Whistleblowing and Protecting the Whistleblower’s Personal Data

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

Protecting a whistleblower’s personal data is one of the foundations of an effective whistleblowing channel in Brazilian organizations.

Whistleblowing in Brazil and the Need for Data Protection

In recent years, Brazilian companies have adopted reporting channels at a remarkable pace, driven both by anticorruption legislation and by the demand for ever more robust compliance programs. Whistleblowing, the practice of employees, partners, or third parties reporting irregularities, has become an indispensable tool of corporate governance. But a channel is only as effective as the trust whistleblowers place in it, and that trust is closely tied to the assurance that their personal data will be handled with the utmost care.

Looking at the Brazilian regulatory landscape, Brazil’s General Data Protection Law, known as the LGPD (Law No. 13.709/2018), sets out principles and rules that apply directly to the handling of information collected through reporting channels. The whistleblower’s identity, the reports submitted, the data of the people reported, and even witness information all qualify as personal data (and, in many cases, sensitive personal data). That data calls for an appropriate legal basis, reinforced security measures, and well-defined retention policies. Ignoring this dimension exposes the organization to significant regulatory risk and, at the same time, undermines the credibility of the channel itself.

Many organizations still treat the reporting channel as a tool separate from their privacy program, which creates dangerous gaps. Integrating anticorruption compliance with data protection is not merely advisable. It is necessary if whistleblowing is to do its job without violating the fundamental rights of the people involved.

This subject is directly related to data sharing between public entities, a topic we cover in a dedicated article.

This subject is directly related to privacy in the workplace, a topic we cover in a dedicated article.

Legal Bases for Processing Data in Reporting Channels

One of the most sensitive issues in running a whistleblowing channel is identifying the legal basis that authorizes the processing of the personal data collected. In simpler situations, the data subject’s consent is easy to obtain. Reports are different, and consent is often an inadequate basis. A whistleblower who provides personal data when reporting an irregularity is, in most cases, not in a position to give free and genuine consent, especially when there is a reporting relationship with the person being reported.

An effective reporting channel depends on the whistleblower’s trust that their personal data is protected, and that trust is built on transparency, technical security, and sound legal governance.

In this setting, the most appropriate legal bases are usually the controller’s legitimate interest (art. 7, IX, of the LGPD), compliance with a legal or regulatory obligation (art. 7, II), and, in certain situations, the regular exercise of rights in judicial, administrative, or arbitration proceedings (art. 7, VI). Which one fits depends on the case. When the channel exists because a sector-specific rule requires it, compliance with a legal obligation is the better fit. When a company adopts the channel voluntarily as part of its integrity program, legitimate interest tends to be the sturdier basis.

Sensitive personal data (which can surface in reports involving discrimination, harassment, or health issues) calls for even closer scrutiny. Article 11 of the LGPD restricts the situations in which such data may be processed, and the organization must show that the purpose of the processing justifies this special category. We recommend that every reporting channel be preceded by a Personal Data Protection Impact Report (RIPD), as provided in art. 38 of the LGPD, documenting the legal bases chosen, the risks identified, and the mitigation measures adopted.

Legitimate Interest and the Balancing Test

When legitimate interest is the legal basis, a balancing test (a Legitimate Interest Assessment) is essential. The test asks whether the organization’s interest in maintaining the reporting channel outweighs the fundamental rights and freedoms of the data subjects involved. It should take into account the data subject’s reasonable expectations, the proportionality of the processing, and whether adequate safeguards exist, such as pseudonymizing the data and restricting access to the information collected.

Technical and Organizational Measures to Protect the Whistleblower

Protecting a whistleblower’s data does not end with choosing the right legal basis. It requires a coordinated set of technical and organizational measures that safeguard the confidentiality, integrity, and availability of the information throughout the entire life cycle of a report. From the moment a report is filed until it is eventually deleted, every stage requires specific controls.

On the technical side, several measures stand out: end-to-end encryption of communications through the channel; separate storage environments, so that report data never mixes with other corporate databases; granular, role-based access control; and audit logs that record every time the data is viewed or handled. Pseudonymizing the whistleblower’s data whenever possible significantly reduces the risk of improper identification, especially in the early stages of an investigation.

On the organizational side, we consider it essential to define roles and responsibilities clearly: who receives reports, who conducts investigations, who has access to the whistleblower’s identity, and under what circumstances that identity may be revealed. Regular training for the teams that operate the channel is just as important, because human error is one of the main causes of confidentiality breaches. Internal “need-to-know” policies (access limited to what is strictly necessary) should be documented and audited regularly.

The Question of Anonymous Reports

Many organizations allow anonymous reports as a way to encourage people to come forward and to protect them. From a data protection standpoint, an anonymous report has the advantage of eliminating (or drastically reducing) the processing of the reporter’s personal data. Caution is still needed, though. Even in reports that are nominally anonymous, technical metadata (such as the IP address, the time of access, and the characteristics of the device used) can allow the whistleblower to be re-identified. Anonymization must therefore be real, not merely formal, and must include deleting or obscuring that metadata.

Data Retention and Deletion

Another critical issue is how long the collected data is kept. Brazilian law does not currently set a single rule on how long report data must be retained. We recommend that the retention policy take into account the limitation periods that apply to the reported violations (which can vary depending on the nature of the offense), the requirements of sector regulators, and the need to preserve evidence for the organization’s possible defense. Once the retention period ends, the data must be deleted securely and the deletion documented, in accordance with art. 16 of the LGPD.

Data Subject Rights and Their Limits in Internal Investigations

The LGPD gives data subjects a broad set of rights, including access, correction, deletion, and portability. In reporting channels and internal investigations, however, exercising those rights creates significant tensions that deserve careful examination.

Consider a person who learns of an investigation and exercises the right to access the personal data the organization holds about them. Granting that request without limits could compromise the ongoing investigation, reveal the whistleblower’s identity (exposing them to retaliation), and interfere with the gathering of evidence. Article 18, §2, of the LGPD itself, along with legal scholarship, recognizes that data subject rights are not absolute and may be limited when there is legitimate justification, such as protecting internal investigations or exercising rights in the regular course of legal proceedings.

That limitation, however, must be proportionate and well-founded. The goal is not to systematically deny the rights of the person reported, but to calibrate the timing and the extent of the response. A good practice is to tell the person reported that their data is being processed (meeting the duty of transparency) without revealing details that could compromise the investigation or identify the whistleblower. After the investigation ends, the reported person’s rights can be honored more fully, subject to any remaining legal limitations.

As for the whistleblower, their rights include knowing how their data will be handled before they even file a report. For that reason, we recommend that the reporting channel present a clear, accessible, channel-specific privacy notice. It should describe the purposes of the processing, the legal bases relied on, the recipients of the data, the retention periods, and the contact details of the Data Protection Officer (DPO). This up-front transparency strengthens trust in the system and shows the organization’s commitment to regulatory compliance.

Data Due Diligence in Whistleblowing Programs

Data due diligence in a whistleblowing program is a systematic, recurring review of every aspect of how personal data is handled in the reporting channel. The review should cover everything from the adequacy of the legal bases to the effectiveness of the security measures in place, including whether third-party contracts (such as those with reporting-channel technology platforms) are compliant, whether internal policies are up to date, and whether teams are trained.

When we conduct a data due diligence for whistleblowing channels, we check whether the data mapping is current, whether the RIPD has been prepared and reviewed, and whether contracts with data processors (such as channel platform vendors) contain adequate data protection clauses (as required by art. 39 of the LGPD). We also check whether documented procedures exist for responding to security incidents involving report data, and whether the organization is prepared to respond to requests from the ANPD (Brazil’s National Data Protection Authority).

The due diligence should also assess international data transfers, which are common in multinational groups whose reporting channels are run by providers based abroad. In those cases, it is necessary to verify whether the destination country offers an adequate level of protection (as assessed by the ANPD) or whether appropriate safeguards, such as standard contractual clauses, have been put in place.

We recommend that data due diligence for whistleblowing programs be carried out at least once a year, and whenever there is a significant change in how the channel operates, a change of service provider, a relevant regulatory update, or a security incident. The results should be documented and reported to senior management as part of the compliance program’s continuous improvement cycle.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.