CP005Referral to law enforcement

The passing of a case, and the material supporting it, to an authority with powers the organization does not have.

Pillar: CP | Consequence for the person
Sources cited: 6
Added: 30 AUGUST 2026
Updated: 5 OCTOBER 2026

Control	Jurisdiction	Source	What it establishes	Prerequisite or recommendation
CP005/HRMandatory	Croatia	Zakon o kibernetičkoj sigurnosti, članci 4, 29, 30, 37, and 38Hrvatski sabor · read 5 Oct 2026	For key and important entities, that the members of the management bodies answer for the risk management measures, approve them, control their implementation, and follow and offer employees suitable training; that the measures include human resources security, access control policies and management of software and hardware assets with a regularly updated inventory, incident handling with monitoring, recording, and reporting, cyber hygiene and training, and multi-factor or continuous authentication; that a significant incident is notified to the competent CSIRT and, where there are grounds to suspect a criminal offence, to the law enforcement bodies; and that the measures and their implementation are set by the Government’s regulation.	For key and important entities, the notification of a significant incident is also delivered to the law enforcement bodies where there are grounds to suspect that it arose from a criminal offence.
CP005/GRMandatory	Greece	Νόμος 5160/2024, άρθρα 8, 14, 15, and 16Βουλή των Ελλήνων · read 5 Oct 2026	For essential and important entities, that the Εθνική Αρχή Κυβερνοασφάλειας is the competent authority and single point of contact, that the management bodies approve the risk management measures within three months of the Act’s entry into force, supervise their implementation, and are responsible for breaches, that their members follow training and the entity gives employees similar training at least annually, that the measures include incident handling, cyber hygiene and training, human resources security, access control policies, and asset management, and multi-factor or continuous authentication, that the entity designates a Υπεύθυνος Ασφάλειας Συστημάτων Πληροφορικής και Επικοινωνιών (Υ.Α.Σ.Π.Ε.) whose duties are incompatible with the Data Protection Officer’s, keeps a single cybersecurity policy and an inventory of assets ranked by criticality, and that a significant incident is reported in an early warning within 24 hours, a notification within 72 hours, and a final report within one month.	Where a significant incident is suspected to be criminal, the Εθνική Αρχή Κυβερνοασφάλειας gives the entity guidance on reporting it to the prosecuting authorities or the competent directorate of the Hellenic Police.
CP005/HUMandatory	Hungary	2023. évi XXV. törvény a panaszokról, a közérdekű bejelentésekről, valamint a visszaélések bejelentésével összefüggő szabályokról, 18. § to 23. §, 54. §, and 56. §https://njt.jog.gov.hu/jogszabaly/2023-25-00-00 · read 5 Oct 2026	That an employer with at least 50 persons in an employment relationship operates an internal abuse reporting system, that employers of 50 to 249 were reached on 17 December 2023 and may run it jointly, that it is operated by a designated impartial person or unit or by a whistleblower-protection lawyer or other external organization under the same impartiality rules, that a written report is acknowledged within seven days, that the investigation closes within thirty days of receipt, extendable with reasons to a maximum of three months, and that the reporter of an oral report is told that their identity is treated confidentially at every stage.	Where a report through the internal system warrants criminal proceedings, the operator arranges for a criminal complaint to be filed.
CP005/ESMandatory	Spain	Real Decreto 311/2022, Esquema Nacional de SeguridadGobierno de España · read 29 Aug 2026	The security measures a Spanish public sector body has to apply, graded by category, among them the concurrence of two people on critical tasks so that no single authorized individual can abuse their rights, an access control on the activity records themselves, and the recording of evidence where an incident may end in disciplinary action.	Evidence that may fall to be settled before a court is recorded as such, and the prosecution of an offense is one of the three cases the decree names for it, alongside disciplinary action against internal staff and against an external supplier. What that evidence has to comprise, and in what detail, is settled on specialized legal advice.
Recommended	Portugalwhere written	Deliberação n.º 7680/2014, Princípios aplicáveis aos tratamentos de dados pessoais decorrentes da utilização de tecnologias de geolocalização no contexto laboralComissão Nacional de Proteção de Dados · read 5 Oct 2026	That geolocation of vehicles is admitted for fleet management in external service in five activities, that protection of goods is weighed strictly and does not cover every vehicle, that geolocation of mobile phones is excessive for both purposes and the employer neither obtains location data from the operator nor installs GPS applications, that location data are never used to control performance, that indications of a crime may support a criminal complaint and a disciplinary proceeding where the facts themselves breach the worker’s duties, that driving parameters tied to the driver are anonymized, and that the purpose of fleet management is spent in the real-time view or the last position.	Indications of a crime in location data may support a criminal complaint.
Recommended	Switzerlandwhere written	Wegleitung zur Verordnung 3 zum Arbeitsgesetz, Artikel 26, Überwachung der ArbeitnehmerStaatssekretariat für Wirtschaft (SECO) · read 5 Oct 2026	What counts as a behaviour monitoring system (cameras in work rooms, microphones, continuous positioning, IT tools that monitor computer or phone activity at work or at home, sensors capturing biometric or physiological data, and AI tools for automated analysis of employee-based data), the three conditions of admissibility of a system needed for other reasons (a clearly overriding other interest, proportionality, and the participation of employees in planning, installation, hours of operation, and retention), the written justification produced to the labour inspectorate on request, and the data rules (prior detailed information, shortest predetermined retention, access limited to those authorized to evaluate, no archiving after the control, an internal regulation on rights and duties, monitored areas marked).	The prosecution of offences inside the business is for the police.