GDPR and whistleblowing channels

Concept of personal data — Report content, metadata, contact details, logs, and information collected during proceedings are personal data if they allow identification of a person.

Legal basis (art 6) — Processing must have a legal basis, for example an obligation under legislation, contract performance, or legitimate interest. The organisation must document on what basis reporting data are processed.

Especially sensitive data (art 9) — Some reports may concern health data, political views, or other special categories of data. In that case, stricter conditions apply.

Data minimisation and purpose limitation (art 5) — Only what is necessary for proceedings may be collected, and data may be used only to handle the report.

Protection by design (art 25) — Privacy by design: technical and organisational measures must protect sensitive data by default, not added later.

Security (art 32) — Encryption, access control, logging, and other measures must be proportionate to the risk.

Controller and processor (art 28) — The organisation is usually the controller. An external platform provider is a processor and requires a data processing agreement (DPA).

Data subject rights (art 12–22) — Access, rectification, erasure, restriction, and objection where applicable and without breaching confidentiality of proceedings.

Data breaches (art 33–34) — In the event of a breach, it must be detected, documented, and where necessary reported to the supervisory authority and data subjects.

Retention and deletion (art 5) — Data may be kept only as long as necessary, and must then be securely deleted.

Confidentiality and identity protection — TÕRTKS requires confidentiality of the fact of reporting; the reporter’s identity may be disclosed only with written consent. The Act does not require accepting anonymous reports. Under GDPR, confidentiality must be delivered technically, including for metadata. Internal email usually does not do that. Technical anonymity is how confidentiality and GDPR measures are made real.

Confidentiality in proceedings — Report content may be known only to designated handlers. This aligns with GDPR need-to-know and access restrictions.

Documented proceedings — Written procedures and responsible persons are a procedural requirement; in practice this also means clear role allocation in data processing.

Activity logs and auditability — The law does not use the word “audit log”, but trustworthy proceedings and proof require being able to see who accessed the data.

External or independent channel — An external channel reduces conflicts of interest. From a GDPR perspective, it helps ensure access to data is limited and controlled.

Anti-retaliation — Whistleblower protection is a procedural legal requirement. Disclosing data to the wrong persons may violate confidentiality principles under both TÕRTKS and GDPR.

email metadata, forwarding, and shared mailboxes may reveal the whistleblower's identity;

IT administrators, backups, and search functions may give access to people who have no procedural need;

generic forms may not ensure EU/EEA data storage or a data processing agreement;

unstructured handling creates retention and deletion risks.

Clearly define the controller and, where needed, processor roles.

Document the legal basis, retention periods, and access rights.

Use a solution that supports anonymous reporting, role-based access, encryption, and activity logs.

Enter into DPAs with external providers and vet subprocessors.

Train handlers and conduct periodic compliance reviews.