What must be confirmed during implementation.
Organisation and scope
Obligations should not be inferred from employee numbers alone. The country of operation, public or private nature, sector, activity and national transposition rules can change the applicable framework.
Receipt and follow-up
Reporting channels must enable reports to be received and followed up securely. Procedures should cover receipt, assessment, communication and appropriate action.
Confidentiality and access
The Directive requires confidentiality of the reporting person's identity and protection against unauthorised access. Anonymous reporting is determined by the law and practice applicable in each jurisdiction.
Records and retention
Reports and related information must be documented and retained only for as long as necessary and proportionate, subject to applicable national rules and any judicial or administrative proceedings.