Internal reporting, external reporting and public disclosure

1. Regulatory Concept & Core Standards

This video's topic is internal reporting, external reporting and public disclosure. By the end, you should be able to distinguish the reporting route’s legal role from its provider. We will connect the information available, the criterion guiding the decision and the action that must be recorded. Follow the case and compare your answer with the proposed response. Protection requires statutory conditions. The channel may accept broader concerns, but receipt alone does not confer every safeguard. Assess work context, public interest, belief in the information’s truth and the reporting route.

Section 4 provides internal reporting, competent authorities and intermediaries. Encourage internal reporting when it can work effectively and the person believes adverse consequences will not follow. Public disclosure has separate conditions. External software hosting does not change an employer channel’s internal character.

Apply the following rule: Reports can go to competent authorities or through the contact point and specified organisations. Since 1 March 2026 KNAB is the contact point. It advises, refers, supervises compliance and examines cases where no competent institution can be determined. It does not replace every sector authority’s powers. Internal reporting is encouraged only under section 5(4); public disclosure has separate section 4 conditions.

2. Practical Implementation & Procedure

Identify recipient, powers and procedure. Verify the official route. Assess section 4 disclosure conditions, protected information and privacy. Do not impose employer permission as a universal prerequisite for external reporting. Before moving on, turn this procedure into a sequence you could explain to a colleague. Identify the first check, the action that depends on its outcome and the record that allows the decision to be reconstructed. Follow the sequence on screen and identify the point where an error would change the result.

3. Case Study & Compliance Action

One worker fears internal pressure and seeks an authority. Another wants to publish documents on social media. The choices require different assessments. Now read the case carefully. Separate established facts from information you would still need to confirm. Do not add motives or events that have not been described. This distinction matters when choosing a response proportionate to the information available.

The exercise is as follows: Does an external server make a channel an official external route? Choose an answer and write one sentence explaining it. During the pause, compare your choice with the criteria we have just considered. Also think about the material you would retain to explain the decision later.

No. The recipient’s legal role determines the route. A technical service confers no public powers and does not satisfy disclosure conditions.

One mistake to avoid is: confusing server location with reporting route.

Now apply the national rule to a second decision. The team treats KNAB as the only investigator for every sector. What needs clarification?

KNAB has performed contact-point functions since March 2026, but the competent institution examines the particular breach. The contact point helps identify it and also examines statutory cases where competence cannot be determined. Check the current official route. A private software provider does not become a competent public authority.