GDPR and whistleblowing: data, access and organisational responsibilities

Review the data flow

GDPR permits transfers outside the EU/EEA with an appropriate legal basis and transfer mechanism. EU hosting is an operational choice, not a universal legal requirement. The subprocessor list distinguishes providers and data types; billing data is handled separately.

TLS protects data in transit. Sensitive report fields and private attachments use server-side AES-256-GCM encryption. The application decrypts for authorised users and server-side analysis; operators with access to the service and its keys can also decrypt.

Review identity and access

Confidentiality and anonymity differ. The EU directive protects identity; national law determines duties to accept anonymous reports. A voice, attachments and report details can identify a reporter.

Encryption does not mean a supplier has no access to content. Ask for an architecture showing key ownership, authorisation, analysis, retention and recovery. Check which data types subprocessors receive, including billing and notifications.

Check evidence and delivered service

We hold no ISO 27001 certification or SOC 2 attestation. We make no blanket guarantee of NIS 2 or AI Act compliance.

Audio add-on – coming soon. Audio recording and audio-file uploads are unavailable. Written reporting and in-person meeting requests are included. The organisation arranges its oral reporting route and requested meetings under applicable law.

Whistlechannel supports receiving and following up whistleblower reports. The organisation remains responsible for independent case handling, information, procedures and applicable legal duties.