How long must whistleblowing reports be kept and who may have access to them?

The reporting system is working, the first reports have come in, and the responsible person is facing a practical question: where to store them, how long to keep them and whether the managing director or the HR department may look at them. A report contains the personal data not only of the whistleblower but also of the person it is directed against, and often of witnesses too. The rules in Slovakia and the Czech Republic are similar, but the time limits differ.

Slovakia: a three-year register and strict confidentiality

The Slovak Whistleblower Protection Act requires an employer to keep a register of reports for three years from the date of their delivery (Section 11(1) of Act No. 54/2019 Coll.). The register contains the date of delivery, the whistleblower’s name, surname and residence (where not anonymous), the subject matter of the report, the outcome of the examination and the date on which it was completed. Everything that happens with a report is subject to strict confidentiality:

An employer under paragraph 1 shall, when receiving, examining and recording reports, maintain confidentiality as to the identity of the whistleblower and the identity of the person concerned; disclosure of information about the whistleblower’s identity requires their written consent.

— Section 10(7) of Act No. 54/2019 Coll. (unofficial English translation)

An exception is the duty to provide that information for the purposes of criminal proceedings or proceedings on an administrative offence. The Act further requires appropriate technical and organisational measures by which the company ensures and demonstrates that the system operates in accordance with the Act (Section 11(2)).

For access, a simple rule follows. A report and its file belong to the responsible person, not in a shared mailbox or a personnel file. Management receives the outcome of the examination and proposed measures, not the whistleblower’s name.

Czech Republic: five years and access for the responsible person only

Czech rules provide for longer retention and are more explicit about access. The responsible person must keep a report submitted through the internal reporting system, and the documents related to it, for five years from the date of its receipt (Section 21(2) of Act No. 171/2023 Sb.). The period therefore applies not only to the register but to the whole file. The responsible person keeps the register of data on reports received in electronic form (Section 21(1)), and only they have access to it, to the reports and to the related documents (Section 21(3)). Information about the identity of the whistleblower and other protected persons may be provided only with their written consent, unless the law imposes a duty to provide it to a public authority (Section 20(2)). A group with companies in both countries therefore cannot simply set a single period for everyone: the Slovak company works with three years of register keeping, the Czech one with five years of keeping the whole file.

Where the GDPR comes in

The whistleblower protection Acts determine what is recorded and for how long. All other questions of processing personal data from reports are governed by the GDPR. Slovak law therefore expressly requires the internal policy to address the processing of personal data contained in a report (Section 10(9)(f)). Once the statutory period has expired, the storage limitation principle (Article 5(1)(e) GDPR) requires an assessment of whether further retention has another basis, such as ongoing litigation or criminal proceedings, and if not, the data must be erased.

A sensitive situation arises where the person against whom a report was directed requests access to their personal data. The right to a copy of the data under Article 15(3) GDPR must not adversely affect the rights and freedoms of others (Article 15(4)). The reply is therefore prepared so that the whistleblower’s identity cannot be established from it, and it is advisable to set out the procedure for such a request in the internal policy in advance.

How we can help

We set up the register, access rights and retention periods according to the country in which the company operates and incorporate them into an internal policy through our whistleblowing and reporting system service. We align records of processing and information given to data subjects through our GDPR and personal data protection service. Who must have a system at all is explained in the duty to have an internal reporting system.