In general, a whistleblower should first report information to his/her employer using internal reporting channels. However, a whistleblower can also choose to go directly to the central state authorities responsible or to EU bodies, in cases where:

• the internal channels do not exist
• they were used but did not function properly or they could not reasonably be expected to function properly (for example because of a fear of retaliation, concerns about confidentiality, the possible implication of the management in the breach, fear that the breach or the evidence might be concealed or destroyed, or if urgent action is required because of an imminent substantial danger to the life, health and safety of persons, or to the environment).

Finally, the law states that if the use of internal and/or external channels did not produce any results and the whistleblower did not receive appropriate feedback within 3-6 months, he/she can choose the option of publicly disclosing the information, for instance, directly via web platforms or social media, or to the media, civil organizations etc.