{"id":8540,"date":"2021-10-21T13:05:06","date_gmt":"2021-10-21T11:05:06","guid":{"rendered":"https:\/\/edorteam.com\/online-whistleblowing-channel-and-data-security-pay-attention-to-gdpr\/"},"modified":"2026-05-04T17:28:52","modified_gmt":"2026-05-04T15:28:52","slug":"online-whistleblowing-channel-and-data-security-pay-attention-to-gdpr","status":"publish","type":"post","link":"https:\/\/nova.edorteam.com\/en\/online-whistleblowing-channel-and-data-security-pay-attention-to-gdpr\/","title":{"rendered":"New European directive on anonymous whistleblowing channel for companies"},"content":{"rendered":"\n

European Directive on Complaints Channel<\/h2>\n

On 21st December, the obligation for all companies with more than 249 workers to have a complaints channel, as required by the European Parliament Directive of 23 October 2019, comes into force. By the end of 2023 it will be mandatory for all private and public companies with at least 50 employees, so most companies are already moving to purchase the best whistleblowing channel<\/em><\/strong>software solution.<\/p>\n

On AEPD's blog last post<\/a>, they emphasize the importance of choosing a solution that respects the basic principles of data protection. Over the next few months, all kinds of solutions will be promoted to implement your own online reporting channel, you can even find free reporting channels<\/strong>, but... Who guarantees that they have the security and privacy measures required by law?<\/strong><\/p>\n<\/div><\/div><\/div><\/div><\/div>

How to comply with the law in your whistleblower channel?<\/h2>\n

The most important thing is to preserve the anonymity and privacy<\/strong> of the complainant. The entire process can be handled internally and confidentially until it is resolved, but measures must be in place to ensure its integrity, which is why free whistleblowing channel software is not at all recommended.<\/p>\n<\/div><\/div>

If your company were to suffer a security breach through its whistleblowing channel and personal data were to be leaked, it could be fined up to \u20ac600,000.<\/h4>\n<\/div><\/div>

These are the requirements that every reporting channel must meet:<\/h3>\n<\/div><\/div><\/div><\/div>

1<\/p>\n<\/div><\/div><\/div>

Guarantee the confidentiality of the identity of the complainant.<\/h5>\n<\/div><\/div><\/div><\/div>

2<\/p>\n<\/div><\/div><\/div>

Designate a person, internal or external, as the person responsible for the complaints channel.<\/h5>\n<\/div><\/div><\/div><\/div>

3<\/p>\n<\/div><\/div><\/div>

The person responsible must acknowledge receipt of the complaints filed, no later than 7 days after receipt.<\/h5>\n<\/div><\/div><\/div><\/div>

4<\/p>\n<\/div><\/div><\/div>

Finally, the complaint must be responded to within a maximum period of 3 months from the issuance of the acknowledgment of receipt.<\/h5>\n<\/div><\/div><\/div><\/div>

5<\/p>\n<\/div><\/div><\/div>

Access must be external to the corporate network because it is not just a tool for internal staff. Anyone related to the company should be able to report.<\/h5>\n<\/div><\/div><\/div><\/div>

6<\/p>\n<\/div><\/div><\/div>

It must have the necessary measures to avoid security breaches, the most basic are:<\/h5>\n