Anonymity and confidentiality are not the same

In an anonymous report, the person’s identity is not known. In an identified report, identity is known but should remain confidential and accessible only under the permitted conditions.

What the framework provides

Official guidance indicates that channels should support written or verbal reports and may receive anonymous or identified communications. The organisation should clearly explain the available options.

The operational challenge

Without contact, clarifying facts may be difficult. A tracking code supports communication without requiring the person to reveal their identity.

How code-based follow-up works

  1. The person submits a report without creating an account.
  2. The system provides a unique code.
  3. The person keeps the code and returns to the tracking page.
  4. The team may request clarification through the process.
  5. Replies remain associated with the case without a personal login.

Configuration considerations

  • Do not request personal data that are not necessary.
  • Explain the effects of anonymous and identified reporting.
  • Define who may access identity where it exists.
  • Prepare messages that do not expose information to third parties.
  • Train the team not to seek to infer identity improperly.

The organisation’s policy should align with the technical form configuration and handling procedure.

Official sources: Portuguese Law 93/2021 — Diário da República and MENAC whistleblower-protection FAQ. This content does not replace legal advice.