IV001Internal reporting channel

The route through which a person inside the organization reports a concern about another, and the protection owed to them for doing so.

Pillar: IV | Investigation and digital forensics
Sources cited: 11
Added: 30 AUGUST 2026
Updated: 5 OCTOBER 2026

Control	Jurisdiction	Source	What it establishes	Prerequisite or recommendation
IV001/HRMandatory	Croatia	Zakon o zaštiti prijavitelja nepravilnosti, članci 19 to 22Hrvatski sabor · read 5 Oct 2026	That an employer with at least 50 workers establishes a system of internal reporting, that the employer adopts a general act on the procedure and appoints a confidential person and a deputy on the proposal of the works council or the union representative or of at least 20 % of the workers, that the confidential person acknowledges receipt within seven days, gives feedback as a rule within 30 and at most 90 days, keeps the identity and the data confidential, forwards unresolved matters to the competent bodies, and reports to the external body within 30 days of deciding, and that the employer does not influence the confidential person.	An employer with at least 50 workers establishes a system of internal reporting under a general act, with a confidential person and a deputy who acknowledge receipt within seven days, examine and give feedback as a rule within 30 and at most 90 days, keep the reporter’s identity and the data confidential, forward unresolved matters to the competent bodies, and report to the external body within 30 days of deciding; the employer does not influence them, and whoever else receives a report forwards it unchanged.
IV001/GRMandatory	Greece	Νόμος 4990/2022, άρθρα 8, 9, and 10https://www.taxheaven.gr/law/4990/2022/arthro/9 · read 5 Oct 2026	That public bodies with 50 or more staff and private entities employing 50 or more at the same time appoint a Υπεύθυνος Παραλαβής και Παρακολούθησης Αναφορών (Υ.Π.Π.Α.), that entities in financial services, transport, and the environment do so at any size, that those of 50 to 249 may share one, that the Υ.Π.Π.Α. is an employee or a third party reporting to the top management body, bound to integrity, confidentiality, and abstention on conflict, that receipt is acknowledged within seven working days and feedback given within three months, that the identity of the reporter and of any third party named is kept confidential from unauthorized persons, and that the Υ.Π.Π.Α. designs training on ethics and integrity.	A private entity employing 50 or more at the same time, and one in financial services, transport, or the environment at any size, appoints a Υ.Π.Π.Α., those of 50 to 249 may share one; the Υ.Π.Π.Α. receives reports in writing, orally, or through a platform, acknowledges receipt within seven working days, keeps the identity of the reporter and of any third party named confidential from unauthorized persons, gives feedback within three months, and informs of the routes to the external channel; failure to appoint draws a fine from the Labour Inspectorate.
IV001/HUMandatory	Hungary	2023. évi XXV. törvény a panaszokról, a közérdekű bejelentésekről, valamint a visszaélések bejelentésével összefüggő szabályokról, 18. § to 23. §, 54. §, and 56. §https://njt.jog.gov.hu/jogszabaly/2023-25-00-00 · read 5 Oct 2026	That an employer with at least 50 persons in an employment relationship operates an internal abuse reporting system, that employers of 50 to 249 were reached on 17 December 2023 and may run it jointly, that it is operated by a designated impartial person or unit or by a whistleblower-protection lawyer or other external organization under the same impartiality rules, that a written report is acknowledged within seven days, that the investigation closes within thirty days of receipt, extendable with reasons to a maximum of three months, and that the reporter of an oral report is told that their identity is treated confidentially at every stage.	An employer with at least 50 persons in an employment relationship operates an internal abuse reporting system, those of 50 to 249 from 17 December 2023 and jointly if they choose; it is run by a designated impartial person or unit, or by a whistleblower-protection lawyer or other external organization under the same impartiality rules; a written report is acknowledged within seven days, the investigation closes within thirty days of receipt, extendable with reasons to three months at most, and the reporter is told that their identity is treated confidentially at every stage.
IV001/LUMandatory	Luxembourg	Loi du 16 mai 2023 portant transposition de la directive (UE) 2019/1937Chambre des Députés · read 5 Oct 2026	That private-law legal persons with 50 or more workers over twelve consecutive months, and public ones, establish channels and procedures for internal reporting and follow-up, that those of 50 to 249 may share resources and were reached from 17 December 2023, that the channel may be run by a designated person or service or by a third party, that it is designed so as to guarantee the confidentiality of the reporter and of any third party named and to bar unauthorized staff, that receipt is acknowledged within seven days, that an impartial person or service follows up, and that feedback comes within three months of the acknowledgement.	A private-law legal person with 50 or more workers over twelve consecutive months, and a public one, has channels and procedures for internal reporting and follow-up, run by a designated person or service or by a third party, designed to guarantee the confidentiality of the reporter and of any third party named and to bar unauthorized staff; receipt is acknowledged within seven days, an impartial person or service follows up, and feedback comes within three months; those of 50 to 249 may share resources and were reached from 17 December 2023.
IV001/ROMandatory	Romania	Legea nr. 361/2022 privind protecția avertizorilor în interes public, articolele 7, 9, 10, și 36Parlamentul României · read 5 Oct 2026	That a private legal person with at least 50 employees, and a public one at any size, identifies or sets up internal reporting channels and procedures for follow-up, that those of 50 to 249 may share resources and were reached on 17 December 2023, that the procedure holds confidentiality of the reporter and of any third party named, acknowledgement within 7 calendar days, a designated impartial and independent person, department, or third party, feedback within 3 months, and that reports are kept in a register for 5 years and then destroyed.	A private legal person with at least 50 employees, and a public body at any size, identifies or sets up internal reporting channels and procedures for follow-up; those of 50 to 249 may share resources and were reached on 17 December 2023; the procedure protects the confidentiality of the reporter and of any third party named and bars unauthorized staff, acknowledges receipt within 7 calendar days, designates an impartial and independent person, department, or third party, gives feedback within 3 months, and the designated person and the means of reporting are displayed on the website and at the premises, with at least one means accessible at any moment.
IV001/SEMandatory	Sweden	Lag (2021:890) om skydd för personer som rapporterar om missförhållandenRiksdag · read 5 Oct 2026	That an operator with 50 or more workers at the start of the calendar year has internal reporting channels, run by independent and autonomous persons or units, that receipt is confirmed within seven days and feedback given within three months, that oral reports are documented and documentation kept no longer than two years after the follow-up case is closed, and that whoever handles a report may not disclose what reveals the reporter’s identity.	An operator with 50 or more workers at the start of the calendar year has internal reporting channels run by independent and autonomous persons or units; receipt is confirmed within seven days and feedback given within three months; private operators of 50 to 249 were reached from 17 December 2023 and others from 17 July 2022.
Recommended	Austriawhere written	Österreichisches Informationssicherheitshandbuch 4.4.0Bundeskanzleramt und A-SIT · read 29 Aug 2026	That logging is only effective as a security measure once someone independent reads it, that where nobody independent can, the administrators’ own activity is what stops being checkable, and that the evaluation goes before the Data Protection Officer either way.	The routes by which something conspicuous in the logs is reported onward are to be laid down, alongside the fixing of who is responsible for the evaluation that found it.
Recommended	Belgiumwhere written	CyberFundamentals 2025, EssentialCentre for Cybersecurity Belgium · read 29 Aug 2026	What the Belgian centre sets out for the heaviest of its assurance levels, and the only place in this record where a national authority names the insider as something the detection tools are there to catch.	Staff are to be trained on how and where to report suspicious activity and on why reporting it in time matters, and the organization is to promote a culture in which an employee feels safe reporting a concern without fear of retaliation.
Recommended	Germanywhere written	IT-Grundschutz-Kompendium, Edition 2023Bundesamt für Sicherheit in der Informationstechnik · read 29 Aug 2026	What the German federal authority holds to be the state of the art, in numbered requirements, among them the checking of a candidate’s own account of themselves, a logging infrastructure the administrators who run it cannot alter, a regular audit of the detection systems against the state they are supposed to be in, and how evidence is secured.	Reporting routes suited to each kind of incident should be built, so that an employee can report quickly and simply over channels that are reliable and can be trusted, and where a central point is set up for it that is communicated to everyone. A communication and contact strategy should state who must be informed and who may be, by whom, in what order, and in what depth, and who passes information about an incident outside. That nobody unauthorized passes it on is to be ensured.
Recommended	Netherlandswhere written	Baseline Informatiebeveiliging Overheid 2, versie 1.3Nederlandse overheid · read 29 Aug 2026	The government measures Dutch public bodies add on top of the two information security standards, among them a screening policy, a detection use case named in the text, and a log retention set against the scenario that an attacker has been inside for a long time.	Everyone, internal and external, has demonstrably taken notice of the procedure for reporting an information security incident.
Recommended	United Kingdomwhere written	Ongoing Personnel Security: A Good Practice GuideNPSA · read 11 Aug 2026	Good practice for personnel security through employment rather than at the door, holding that protective monitoring should be proportionate.	Reporting routes are treated as a control in their own right, and their value as depending on whether they are trusted.