draft and formally approve an internal whistleblowing procedure that covers: how reports are received and logged, the triage and initial assessment process, investigation methodology and standards, response timelines aligned with legal deadlines, confidentiality protocols and data-access restrictions, escalation paths for serious or complex matters, and provisions for external reporting to competent authorities when required. This document should be reviewed by legal counsel and made available to all employees.
Monitor deadlines, maintain records, and iterate
Actively track all legally mandated deadlines: the 7-day acknowledgment window and the 3-month feedback deadline for every report received. Maintain the report register securely for a minimum of 5 years, ensuring that access is restricted to authorised personnel. Conduct periodic reviews of your reporting channel's effectiveness, update procedures as legislation evolves, and report aggregated statistics to senior management or the board. WhistleBox automates deadline monitoring, record-keeping, and audit-trail generation, ensuring your organisation is always inspection-ready.
Kuidas Whistlebox aitab teil vastavusse viia
Whistlebox pakub turvalise ja kasutajasõbraliku teavituskanali lahendust, mis vastab täielikult Eesti rikkumisest teavitaja kaitse seaduse nõuetele. Meie platvorm tagab teavitaja konfidentsiaalsuse, võimaldab anonüümset teavitamist ja haldab kogu teavituse elutsüklit alates vastuvõtmisest kuni lahendamiseni.