A whistleblowing report ispersonal data about three people.
ConsentCenter does not run your reporting channel. It helps with the privacy work around it: notices, access requests that must protect identities, and retention.
- 01 Map
- 02 Restrict
- 03 Retain
Click a provision to read what it says.
Whistleblowing is a compliance programme.
It is also a GDPR processing activity.
Every report names a reporter, a person concerned and often witnesses. The Directive requires their identities to stay confidential and their data to be processed under the GDPR, which means access requests, notices and deletion still apply, with restrictions that have to be handled carefully.
Where this goes wrong first.
An access request that unmasks a reporter
The person concerned asks for their data. Answering in full could reveal who reported them, which the Directive forbids.
Reports kept forever
Data that is not relevant to a report should be deleted, and the rest kept no longer than needed. Inbox archives keep everything.
Nobody knows where reports go
Case tools, email, HR files and outside counsel all hold parts of a report. Without a map, retention and access cannot be enforced.
What changes for you.
Route access requests about reports to an owner who can apply restrictions.
Map where whistleblowing data lives across tools and teams.
Document retention and deletion for report data.
How it works
Map
Record which systems and teams hold report data.
Restrict
Handle access requests with confidentiality checks before release.
Retain
Apply and document deletion once data is no longer needed.
What the text actually says.
- Directive (EU) 2019/1937, Article 8
- Legal entities in the private sector with 50 or more workers must establish internal channels and procedures for reporting.
- Directive (EU) 2019/1937, Article 9
- Receipt of a report must be acknowledged within seven days, and feedback given within a reasonable timeframe not exceeding three months.
- Directive (EU) 2019/1937, Article 16
- The identity of the reporting person must not be disclosed without their explicit consent to anyone beyond the staff authorised to handle reports.
- Directive (EU) 2019/1937, Article 17
- Processing of personal data under the Directive must comply with the GDPR, and data manifestly not relevant to a report must not be collected or, if collected, must be deleted.
Paraphrased for brevity and provided for orientation, not as legal advice. Which obligations apply to your organisation is a question for your own counsel, and ConsentCenter does not determine it for you.
The products that apply
DSAR & Privacy Rights
Assign access requests about reports to an owner who can review them first.
View productData Mapping
See where whistleblowing data lives, so retention can be enforced.
View productUniversal Consent & Preference Management
Record a reporter’s explicit consent where disclosure of identity is needed.
View product
Frequently asked questions
No. ConsentCenter does not receive or manage reports. It covers the data protection work around a reporting channel, alongside whatever reporting system you use.
They have a right of access under the GDPR, but it can be restricted to protect the reporter and the investigation, under Article 23 GDPR and national law. Those decisions need careful review, which is why such requests should go to a named owner.
No. Member states transposed it into national law, and several went further than the minimum. Check the law of each country where you have workers.
Bring us your Whistleblower Directive question.
Show us the consent question you cannot currently answer — the choice that did not propagate, the record you could not reproduce — and we will walk through exactly how ConsentCenter handles it.