Your cookie preferences

EDPB guidance · Art. 7 GDPR

We use technical cookies essential for the platform to work (login, security, sessions). We would also like to use analytics cookies to understand how to improve it.

You can accept all, reject all, or choose which categories to switch on.Your consent is valid for 6 months and you can withdraw it at any time from the footer.

You will find everything in our privacy notice.

All news
Regulation July 20, 2026 3 min

Whistleblowing: without consulting the unions, the procedure is not compliant

The Italian anti-corruption authority's guidelines confirm that internal channels must be activated after hearing union representatives. Skipping it exposes the organisation to sanctions, however well the channel works

The forgotten requirement

The internal channel must be activated 'having heard worker representatives or trade unions' (Art. 4 of Decree 24/2023, referring to Art. 51 of Decree 81/2015). The consultation is informative - no agreement is needed - but it must happen and be documented. Skipping it makes the procedure non-compliant regardless of the channel's technical quality.

The three points that matter

  • Union consent is not required, but hearing them is: formally communicate (including by certified email) the activation or update of the channel, attaching the organisational act and setting a deadline for requesting a meeting. If no request arrives, the stage is complete.
  • It also applies to updates: the guidelines specify that unions must be heard not only at first activation but also for substantial changes to the procedure. Anyone who changed platform or handler in recent months should check.
  • The risk is twofold: an ANAC sanction for a non-compliant procedure, and a possible complaint to the data protection authority by the unions themselves, if they consider the process compromises the confidentiality of potential reporters.

What to do now, in practice

For clients subject to Decree 24/2023 (50+ employees, or bodies with a 231 compliance model): 1) retrieve documentary evidence of the union consultation carried out at activation: if none exists, remedy it now with a formal communication; 2) if the procedure was changed after activation, repeat the notice; 3) file the certified email, organisational act and minutes of any meeting with the whistleblowing documentation; 4) check the organisational act covers conflicts of interest of the handler and their replacement during prolonged absence.

Why it matters for your clients

It is the classic requirement nobody remembers because it is not about technology: you buy the platform, write the procedure, and forget the union step. For the DPO it is a quick check that shields the client from a formal challenge that is very easy to raise and just as easy to prevent. A scope note: whistleblowing under Decree 24/2023 is distinct from the privacy reporting channel to the DPO, which answers to its own purposes and rules.

Official source:ANAC - Guidelines on whistleblowing internal reporting channels; Legislative Decree 24/2023, Arts. 4 and 21

Looking for a workspace for your DPO work?

DPO Workspace is built by a certified DPO. 30-day free trial.

Start free

Related articles

Regulation
nullathe decision on a worker taken by the algorithm alone, from 23 October

A dismissal decided by the algorithm is void: from 23 October in Italy

Published in Official Gazette no. 234 of 8 October 2026 and in force since 23 October, decree no. 179/2026 provides that final decisions on the employment relationship cannot be based solely on automated processing, that the worker may request an understandable explanation, and that decisions taken in breach are void. In parallel, AI systems affecting work organisation enter the risk assessment under Article 28 of decree 81/2008. For a DPO this is the rare case where the consequence is not economic but civil, and it changes how the check is framed.

Oct 08, 2026New 8 min
Regulation
3signals that make notification due

Poland's UODO: not every breach must be notified. Public-register data on one side, PESEL, health and financial data on the other

If an invoicing system leaks only a sole trader's name, business name, tax number and registered address, already public in the business register, risk is normally unlikely. If it also leaks the national ID number, purchase details revealing health, or financial data, notification is due. Either way, the decision goes into the internal register.

Oct 05, 2026New 5 min
Regulation
120days to charge you, not to fine you

The 120 days are not the deadline to fine you: they are the deadline to charge you

Anyone who built an appeal on the authority's delay should re-read the calendar. The Court clarifies three things: the complaint procedure and the sanctioning procedure are autonomous, so overrunning the nine-to-twelve months on the complaint does not extinguish the power to fine; the 120 days are for notifying the charge, not for imposing the fine; and they run from the «definitive finding», which is not the first notice but the moment the authority can assess every element — including the hearing of your side. After the charge, only the five-year limitation period remains.

Sep 20, 2026 7 min