Anonymous or confidential report?

Anonymous report

The whistleblower does not directly provide identifying details. However, the content or attachments may include information from which their identity can be inferred.

Identified and confidential report

The whistleblower provides personal details, but the organisation restricts knowledge of their identity to authorised people and legally necessary situations.

Follow-up without identification

A secure code can make it possible to check the status and exchange messages without creating an account or directly revealing identity.

Responsible communication

The portal should clearly explain the options, limitations and how data will be handled.

Risk of re-identification

An anonymous report does not request identifying details, but the text, attachments, dates or description of events may indirectly reveal who submitted it. The portal should warn about this risk, and the responsible team should avoid collecting information that is not necessary to assess the situation.

Secure dialogue without revealing identity

A tracking code makes it possible to request clarification, send additional information and communicate decisions without requiring a personal account. The security of this mechanism depends on protecting the code, encrypting communications, controlling access and configuring technical logs appropriately.

How to explain the options

The organisation should explain in plain language the difference between anonymity and confidentiality, who may know the identity, when information may be shared and the limitations of each option. The choice should be presented before submission without making absolute promises.

Practical controls for protecting identity

Anonymity depends on both technical configuration and the behaviour of the reporter and case handlers. Even without a name field, a file, signature, time reference or team description may allow a person to be reidentified.

Channel configuration and guidance should address the following:

• Do not request identifying details when anonymous reporting is selected.
• Warn about names, signatures and metadata that may be present in attachments.
• Protect the tracking code and do not send it through insecure channels.
• Limit access to identity in identified and confidential reports.
• Separate technical administration from case-content access where appropriate.
• Explain when identity may have to be disclosed because of a legal obligation.
• Maintain a secure way to request clarification without requiring identification.
• Delete or restrict data that is manifestly irrelevant to the assessment.