Dejan Jasnic · Co-founder & Compliance Lead, Trusty · 20+ years anti-fraud & compliance · ACFE Swiss Chapter Board
In most cases, yes. A whistleblowing channel processes sensitive data about reporters, the people they name and witnesses, so it usually meets the GDPR test of processing “likely to result in a high risk” that triggers a data protection impact assessment (DPIA). In some countries the answer is written down: Italy’s whistleblowing decree requires a DPIA, and France’s data protection authority lists whistleblowing systems among the processing that always needs one. Where no rule names it, the regulators’ own high-risk criteria point the same way. The DPIA must be carried out before the channel goes live and reviewed when it changes.
This guide explains when a DPIA is required, what it should cover for a reporting channel and the gaps that come up most often. For the wider legal framework, see our guide to whistleblowing law in the EU.
into the channel
A reporting channel designed around confidentiality. Trusty Whistleblowing gives you an anonymous two-way inbox, a full audit log, configurable retention periods and a data processing agreement for every customer.
Why a whistleblowing channel is a data protection question
A whistleblowing channel exists to collect information about possible wrongdoing. That information is almost always personal data: about the person who reports, the person accused, and colleagues or witnesses named along the way.
Three features make this processing sensitive:
- Special-category and criminal data. Reports can reveal health, trade union membership or sex life, which are special categories of data under Article 9 GDPR. Many reports describe possible offences, which brings in Article 10 on data relating to criminal convictions and offences.
- People who do not know they are named. The person concerned by a report usually learns about it late, if at all, and has little control over what is recorded about them.
- A legal duty of confidentiality. Article 16 of Directive (EU) 2019/1937 requires that the reporter’s identity is not disclosed beyond the authorised staff who handle reports without their explicit consent. This also covers any information from which their identity could be worked out.
The Directive also says that personal data which is manifestly not relevant to a report must not be collected, or must be deleted without undue delay if it was collected by accident (Article 17). These duties have to be designed into the channel. A DPIA is where you show how.
When a DPIA is required
Article 35(1) GDPR requires a DPIA before any processing that is likely to result in a high risk to people’s rights and freedoms. Article 35(3) lists three cases where it is always required, including large-scale processing of special-category or criminal-offence data.
For everything else, the Article 29 Working Party’s DPIA guidelines (WP248 rev.01) set out nine criteria. As a rule of thumb, processing that meets two of them will in most cases need a DPIA. A whistleblowing channel typically meets at least two: sensitive or highly personal data, and vulnerable data subjects, a category the guidelines say includes employees.
National rules settle the question in some countries. Each data protection authority (DPA) must publish a list of processing that requires a DPIA (Article 35(4) GDPR). Our check of the lists and related guidance found:
Country | Position on whistleblowing | Source |
|---|---|---|
France | The CNIL list includes processing to manage professional alerts and reports | CNIL Délibération n° 2018-327 |
Poland | The UODO list names systems for reporting irregularities (whistleblowing) as an example | UODO DPIA list |
Italy | Not on the Garante list, but the whistleblowing decree requires the reporting model to be based on a DPIA | Legislative Decree 24/2023, Article 13(6) |
Germany | Not on the national list, but the DSK guidance on whistleblowing hotlines says a DPIA is needed because of the particularly high risk | DSK Orientierungshilfe (2018) |
Spain, Belgium, Netherlands, Ireland | Not named on the national lists, so the general criteria apply | National DPIA lists |
If you conclude that a DPIA is not needed, document your reasoning. Groups that run one channel across several countries should check each national rule: our guide to whistleblowing for multi-country employers explains how.
clear access
Keep reports away from people who should not see them. Trusty offers SSO on every plan, two-factor authentication from Standard and role-based permissions on Advanced, with a full audit log of who did what.
What a whistleblowing DPIA should cover
Article 35(7) GDPR sets the minimum content: a systematic description of the processing and its purposes, an assessment of necessity and proportionality, an assessment of the risks to the people concerned, and the measures to address those risks. For a reporting channel, work through these points:
- Purpose and legal basis. Receiving and following up reports under your national whistleblowing law. For employers that must have a channel, this is usually compliance with a legal obligation.
- Data categories. Identity and contact details if the reporter gives them, the content of the report, evidence, interview notes, and any special-category or criminal-offence data.
- Access rights and roles. Name the roles: the report handler, a deputy for conflicts of interest, investigators. Everyone else, including IT and senior management, should have no routine access.
- Retention periods. Set a period for each stage. Italy allows records to be kept for no more than five years from the final outcome. Spain requires data to be deleted from the system after three months if no investigation has started, unless it is kept to show how the system works, and sets an absolute limit of ten years. Your whistleblowing policy should state the period you choose.
- Rights of the reporter and the person concerned. How you inform people under Articles 13 and 14 GDPR, when informing the person concerned can be delayed, and how access requests are handled without revealing the reporter.
- Security. Encryption, authentication, logging, hosting location, and how anonymous reporters stay anonymous.
- Processors. If a software provider hosts the channel, it acts as your processor and you need a contract under Article 28 GDPR. Italy’s decree requires this expressly.
How to run a DPIA in practice
- Map the process. Follow a report from submission to deletion, including oral reports and meetings.
- Involve the DPO early. Article 35(2) GDPR requires the controller to seek the advice of the data protection officer (DPO) where one is designated.
- Identify the risks. For example: the reporter is identified through metadata, a manager accused in a report can read it, or data is kept indefinitely.
- Choose measures. Match each risk to a control and record who owns it.
- Sign off and review. Management accepts the remaining risk on the DPO’s advice. Review the DPIA when you change provider, add a country or open a new channel.
In Italy, the 2025 guidelines of ANAC, the national anti-corruption authority, add two useful points. The controller can rely on the software provider’s support for the DPIA. And ordinary email or certified email (PEC) is considered in itself not adequate to protect confidentiality, unless specific, justified countermeasures are identified in the DPIA. For the broader picture, see data protection and compliance.
Common gaps
- Retention left undefined. “As long as necessary” is not a retention period. Set one for each stage and make sure the system enforces it.
- Too many people with access. Shared mailboxes, HR inboxes and administrator accounts often give more people sight of reports than the rule on authorised staff allows.
- No processor agreement. Using a provider without an Article 28 contract is a gap in itself.
- The person concerned is forgotten. Many DPIAs focus on the reporter. The person named in a report also has rights, and the assessment should explain how they are respected.
- Written once, never reviewed. A DPIA from the launch of the channel will not reflect new countries, new handlers or a new provider.
How Trusty Whistleblowing helps
Trusty Whistleblowing gives the controls a DPIA asks about a concrete home. Data is hosted in an ISO 27001 certified data centre in Germany, connections and communication are encrypted, and no IP addresses are stored. Reporters can stay anonymous and continue the dialogue through a secure inbox.
Every plan includes SSO, a full audit log and tamper-proof case records, with two-factor authentication from the Standard plan and role-based permissions on Advanced. Retention periods are configurable, with deletion reminders, and a data processing agreement is available for every customer.
Looking for whistleblowing software? Trusty sets up an internal reporting channel from €49 a month.
This article is general information, not legal advice. Sources: Regulation (EU) 2016/679 (GDPR); Directive (EU) 2019/1937; Article 29 Working Party, WP248 rev.01; CNIL, list of processing requiring a DPIA; UODO DPIA list; Garante DPIA list; Legislative Decree 24/2023; DSK, Orientierungshilfe Whistleblowing-Hotlines; AEPD DPIA list; Ley 2/2023; ANAC, Linee Guida n. 1/2025.
Frequently asked questions
In some countries it is required by name, for example in Italy under Legislative Decree 24/2023 and in France under the CNIL's list. Elsewhere, a reporting channel usually meets at least two of the regulators' high-risk criteria, which in most cases means a DPIA is required.
The controller, meaning the organisation that runs the channel, is responsible. It must seek the advice of its data protection officer where one is designated, and can ask the software provider for the technical details.
The GDPR sets no fixed period, so national law and your DPIA decide. Italy allows up to five years from the final outcome. Spain sets an absolute limit of ten years and requires deletion after three months if no investigation has started.
Yes, in principle, but it can be restricted to protect the reporter's identity. France's CNIL and Germany's DSK both confirm the right while allowing the reporter's identity to be withheld, and Italian law limits it where it would harm the reporter's confidentiality.
No. The organisation remains the controller and must still carry out the DPIA. The provider acts as a processor under an Article 28 contract and can supply the technical information you need.
with EU Directive & GDPR
Whistleblowing software made simple, built by compliance experts.