Handling data from reports with care

Process only necessary information

Describe specific events and their connection with the organization concerned. We assess which information is necessary to handle the report. Private details unrelated to the possible violation should not be collected or shared. Allegations are initially reports of suspected misconduct, not established facts.

Limit access and disclosure

Personal information may be provided only to those offices or individuals who need it for their particular role and are entitled to receive it. Identifying information and the substance of a report must be considered separately. Even an anonymized summary can allow identification when only a small group of people is involved.

Who acts as the data controller and which recipients are involved depends on the specific engagement and the actual allocation of responsibilities. Engaging a law firm does not automatically mean it acts as a data processor. The privacy notice for the relevant reporting procedure explains these arrangements.

Documentation and retention

Documentation under the HinSchG must generally be deleted three years after the procedure ends. Longer retention is permissible only where necessary and proportionate to meet legal requirements. Separate retention duties may also apply to attorneys’ case files.

Rights of access and other data protection rights must be reconciled with statutory identity protection, attorneys’ duties of confidentiality, and the rights of others. This creates neither a blanket right to disclosure of a whistleblower’s identity nor a general exclusion of data subject rights.

Before sending documents

Discuss with us which documents are needed and how they can be sent. Do not obtain documents by committing criminal offenses yourself. If there is uncertainty, we can first clarify how to describe the facts already available.