Dan Ostergaard · Co-founder, Trusty · Former Novartis Global Head of Compliance · Founder of PolicyStore
Data protection and compliance meet in every whistleblowing channel. The compliance function handles the reports, while the data protection officer (DPO) makes sure personal data is processed lawfully. This guide explains both roles under the GDPR and Directive (EU) 2019/1937, and how to split tasks without conflicts of interest.
What is the role of the data protection officer?
The DPO is a role defined by the GDPR (Regulation (EU) 2016/679). A DPO must be designated in particular where processing is carried out by a public authority, or where core activities involve large-scale monitoring or large-scale processing of sensitive data (Article 37(1)).
The DPO’s tasks include informing and advising the organization, monitoring compliance with the GDPR, advising on data protection impact assessments and cooperating with the supervisory authority (Article 39). A DPO may have other tasks, provided they do not create a conflict of interests (Article 38(6)).
What is the role of the compliance officer?
Unlike the DPO, the compliance officer is not a role defined by the GDPR. The compliance function makes sure the organization follows laws and internal rules in general, for example on anti-corruption, money laundering or competition.
In a whistleblowing channel, the compliance function can act as the impartial person or department that follows up on reports. The directive requires such a person or department (Article 9(1)(c) of the EU Whistleblowing Directive).
DPO vs compliance officer: who does what in the channel?
A clear split of tasks avoids gaps and conflicts:
- Compliance officer: receives and assesses reports, investigates, gives feedback within three months and proposes measures.
- DPO: advises on the lawful design of the channel, the data protection impact assessment, access rights and retention periods, and monitors GDPR compliance.
- Both: protect the identity of the reporting person and of the persons concerned.
Should the DPO also handle reports? The GDPR allows other tasks only without a conflict of interests (Article 38(6)). Because the DPO later monitors the processing of the same data, your company should assess this combination carefully.
What data protection rules apply to a whistleblowing channel?
Any processing of personal data under the directive must comply with the GDPR (Article 17). Personal data that is manifestly irrelevant to a report must not be collected. If collected by accident, it must be deleted without undue delay. Further rules apply:
- Confidentiality: the identity of the reporting person goes no further than the authorized staff without explicit consent (Article 16).
- Persons concerned: their identity is protected while investigations are ongoing (Article 22(2)).
- Records: reports are kept no longer than necessary and proportionate (Article 18).
Is a data protection impact assessment required?
Under the GDPR, a data protection impact assessment is required where processing is likely to result in a high risk to the rights and freedoms of individuals (Article 35(1)). A whistleblowing channel processes sensitive information about reporting persons and the people they name. Your company should therefore assess this question with its DPO before launch. Our guide to the whistleblowing DPIA explains the assessment step by step.
How long can whistleblowing data be kept?
The directive requires storage no longer than necessary and proportionate (Article 18). National laws give concrete periods. In Germany, documentation is deleted three years after the procedure ends (Section 11(5) HinSchG). In Italy, reports are kept no longer than five years from the final outcome (Article 14 of Legislative Decree No. 24/2023). In Spain, data must be deleted after three months if no investigation was started, unless kept as evidence of how the system works (Article 32 of Law 2/2023).
How to combine data protection and compliance in practice
Involve the DPO from the start, when you choose the channel and define access rights. Let the compliance function own the case handling. Document the split of tasks in your whistleblowing procedure. A digital channel with role-based access, encryption and automatic deletion supports both sides. The whistleblowing channel guide lists the legal requirements.
Which data does a whistleblowing channel process?
A whistleblowing channel typically processes data about three groups. These are the reporting person, the persons concerned and third parties named in the report. The data may include names, roles, descriptions of conduct and evidence such as documents or messages. Some of it can be highly sensitive, for example information about possible criminal conduct or health.
Data protection and compliance therefore start with data minimization. Collect only what the case needs, and delete data that is manifestly irrelevant without undue delay (Article 17 of the directive).
Who may access whistleblowing data?
Only the authorized staff who receive or follow up on reports may know the identity of the reporting person, unless that person gives explicit consent (Article 16). A role-based access concept is the practical answer. Define who sees which case, log every access and review the rights regularly with your DPO. Encryption and automatic deletion after the retention period reduce the risk further.
Finally, document the roles in writing. A short description of who handles reports, who advises on data protection and who decides on measures avoids confusion when the first sensitive case arrives. Review it together with your DPO at least once a year.
Conclusion
Data protection and compliance are two sides of a working whistleblowing channel. The compliance officer handles the reports, and the DPO ensures that personal data is processed lawfully. With whistleblowing software from Trusty, your organization runs a secure, confidential channel without an IT project, from 49 EUR per month.
Related reading: Whistleblowing DPIA and Whistleblowing procedure step by step.
Frequently asked questions
The DPO is a GDPR role that advises on and monitors data protection. The compliance officer ensures that the organization follows laws and internal rules in general and can handle whistleblowing reports.
The GDPR allows other tasks only without a conflict of interests (Article 38(6)). Because the DPO monitors the processing of the same data, the combination needs careful assessment.
Yes. Any processing of personal data under Directive (EU) 2019/1937 must comply with the GDPR (Article 17).
No longer than necessary and proportionate (Article 18). National laws set periods, such as three years after closure in Germany and up to five years in Italy.
POLICIES, TRAININGS AND HOTLINE
Trusty Compliance App: company policies, compliance training and a whistleblowing channel in one app for your employees. 10 ready-made policies, 6 trainings, free trial, no IT setup.