Internal reporting, external reporting and public disclosure

1. Regulatory Concept & Core Standards

This video's topic is internal reporting, external reporting and public disclosure. By the end, you should be able to explain the differences between reporting routes and their conditions. We will connect the information available, the criterion guiding the decision and the action that must be recorded. Follow the case and compare your answer with the proposed response. The national regime has its own scope and conditions. An organisation may accept a broader range of concerns under its policy, but this does not mean that all of them automatically receive the same legal protection. The assessment distinguishes receiving information, following it up and respecting people's rights.

Article 11 gives internal reporting priority for prompt prevention, with exceptions concerning retaliation or ineffective measures, and expressly permits internal reporting, external reporting or both. CPDP is the central external body. Public disclosure is separate and requires the article 7 conditions. Internal priority is not an unconditional ban on direct external reporting.

Apply the following rule: The Commission for Personal Data Protection, CPDP/KZLD, is the central external reporting body and coordinates checks with competent authorities. Article 11 permits internal reporting, external reporting or both; the internal priority and exceptions for retaliation risk or ineffective handling do not create a universal prohibition on direct external reporting. The amendment published on 5 June 2026 changes article 20(3) on public positions and the Commission for Counteracting Corruption. Check current powers and transitional rules; CPDP remains the central external body. Public disclosure has separate conditions under article 7.

2. Practical Implementation & Procedure

Identify the objective, risks and competent authority. Consult national conditions before explaining the choice of route. A channel hosted by a technology provider may still be internal. The distinction depends on who receives reports and makes decisions, not on where the channel is hosted. Public disclosure requires its own assessment, even where external reporting would have been admissible. Before moving on, turn this procedure into a sequence you could explain to a colleague. Identify the first check, the action that depends on its outcome and the record that allows the decision to be reconstructed. Follow the sequence on screen and identify the point where an error would change the result.

3. Case Study & Compliance Action

An employee has reasonable grounds to fear retaliation if she reports internally. She intends to contact the competent authority. Another employee wants to publish documents on social media because he considers the process too slow. These routes require separate assessments; the second decision does not automatically follow from the first. Now read the case carefully. Separate established facts from information you would still need to confirm. Do not add motives or events that have not been described. This distinction matters when choosing a response proportionate to the information available.

The exercise is as follows: Does hosting by a technology provider automatically make a platform an external reporting channel? Choose an answer and write one sentence explaining it. During the pause, compare your choice with the criteria we have just considered. Also think about the material you would retain to explain the decision later.

No. It may remain the organisation's internal channel. External reporting is addressed to a legally competent authority. Public disclosure is a third route with its own requirements, which must be assessed separately.

One mistake to avoid is: teaching an obligatory sequence without exceptions from internal reporting to external reporting and public disclosure.

Now apply the national rule to a second decision. An advice page is presented as the sole destination for every report. What check is missing?

The recipient's powers and role must be confirmed. Advice, external receipt, investigation and protection may belong to different bodies. Also check the national conditions for the selected route. User information must help people find the correct procedure without requiring steps that do not exist in law.