Internal reporting, external reporting and public disclosure

1. Regulatory Concept & Core Standards

This video's topic is internal reporting, external reporting and public disclosure. By the end, you should be able to explain the differences between reporting routes and their conditions. We will connect the information available, the criterion guiding the decision and the action that must be recorded. Follow the case and compare your answer with the proposed response. Protection depends on statutory conditions rather than the name of a form. The course examines reporting persons, covered breaches and the differences between reporting routes. The examples distinguish an unsubstantiated concern from deliberate falsehood and assess the work-related context.

Internal reporting is directed to the organisation's channel. External reporting is addressed to the competent authority. Public disclosure makes information available to the public and is subject to additional conditions. Countries do not all adopt the same relationship between internal and external routes. Assess the recipient, national conditions and specific risk, without assuming automatic protection for a social media post.

Apply the following rule: External reports may be submitted to the Rzecznik Praw Obywatelskich, the Commissioner for Human Rights, or the competent public authority. Prior internal reporting is unnecessary. The Commissioner receives reports, conducts an initial assessment and forwards them where appropriate. The RPO portal explains that anonymous reports are accepted only exceptionally, considering the importance of the case and public interest.

2. Practical Implementation & Procedure

Identify the objective, risks and competent authority. Consult national conditions before explaining the choice of route. A channel hosted by a technology provider may still be internal. The distinction depends on who receives reports and makes decisions, not on where the channel is hosted. Public disclosure requires its own assessment, even where external reporting would have been admissible. Before moving on, turn this procedure into a sequence you could explain to a colleague. Identify the first check, the action that depends on its outcome and the record that allows the decision to be reconstructed. Follow the sequence on screen and identify the point where an error would change the result.

3. Case Study & Compliance Action

An employee considers reporting to the competent authority because of fear of the manager’s reaction. A colleague proposes publishing all documents on social media. The conditions for those routes differ. Now read the case carefully. Separate established facts from information you would still need to confirm. Do not add motives or events that have not been described. This distinction matters when choosing a response proportionate to the information available.

The exercise is as follows: Does hosting the platform at a supplier turn a report into an external report? Choose an answer and write one sentence explaining it. During the pause, compare your choice with the criteria we have just considered. Also think about the material you would retain to explain the decision later.

No. The legal recipient and statutory procedure determine the route, not server location. A report to the employer can remain internal even when a service provider supports it.

One mistake to avoid is: teaching an obligatory sequence without exceptions from internal reporting to external reporting and public disclosure.

Now apply the national rule to a second decision. An advice webpage is listed as the sole destination for every report. What check is missing?

Check the recipient’s role and competence. RPO, competent public authorities, police and advisers do not have identical functions. Find the current dedicated route. An external report does not require prior internal reporting. Public disclosure needs a separate Article 51 assessment.