Whistleblowing and corporate compliance: a complete guide to internal channels, governance, privacy and Legislative Decree 24/2023

1. What whistleblowing is and why it is a compliance safeguard

Whistleblowing is the system through which a person who has learned of a breach in their work context reports it through a channel that protects their identity and obliges the organisation to take the report on. In Italy it is governed by Legislative Decree 24/2023, which protects those who report breaches of national or EU rules that harm the public interest or the integrity of the organisation. The term is not the same as an anonymous accusation, nor as any internal complaint.

A definition that stands up to the facts

The Decree does not define "whistleblowing": it regulates the protection of persons who report breaches. A report is the written or oral communication of information on breaches, including well-founded suspicions; the reporting person is whoever acquired that information in their work context. In popular usage, according to the Wikipedia entry, a whistleblower is someone who reports wrongdoing or fraud, publicly or privately, usually in the context of work (Wikipedia, entry "Whistleblower", CC BY-SA 4.0, accessed on 29 October 2026). In 2016 the Accademia della Crusca (Italy's language academy) proposed allertatore civico ("civic alerter") as the Italian equivalent. For obligations and thresholds, the Decree is what counts (section 3).

A report may be open, confidential (the identity is known to the recipient and shared only if needed) or anonymous: this is the distinction made by ISO 37002:2021, a voluntary standard. Under the Decree, confidentiality is an obligation of the channel; anonymity is a choice for the organisation. Details are in section 9.

Whistleblowing, complaint, non-conformity, personal matter

The Decree excludes disputes and personal grievances that relate exclusively to individual employment relationships, including those with hierarchical superiors.

The last two rows and the choice of who deals with them are an EcosAgile working model, not a published standard: the Decree sets only the boundary with personal grievances.

The same matter can have two natures: a customer who complains about an invoice may have brought to light, without knowing it, a wrongdoing of the organisation. A report that reaches a party that is not competent must be forwarded to the competent party within 7 days, with notice to the reporting person. The timescales are in section 8; the boundary with workplace bullying (mobbing), which does not always fall within the Decree, is in section 4.

What it is for, and why it is compliance

The channel serves to bring wrongdoing to light before it turns into disputes, to protect the integrity of the organisation and to be able to show those who govern and oversee it how the organisation responded. That is why it is a compliance safeguard: it intercepts risks that ordinary controls do not see, leaves a trace that the report was taken on and protects the reporting person from retaliation. For organisations with an organisation model, internal channels are a mandatory element of the model (section 11). On personal data: section 10.

Our position: the channel is a control safeguard with a named owner, not a mailbox. Its value is measured by what happens to the reports, not by how many arrive. The Decree also penalises the failure to verify and analyse reports, in addition to the failure to set up the channel. A year without reports does not prove that wrongdoing is absent: as a working criterion, it is a prompt to check accessibility and trust (section 15).

2. Regulatory framework 2026: Legislative Decree 24/2023, ANAC, GDPR and the 231 Model

As at 29 October 2026 the Italian reference is Legislative Decree 24/2023, which transposes Directive (EU) 2019/1937. The ANAC Guidelines No. 1/2025, approved by Resolution 478 of 26 November 2025, detail the internal channels; Resolution 479, of the same date, amends Guidelines 311/2023 on the external channel and also affects anonymous reports, email and certified email (PEC), the channel manager and the sharing of the channel. Alongside them stand the GDPR, the Italian Privacy Code (Codice privacy) and, for organisations that adopt it, Legislative Decree 231/2001.

Last regulatory check: 29 October 2026, on the texts published in the Official Gazette, Normattiva, ANAC and the Garante. This section describes the rules and is not legal advice.

What is law and what is guidance

The obligations and the penalties are in the Decree. The ANAC Guidelines are guidance acts of the Authority, which in the text refers to its own "general power of guidance"; the degree of legal bindingness is not stated. The Guidelines do not address the point explicitly and the reading should be confirmed with your own adviser. As good practice, anyone who departs from the Guidelines puts the reasons in writing. Guidelines 478 supplement Resolution 311/2023 without replacing it; Resolution 311, as amended by Resolution 479, remains in force in its consolidated version.

The last column is an EcosAgile working model, not an official text.

Resolutions 478 and 479: what changes compared with 2023

Anyone who built the procedure on the 2023 material should re-read three points. Anonymous reports: organisations "may" now treat them as ordinary reports, but must regulate the choice in their own acts. Email and PEC: in themselves not adequate, unless countermeasures are justified in the impact assessment. Sharing the channel: each organisation still appoints its own channel manager. Commentary dated before 26 November 2025 on these points is out of date. Details in sections 6, 9 and 12.

GDPR, Privacy Code and the Garante

Article 13 of the Decree refers to the GDPR and the Privacy Code, with privacy notices to reporting persons and persons involved; Article 2-undecies of the Code limits the data subject's rights in order to protect the identity of the reporting person. The Garante's inspection plan for January-July 2026 provided for checks on applications used for reports. Details, DPIA included, in section 10.

Penalties under Article 21 in brief

From EUR 10,000 to 50,000, imposed by ANAC, for retaliation, obstructing a report and breach of confidentiality; the same range for failing to set up channels, procedures that do not comply with Articles 4 and 5 and failing to verify and analyse reports. From EUR 500 to 2,500 in the cases of Article 16(3) (liability of the reporting person), unless there is a conviction, even at first instance, for defamation or false accusation (calunnia). For the penalty relating to the channel, the governing body answers jointly and severally with its members.

Resolution 344/2026 concerns a channel with an encrypted platform that was penalised all the same: EUR 15,000 on each of the three members of the management body, for breach of Article 12. Confidentiality covers any information from which the identity can be inferred, even indirectly; the facts predated Guidelines 478 and the conduct was judged negligent.

Insight from the expert: the chapter "ANAC Resolutions 478 and 479 and the regulatory framework" (00:00) of the 2026 EcosAgile webinar sets out the two resolutions and the role of ANAC as the authority for enforcement, penalties and oversight. The presenter is a software supplier and does not give legal advice: the text of the resolutions prevails. See the webinar Whistleblowing and ANAC guidelines: what Resolutions 478 and 479 require on reporting channels (in Italian).

3. Who must set up an internal whistleblowing channel

A private-sector entity that had an average of at least 50 employees in the last year must set up an internal channel. The threshold, however, does not exhaust the obligation: below 50, it also applies to private-sector entities that fall within the sectors of the EU acts referred to in the Annex to the Decree and to those that have adopted a 231 Model. The Decree requires a compliant channel and a procedure, not the purchase of a specific piece of software.

The cases, one by one

The summary by row is an EcosAgile working model, not an official text. Public bodies follow their own rules (handling by the Head of Corruption Prevention and Transparency, RPCT), outside the scope of this guide.

For groups the threshold is calculated on the individual company, not on the group (section 12). Who can report and what can be reported in the different cases is in section 4.

The sensitive sectors

These are the sectors covered by the European Union acts listed in the Annex to the Decree. According to the summary published by ANAC they include, among others, financial services, products and markets, anti-money-laundering, transport safety and environmental protection. The reference is Article 2(1)(q)(2); Article 3(2), by contrast, concerns the reportable breaches. A below-threshold entity operating in one of these sectors checks the Annex, not its impression of being a small organisation.

How the threshold of 50 is read

The rule speaks of an average "in the last year". ANAC specifies that the reference is the last calendar year before the current one, with the average number of staff taken from the data of INPS (the Italian National Social Security Institute) shown in the Chamber of Commerce records; for new businesses, the current year or the latest record. As at 29 October 2026 you therefore look at 2025. How to count part-time staff, agency workers and contractors is not stated in the sources consulted: the reading should be confirmed with your own adviser. The same applies to the relationship between the ANAC criterion and the text of the Decree.

Example with fictitious data: a company has 47 staff today, but in 2025 the average was 53. Under the criterion indicated by ANAC the reference year would be 2025, so the company would be above the threshold even if it has fallen below 50 today: the reading should be confirmed with your own adviser.

The 2023 deadlines are history

The Decree has had effect since 15 July 2023 and since 17 December 2023 the obligation has also been operative for private-sector entities of up to 249 workers. There is no open compliance deadline today: an obliged entity without a compliant channel can be penalised EUR 10,000-50,000 (Article 21(1)(b); section 2). Texts that still speak of requirements "by 17 December 2023" describe a past situation.

No obligation to buy software

Article 4(3) allows written reporting, including by IT means, and oral reporting. Guidelines 478 regard the IT form as preferable and note that platforms allow encryption and confidential dialogue by means of a code; without a platform, they allow confidential registration in a double envelope, which for bodies subject to the Digital Administration Code (CAD) is, however, a "last resort". Our reading: a platform is the most straightforward way to obtain confidentiality and dialogue with the reporting person together, but it remains a choice for the organisation, to be justified in the organisational act. How to assess a supplier is in section 16; email is dealt with in section 6.

4. Who can report and what can be reported

Anyone who learned of the breach in their work context can report: not only employees currently in post, but also self-employed workers, contractors, consultants, trainees, shareholders and suppliers' workers, and in certain cases candidates and former workers. What is reported is breaches of national or European Union rules that harm the public interest or the integrity of the organisation. Personal grievances that concern only the person's own employment relationship are left out.

Who is protected

The list in Article 3 of Legislative Decree 24/2023 goes well beyond the word "employees".

The table is an EcosAgile working model that rearranges Article 3: the text of the Decree prevails.

The facilitator assists the reporting person confidentially, in the same work context; designating one is the reporting person's choice. A facilitator should not be confused with a Third Sector entity (Ente del Terzo settore), and a trade unionist who assists under the union's name is not one. Customers do not appear as a category in the list in Article 3(3): accepting their reports is a choice for the organisation, outside the Decree, and whether and to what extent the Decree's protections apply to them should be confirmed with your own adviser.

What can be reported

Article 2(1)(a) speaks of administrative, accounting, civil and criminal offences; of conduct relevant under Legislative Decree 231/2001 or of breaches of 231 Models; of wrongdoing of European origin concerning, among other things, public procurement, anti-money-laundering, the environment, product safety, public health, consumers, privacy and competition. Well-founded suspicions are enough. Since 24 January 2026 breaches of EU restrictive measures are also included.

For private-sector entities the scope depends on the type of entity (Article 3(2)). For those with at least 50 workers and for the sensitive sectors the rule refers to the European breaches in points 3 to 6; an entity below the threshold with a 231 Model receives 231 conduct and breaches of the model in its internal channel. Who is obliged is explained in section 3; the exact boundary for your own organisation should be confirmed with your adviser.

What is left out: complaints, mobbing, personal conflicts

Excluded are disputes of personal interest linked exclusively to individual employment relationships, including with hierarchical superiors, cases already regulated on a mandatory basis by sector-specific acts, and national security. The rules on classified information and on legal and medical professional secrecy remain unaffected.

A colleague who complains about the shifts assigned by their manager raises a personal matter; if they describe false invoices issued to cover a shortfall, they raise a wrongdoing. Mobbing (workplace bullying) sits in between: it is not whistleblowing by definition, it becomes so if a breach of Article 2 lies behind it, and it can appear as retaliation (section 9). The ordinary complaint is dealt with in section 1; the channel manager checks the preconditions before the investigation (section 8).

Where out-of-scope reports go, to HR or to complaints, is for the organisation to choose and to write in the organisational act. Confidentiality is not lost along the way: the Garante, in Opinion No. 581 of 9 October 2025 on the drafts of the guidelines, recalled the reasonable expectation of protection of those who believed they were protected.

Anonymous reports

The Decree does not regulate them. The organisation may treat them as ordinary reports and writes this in its internal act; in any case it records and retains them, because a reporting person who is later identified and suffers retaliation is protected (Article 16(4)). Anonymity and confidentiality are distinguished in section 9.

5. Internal channel, ANAC external channel and public disclosure

Legislative Decree 24/2023 provides for three routes: the organisation's internal channel, the external channel run by ANAC and public disclosure. The reporting person does not choose at will. The external channel is used only in the cases set out in Article 6(1), and public disclosure only if one of the conditions in Article 15 applies. The organisation must explain to those who work with it when to move from one route to another.

The table is an EcosAgile working model that summarises Articles 4, 6, 7 and 15: the text of the Decree prevails.

When the ANAC external channel can be used

Article 6(1) allows external reporting only if at least one of these cases applies:

1. the internal channel is not required, or is not active, or is not compliant;
2. an internal report has already been made and was not followed up;
3. there are reasonable grounds to believe that the internal report would not be followed up, or would expose the person to retaliation;
4. there is an imminent or manifest danger to the public interest.

ANAC Resolution 479/2025 adds that a person working in a private-sector entity with fewer than 50 employees, without a 231 Model and outside the sensitive sectors, may nonetheless report to ANAC. What protections that reporting person is entitled to is a point to confirm with your own adviser. For ANAC's deadlines (acknowledgement within 7 days, feedback within 3 months or, for justified reasons, 6) Article 8 applies; those of the organisation are in section 8. ANAC page: anticorruzione.it/-/whistleblowing.

Public disclosure: conditions and precautions

Article 15 provides protection if, alternatively: the internal and external report (or the external report alone) received no response within the time limits; there is an imminent or manifest danger to the public interest; there is a risk of retaliation or little follow-up to the external report is likely, for example because evidence could be concealed or because there is collusion between the recipient and the person who committed the breach. Journalistic confidentiality of sources remains.

Protection is tied to these conditions: those who turn to the press outside them do not have the same certainty of protection. The organisation's information can set out the conditions and refer to the text of the law; the individual case is for a professional to assess.

What to publish on the website and in the workplace

Article 5(1)(e) requires clear information on the channel, procedures and preconditions, for both internal and external reports. It must be displayed in the workplace, made accessible also to those who do not attend it and published in a dedicated section of the website, if the organisation has one. According to ANAC the organisational act or the 231 Model should also be circulated to suppliers, consultants, contractors and partners.

The website page should contain at least:

• who the channel is for, external parties included;
• how to access the internal channel and by what means (written, oral, meeting on request);
• who manages it, even if only as a role;
• the confidentiality guarantees and the reference to the privacy notice;
• when the external channel can be used and the link to ANAC;
• the conditions for public disclosure;
• the prohibition of retaliation and the fact that retaliation is reported only to ANAC (Article 19).

The list is an EcosAgile working proposal, not a model published by ANAC.

6. How the internal channel should be designed

The internal channel must guarantee confidentiality. Article 4(3) provides for reporting in written form, including by IT means, or orally, and, at the reporting person's request, a direct meeting within a reasonable time; the ANAC Guidelines 478/2025 ask the organisation to guarantee both written and oral reporting. There is no obligation to buy software: the Decree requires a compliant internal channel, and ANAC considers IT platforms preferable for written reports. Without a platform there remains confidential registration in a double envelope, indicated by ANAC as a last resort for bodies subject to the CAD.

Written, oral, direct meeting

ANAC asks for both forms to be guaranteed: a written-only channel is not enough. The methods of receipt and the handling process must then be set out in the organisational act.

The column on the act is an EcosAgile working model; the first two columns report the rule and the guidelines.

Accessibility for external parties and suppliers

The channel must be easily accessible to all those entitled to use it, consultants included, and the information must be reachable also by those who do not attend the workplace. A consultant or a supplier's employee does not have the organisation's credentials: a channel reachable only from the intranet would leave them out. This is a design choice. Who can report: section 4; the information page: section 5.

Confidentiality and follow-up

Article 4(1) requires protection of the identity of the reporting person, of the person involved and of the person mentioned, as well as of the content and the documentation, including by encryption. If the channel is accessed from the internal network, the non-traceability of the reporting person must be guaranteed, on the platform and on firewalls and proxies; a report that arrives by mistake on another medium must still be protected. The dialogue to obtain supplementary information (Article 5(1)(b)) must also take place without exposing the identity. Technical measures: section 13; handling stages: section 8.

Email and PEC

ANAC considers email, ordinary or certified, in itself not adequate to guarantee the confidentiality of the reporting person's identity, unless accompanied by specific countermeasures justified in the impact assessment (DPIA). The reason is technical: mail systems generate and retain sending and receiving logs, with a greater risk on the corporate mailbox. The wording says neither "prohibited" nor "permitted": whoever chooses email must be able to show which countermeasures have been adopted and why. On the DPIA, section 10.

Insight from the expert: the 2026 EcosAgile webinar (in Italian) devotes one chapter to the DPIA and email (26:23) and one to oral reporting, meetings and groups (40:04). On email and PEC, the ANAC text prevails.

In EcosAgile: the channel is cloud software in the Compliance module with two entry points: a public link, without credentials, for non-employees (customers, suppliers, consultants) and an entry point for employees. The written report is completed in two steps, with a privacy notice, consent and anti-bot protection; the reporting person enters the reason, subject and description, attachments are optional and there is an "Anonymous" switch. On submission the reporting person receives a KeyCode, the code used to see the status and to communicate confidentially with the company, even if anonymous. The audio attachment is optional, with voice distortion, and is reserved for non-anonymous reports: it should not be read as an oral channel compliant with the guidelines. Channel managers, the organisational act, the DPIA, meetings outside the platform and training remain the organisation's responsibility.

7. Governance: channel manager, autonomy and conflicts of interest

The channel manager is the person or office, internal or external, that receives the reports and follows them up. The Decree requires the manager to be autonomous and to have specifically trained staff (Article 4(2) of Legislative Decree 24/2023); for ANAC, autonomy means impartiality and independence. In the private sector no role is the channel manager by definition: what matters are the requirements, the training and, as ANAC indicates, a substitute identified in advance for absences and conflicts.

Requirements of the channel manager

The ANAC Guidelines No. 1/2025 (Resolution 478 of 26 November 2025, pp. 14-15), which are guidance from the Authority and not law, ask for a channel manager who is impartial, independent, trained and familiar with the organisation; legal, ethical and privacy competence is preferable. The manager investigates: does not establish individual liability and does not decide penalties. The governing bodies do not supervise individual cases and do not have the last word on the investigation. For training see section 15.

Internal or external channel manager

An internal channel manager (ANAC cites internal audit, the OdV and ethics committees as examples) knows the organisation. An external one requires a contract, adequate powers and an organisational act that refers to it. Outsourcing does not shift responsibility: the principal remains liable to a penalty if it chooses an unsuitable manager. For the privacy roles (Article 28 GDPR) see section 10.

Substitutes and continuity

ANAC indicates that the act should identify in advance a substitute with the same requirements, for conflicts or prolonged absence, which in footnote 24 is an absence of more than 7 days. These are the 7 days of the acknowledgement of receipt (section 8): an uncovered holiday period puts that deadline at risk. If the substitute too is in conflict, or a small organisation is unable to appoint one, the reporting person can turn to ANAC.

Conflict of interest and recusal

There is a conflict when the channel manager is involved in the reported facts or has an interest in the matter, and the organisational act must regulate it. Working model: written recusal, case passed to the substitute, access revoked for the conflicted manager. The difficult case is a report that concerns the channel manager or their superior: the written procedure says at once who takes it.

DPO, OdV and other roles

In large or complex organisations, as far as possible, the Data Protection Officer (DPO) is not the same person as the channel manager; below 50 employees, with a reasoned assessment, they can be the same person. The DPO oversees the processing: if they are also the channel manager, they oversee a process that they themselves run. The OdV appears among the examples of channel manager, with neither an obligation nor a prohibition; if it is not the channel manager, the act regulates the coordination and the OdV does not have access to reports. See section 11; the reading should be confirmed with your own adviser.

The limits for HR and IT are an EcosAgile working model, not a published standard.

Organisational act, governing body and trade unions

The channels are defined in an organisational act or in the 231 Model, adopted by the governing body: the tasks and powers of the channel manager, the methods of receipt, the process. The body answers for the Article 21 penalties relating to the channel, jointly and severally with its members. Before the channel is activated, and at every substantial change, the trade union representatives must be "consulted" (Article 4(1)): prior notice to the workplace union representatives (RSA/RSU) or, failing that, to the most representative local trade union organisations. The opinion is not binding, but without the notice the procedure is not compliant and the organisation is liable to a penalty.

Insight from the expert: the 2026 EcosAgile webinar devotes to the channel manager the chapters "The channel manager and continuity" (06:39) and "Conflicts of interest and management committee" (10:55): Whistleblowing and ANAC guidelines: what Resolutions 478 and 479 require on reporting channels (in Italian).

8. How a report is handled: acceptance, investigation and timescales

The channel manager sends the acknowledgement of receipt within 7 days of receipt, verifies the preconditions, requests supplementary information, carries out the investigation and gives feedback within 3 months of the acknowledgement or, if none was sent, of the expiry of the 7 days (Article 5(1) of Legislative Decree 24/2023). For ANAC the 3 months are not peremptory, but the outcome must be communicated in any case. The feedback may be interim and does not coincide with the closing of the investigation.

Stages taken from the Decree and ANAC; the calculation convention and the timescales not fixed by law are an EcosAgile working model.

Receipt and acknowledgement of receipt

The 7 days run from receipt (Article 5(1)(a)); for ANAC the acknowledgement is informational and does not assess the content. The Decree says "days" without specifying which: as a procedural choice we propose counting them as calendar days, and writing this in the procedure. For the internal channel, Article 5 provides no exceptions to the acknowledgement; those in Article 8 apply to ANAC.

Verification of preconditions and supplementary information

After Resolution 479/2025 ANAC no longer speaks of "admissibility": the channel manager verifies that the reporting person is entitled to report and that the breach falls within the Decree. What to do if the preconditions are missing is decided by the organisation's procedure, to be written in the organisational act and checked with your own adviser.

Investigation

The Decree requires "diligent follow-up" and does not fix its duration. Internal departments or specialists are involved without forwarding the report: only outcomes or anonymised extracts are passed on. The identity is accessed only where strictly necessary, logging the access and the reasons. Confidentiality covers any information from which the identity can be inferred, even indirectly: with Resolution 344 of 9 September 2026 ANAC penalised the three members of a management body EUR 15,000 each, even though the platform was encrypted: the breach came from the questions asked during the investigation. See section 9.

Feedback within 3 months

The feedback communicates the follow-up given or planned, even if only as a status update. The deadline is not peremptory but has consequences: without follow-up the reporting person can turn to ANAC, and failing to carry out checks and analysis is liable to a penalty (Article 6(1)(b); Article 21(1)(b)). See section 5.

Example with fictitious data: report of 10 February 2027, acknowledgement by 17 February 2027 at the latest. With an acknowledgement on 12 February 2027 the feedback falls due on 12 May 2027; without an acknowledgement, on 17 May 2027.

Outcome, action log and retention

The final outcome must be communicated in any case, and retention runs from that point (section 10). "Audit trail" appears neither in the Decree nor in the Guidelines, which ask for access to the identity to be logged with the reasons, and for anonymous reports to be logged. The EcosAgile working model is a log of the actions on the case (who, what, when, why) without identifying data of the reporting person or network identifiers.

In EcosAgile: on submission the reporting person receives a KeyCode, the code used to see the status and to communicate with the company, even if anonymous. The channel manager, who cannot modify the content of the report, sets priority, owner, actions and internal notes and gives feedback with a status (Active, In progress, Suspended, Closed, Rejected). The reminders to the owner of the reason (with the contact person in copy) at 5, 25 and 30 days contain no information about the report; the reminder deadline can be set (default 90 days) and does not coincide with the 3 months required by law, which the organisation monitors in its own procedure.

Insight from the expert: the 2026 EcosAgile webinar shows in a demo the reporting person's access (27:48) and the handling (32:36). For the deadlines the Decree applies: Whistleblowing and ANAC guidelines: what Resolutions 478 and 479 require on reporting channels (in Italian).

9. Confidentiality, anonymity and whistleblower protection

Confidentiality and anonymity are different things. Confidentiality is an obligation of the channel: the identity of the reporting person, and any information from which it can be traced back to them, is not revealed to anyone not authorised without express consent (Article 12(2) of Legislative Decree 24/2023). Anonymity is a choice for the organisation. Protection is the prohibition of retaliation, under the conditions of Article 16.

Sources as at 29 October 2026. It describes the rules and is not legal advice.

Confidentiality of identity

The channel must guarantee it also for the person involved and the persons mentioned (Article 4(1)). In disciplinary proceedings the identity is revealed only with express consent, if indispensable for the defence (Article 12(5)-(6)). A breach is penalised by ANAC with EUR 10,000-50,000 (Article 21(1)(a)).

The concrete risk is identification by deduction. With Resolution No. 344 of 9 September 2026 ANAC penalised three members of the management body of a private company EUR 15,000 each for breaching Article 12, even though the platform was encrypted. According to the ANAC press release, the risk arose from the questions asked in the interviews, which together with the context could reveal who had reported.

Anonymity and confidentiality compared

The Decree does not regulate anonymous reports, except Article 16(4). The organisation "may" treat them as ordinary reports and writes its choice in the internal act; it records them in any case.

Summary: EcosAgile working model, not a published standard.

In EcosAgile: on submission the reporting person receives a KeyCode, the code used to see the status and to communicate confidentially with the company, even if anonymous. In anonymous mode the system is configured not to store identifying technical elements in application logs and notifications, without promising absolute anonymity. Someone reporting from the public link, without credentials, receives no notification emails from the system; for use from the employee area the manuals describe notifications to the reporting person.

Prohibition of retaliation

Retaliation is any act or omission, even if only attempted or threatened, by reason of the report, that may cause unjust harm (Article 2(1)(m)). The list in Article 17(4) is illustrative:

• dismissal, suspension, demotion;
• change of duties, workplace, salary or working hours, non-renewal of a fixed-term contract;
• negative references, disciplinary measures, harassment, ostracism;
• early termination or cancellation of a supply contract.

The rule presumes that the acts are a consequence of the report: proving unrelated grounds is for whoever adopted them (Article 17(2)-(3)). The acts are null and void and a dismissed person is entitled to reinstatement (Article 19(3)). Retaliation is reported only to ANAC (Article 19).

Facilitators and connected persons

Protection also covers the facilitator, persons in the same work context linked by a stable emotional bond or kinship up to the fourth degree, colleagues with a habitual relationship and the reporting person's entities (Article 3(5)). For ANAC the facilitator is not the Third Sector entity and nobody is obliged to designate one.

Bad-faith reports

The reasons for the report are irrelevant (Article 16(2)); what matters is a reasonable ground to believe the facts are true (Article 16(1)). Protection lapses, with a disciplinary sanction, only if criminal liability for defamation or false accusation (calunnia), or civil liability for the same facts with wilful misconduct or gross negligence, is established, even at first instance (Article 16(3)). Mere suspicion is not enough: the specific case should be assessed with your own adviser.

Mobbing and demotion

Disputes of personal interest that relate exclusively to individual employment relationships are excluded (Article 1(2)(a)): mobbing does not become whistleblowing because it reaches the channel. But change of duties, demotion and ostracism are in the list in Article 17(4): if they result from a report, they are retaliation, and the link is established case by case. The boundary with complaints is in section 4.

10. Privacy, GDPR and DPIA in whistleblowing

In whistleblowing, privacy is part of the design of the channel. The controller is the organisation: it applies minimisation, authorised access, security, a privacy notice and limited retention, at most five years from the final outcome. Article 13(6) of Legislative Decree 24/2023 provides that the model for handling reports is defined on the basis of a data protection impact assessment (DPIA). The DPIA is the controller's responsibility, and the controller may draw on the supplier's documentation.

Sources as at 29 October 2026. It is not legal advice.

The data cycle

Table: EcosAgile working model, not a published standard.

Roles and legal basis

Controllers are the entities required to set up the channel (Article 13(4)). In Opinion No. 581 of 9 October 2025, issued on the draft ANAC Guidelines, the Garante recognises as the legal basis the legal obligation and tasks carried out in the public interest (Article 6(1)(c) and (e) GDPR); the processing may include special categories of data and data on criminal convictions and offences (Articles 9 and 10). The consent in Article 12(2) serves to reveal the identity to someone not authorised. The platform supplier is a processor (Article 28 GDPR), and an external channel manager may be one. Among entities of up to 249 workers that share the channel, joint controllership applies (Article 13(5); Article 26 GDPR); in groups, Article 28, with the parent company as processor (section 12).

Minimisation, access and metadata

Data that is manifestly not useful is not collected, or is deleted immediately (Article 13(2)). The identity is accessed only where strictly necessary, with the access logged; to third parties, outcomes and anonymised extracts are passed on. Email metadata is the reason why ANAC judges email and PEC in themselves not adequate, unless countermeasures are justified in a DPIA (section 6).

In EcosAgile: the privacy notice and the consent to processing appear in the first step of the form; the address of the notice is a mandatory field in the settings. The data is managed in Italy, the content is encrypted at database level, and attachments are automatically cleaned of properties and metadata without altering the document. The manual indicates deletion of the data five years after the communicated final outcome. The GDPR record of processing is kept in the Compliance module.

DPIA: when and how

ANAC recalls that Article 13(6) provides for a prior impact assessment, to be carried out when the channel is designed, before processing begins (Resolution 311/2023, consolidated version, p. 61 footnote 112); in the Explanatory Report it speaks of a "constraint". In its opinion on the draft, the Garante reports that it is for the obliged entities, as controllers, to carry it out, also drawing on the supplier's documentation. Scope and content should be agreed with the DPO; for below-threshold entities with a 231 Model the reading should be confirmed with your own adviser. Working contents:

• data flow, from receipt to deletion;
• categories of data, including special-category and judicial data;
• risks for the reporting person, the person reported and the persons mentioned;
• measures chosen, including for email;
• suppliers' roles and the DPO's comments.

List: EcosAgile working model.

In EcosAgile: the DPIA belongs to the controller organisation; the supplier can make supporting documentation available. The Whistleblowing Kit offers templates and checklists for the check, without replacing the controller's responsibilities.

Retention

Reports and documentation are retained for the time necessary and in any case no longer than five years from the communication of the final outcome; they are deleted at that point at the latest. Five years is a maximum and runs from the outcome, not from the report. On backups and copies neither the Decree nor the ANAC Guidelines say anything: the procedure must say when they disappear.

The person reported and the privacy notice

The privacy notices under Articles 13 and 14 GDPR go to reporting persons and persons involved (Article 13(4)). ANAC indicates a general notice published in advance and one to the person reported only if proceedings are started against them (Resolution 311, p. 61). The rights under Articles 15-22 can be delayed, restricted or excluded if actual and concrete prejudice to the confidentiality of the reporting person would result, with a reasoned communication (Article 13(3); Article 2-undecies of the Privacy Code). The coordination with the information obligations should be validated with the DPO or a lawyer.

11. Whistleblowing and the 231 Model

Since 15 July 2023 Article 6(2-bis) of Legislative Decree 231/2001 has provided that the organisation model must contain three elements: internal reporting channels, the prohibition of retaliation and the disciplinary system. ANAC recommends a single channel for the reports under Legislative Decree 24/2023 and for those relevant for 231 purposes, but does not require it. The model remains optional; whoever adopts it falls within Decree 24 even below 50 workers.

What needs updating in the model

These are the three aspects that ANAC asks to be brought into line: channel, prohibition of retaliation, disciplinary system. A model that has not been updated, in the Authority's view, has no exempting effect. Since 24 January 2026 there is one further update: Legislative Decree 211/2025 inserted in Legislative Decree 231/2001 Article 25-octies.2 on the restrictive measures of the European Union and also extended Article 1 of Decree 24 to those measures. Anyone who revises the map of offences also revises the scope of reports.

One channel or two

With a single channel, the Decree 24 reports and the 231 reports come in through the same entry point, without prejudice to the structured information flows to the OdV. It is a recommendation: the choice remains with the organisation, which writes it in the organisational act or in the model. A report that reaches the wrong recipient must in any case be passed to the competent party within 7 days (Article 4(6)). The single channel also receives reports that do not touch 231: if the OdV is not the channel manager, it does not have access to them.

Disciplinary system

Article 21(2) requires organisations with a 231 Model to provide for disciplinary sanctions against those found responsible for the wrongdoing in paragraph 1: retaliation, obstructing a report, breach of confidentiality, failure to verify and analyse. For confidentiality, Resolution 479/2025 specifies that they apply regardless of the average number of workers. The case of Article 16(3) remains: a reporting person whose liability is established, even at first instance, for defamation or false accusation (calunnia), or civil liability for wilful misconduct or gross negligence, with proportionality and gradation.

Channel manager and OdV

The OdV can be designated as channel manager if it has autonomy, training, knowledge of the organisation and rules on conflicts; it is not an obligation, and the sources do not exclude it. If it is not the channel manager, the coordination is regulated in the act or in the model.

Summary of positions as at 4 November 2026; the text of the sources prevails and the specific case should be assessed with your own adviser.

In small organisations the governing body, or in capital companies the board of statutory auditors, can perform the functions of the OdV (Article 6(4) and (4-bis)). Whether it can also be the channel manager should be confirmed with your own adviser: the Decree and the ANAC Guidelines do not address the case. The roles matrix is in the section on the channel manager.

The 231 scope below 50 workers

An organisation with a 231 Model and fewer than 50 workers handles internal reports only on 231 conduct and breaches of the model. If it has reached an average of 50 in the last year, the scope widens to breaches of EU law, external reports and public disclosure. Adopting the model therefore also decides the breadth of the channel. The thresholds are in the section on who must set up the channel.

Insight from the expert: in the 2026 EcosAgile webinar (in Italian) the chapter "Documentation, the 231 Model and abusive reports" (19:01); in the 2024 EcosAgile webinar (in Italian) the chapter "Reports of non-conformities and the single channel" (34:34). The chapters do not replace the rules or legal advice.

12. Corporate groups, multi-company set-ups and shared channels

A group has no right to a single channel: the size threshold is calculated for each individual company. Companies with an average of up to 249 workers can share the channel and its handling or entrust them to a third party; in a group with companies above 249, sharing is not permitted and entrusting to an external party remains, the parent company included. Each company that is required to do so keeps its own channel, its own channel manager and its own responsibility.

What Article 4(4) says, and why it is not enough

The Decree allows private-sector entities with an average of no more than 249 workers to share the channel and its handling. It does not speak of groups: ANAC dealt with them, applying the threshold to each company. The European Commission, in report COM(2024) 269 of 3 July 2024, observes that the Directive provides for resource sharing only for private-sector entities between 50 and 249 workers and that extending it to groups conflicts with the accessibility and proximity of channels.

The scenarios in brief

EcosAgile working summary of the ANAC indications (Guidelines No. 1/2025, Resolution 478, and Resolution 479): it is not a published standard, and the ANAC text prevails. The Guidelines are guidance acts of the Authority.

Article 28 in groups, Article 26 among entities that share

These are two different regimes and they are often confused. Among entities that share the channel, Article 13(5) requires an internal agreement on responsibilities and treats them as joint controllers. In groups ANAC applies Article 28 GDPR: the parent company that runs the channel for the companies is the processor, and Article 13(5) does not apply. The Garante, in Opinion No. 581 of 9 October 2025 issued on the drafts, had asked for the ambiguity on this point to be removed.

Channel managers, substitutes, penalties

Even with common services each organisation appoints its own channel manager. If several organisations use the same external channel manager, each accesses only its own reports, with technical and organisational measures. The substitute, for conflict of interest or prolonged absence, must be identified in advance in the organisational act. Entrusting handling to a third party does not discharge responsibility: the principal remains liable to a penalty if it chooses an unsuitable manager.

Cases the sources do not clarify

Example with fictitious data: a group of three companies with an average of 120, 90 and 310 workers. The third has its own channel and cannot share it. For the first two, the Guidelines distinguish groups where all companies are up to 249 from those above: the mixed case is not explicitly addressed.

The ANAC Guidelines do not address the case explicitly. A prudent reading, to be confirmed with your own adviser, is entrusting to a third party, which may be the parent company, with a contract and separate access. The situation of an Italian employee who reports to a foreign group channel that does not comply with Article 4 also remains open: what protections apply should be checked case by case.

In EcosAgile: the new report has a Company field, a drop-down list with only the companies enabled for the channel; the channel manager receives notifications of the reports within their remit, also by company or reason; contact persons and owners are provided for each company and reason, along with selective access by reason, company and visibility groups. Appointing channel managers and substitutes, choosing between sharing and entrusting to a third party, and the privacy roles remain the organisation's responsibility.

Insight from the expert: in the 2026 EcosAgile webinar (in Italian) the chapter "Company size and shared channels" (21:42) discusses how the annual average number of employees affects the shared channel, and the chapter "Oral reporting, meetings and groups" (40:04) touches on responsibilities and substitutes for each company. The text of the resolutions prevails.

13. Technical and security requirements for a whistleblowing platform

Legislative Decree 24/2023 does not list technical requirements: it asks for a channel that guarantees, including by encryption, the confidentiality of the reporting person, the person involved, the persons mentioned, the content and the documentation (Article 4(1)). ANAC considers IT platforms preferable, because they allow encryption at rest and a confidential dialogue through a code known only to the reporting person. From this follow requirements that can be verified: separate access, non-traceability, cleaning of attachments, a log of access to the identity, continuity of service.

The Decree requires a compliant internal channel, not a specific piece of software. The requirements below say what the supplier must be able to demonstrate; the rest (channel managers, organisational act, internal network) is the organisation's responsibility.

Channel security and authentication are not the same thing

A platform can have a second factor for channel managers and, at the same time, record the address and browser of whoever reports. The second matters more. In 2022 the Garante penalised a hospital trust and the supplier company, among other things, for browsing logs that made it possible to identify users (Newsletter No. 488 of 11 May 2022).

The same logic applies inside the organisation. If the channel is accessed from the corporate network, ANAC asks for the non-traceability of the reporting person to be guaranteed on the platform and also on firewalls and proxies (Guidelines No. 1/2025, Resolution 478, pp. 11-12). No supplier can do this in place of the organisation's IT. Working proposal: have IT demonstrate, before activation, that a test report sent from the internal network leaves no traces attributable to the person.

Attachments and metadata

An uploaded file carries properties and metadata with it. A well-built platform cleans them, without touching the content of the document. The limit should be explained to reporting persons: if a person's name is written in the text of the file, the cleaning of the metadata does not remove it.

Identity, register and technical logs

ANAC wants access to the reporting person's identity to take place only where strictly necessary, possibly through an identity custodian (an optional role), and the system to record the access and the reasons (pp. 22-25 of Guidelines 478). It also wants technical logs not to make the reporting person identifiable. The two requests can be reconciled by deciding what is recorded: actions on the case (who, what, when, why) yes, identifiers of the reporting person and of the network no. "Audit trail" is not a term used in the law.

The table is an EcosAgile working model, not a published standard. "Proposal" indicates a requirement that as at 29 October 2026 no rule or guideline sets in these terms.

In EcosAgile: the software is in the cloud, in the Compliance module. The data is managed in Italy, in a data centre classified Tier IV, with SSL/TLS protocols and encryption of the content of reports and attachments at database level (not end-to-end). Multi-factor authentication is available for channel managers; the manufacturer declares periodic penetration tests and ISO 9001 and ISO 27001 certifications. In anonymous mode the system is configured not to store identifying technical elements in application logs and notifications; attachments undergo automatic cleaning of properties and metadata, without altering the content. These are the manufacturer's declarations: the evidence is requested as from any supplier.

In EcosAgile: the audio attachment is optional, provided only for non-anonymous reports and with voice distortion. It is not a compliant oral channel: written, oral and direct meeting are designed as in the section on the internal channel.

14. How to integrate whistleblowing into the compliance system

Whistleblowing is integrated into the compliance system by linking it to the safeguards with which it shares data, roles and evidence: privacy, the 231 Model and code of ethics, complaints and non-conformities, relations with suppliers and procurement, and any anti-corruption standards. Reports remain confidential: the channel manager does not pass them on to other functions, to which it transmits only outcomes and anonymised extracts. What is integrated, therefore, is processes and evidence, not content.

The map of safeguards

EcosAgile working map: not a published standard. Legislative sources as at 29 October 2026. For public bodies the management of the channel is for the RPCT and whistleblowing is among the corruption prevention measures.

Privacy and documentation

The channel is a processing of personal data and must be kept aligned with the organisation's privacy documentation: privacy notices, appointment of the supplier as processor, DPIA, record of processing. For complaints and personal data breaches the organisation may keep its own registers: the channel does not replace them, and the link with a report is decided in the procedure. The deadlines and obligations for notifying a breach to the Garante follow the GDPR and should be checked against the text.

In EcosAgile: the Compliance module, which also hosts the whistleblowing channel, includes the GDPR record of processing, with forms for controller and for processor and export, and the GDPR documents.

In EcosAgile: the complaints register collects date, nature, function concerned, corrective actions, owner and expected resolution, with statuses Issued, In progress and Completed. The register of personal data breaches (Data Breach) keeps dates, categories of data and measures adopted and records the notification to the Garante, without sending it. The link between a report and these registers is defined in the organisation's procedure.

Suppliers, procurement and anti-corruption

Anyone who qualifies suppliers should know that their workers and contractors can report and are protected, and that the early termination of a supply contract can constitute retaliation. The organisation model or the act should also be made known to suppliers, consultants and partners, with a dedicated section of the website. Wrongdoing in the field of public procurement falls within the scope of reportable breaches. On tender clauses, the Decree and the ANAC Guidelines do not indicate specific provisions of Legislative Decree 36/2023.

Evidence to keep

The Garante had included in its January-July 2026 inspection plan the continuation of checks on whistleblowing applications. As a working proposal, it is worth having a file containing the organisational act, the communication to the trade unions, appointments, training, the DPIA, contracts, channel tests and indicators. Health and safety at work is a topic covered in the guide Health and safety at work and occupational medicine and is outside this page. For related topics: the guide on pay transparency and the one on digitalising HR processes.

Insight from the expert: in the 2026 EcosAgile webinar (in Italian) the chapter "What to check in the company" (43:11) lists appointments, substitutes, training, the DPIA and the organisational act; in the 2024 EcosAgile webinar (in Italian) the chapter "GDPR: record of processing and data breach" (03:50, with the data breach from minute 05:30) shows the registers.

15. KPIs, reporting, training and continuous improvement

The KPIs of a reporting channel are there for the governing body to know whether the channel works, not to follow individual cases. They measure acknowledgement and feedback times, the age of cases, scope, outcomes, training and technical tests, with aggregated reports that do not expose personal data. Zero reports do not prove that all is well: the set includes indicators that make sense even without cases.

As at 29 October 2026 no official source sets a list of KPIs for internal channels. ANAC asks the governing body for general monitoring of how the procedure works, without supervisory powers over handling, and does not indicate indicators. The ten in the table are a working model. Only the limits come from the law: 7 days for the acknowledgement, 3 months for the feedback, 5 years of retention at most. Calendar days are counted: the Decree says "days" and "months" without more, and the prudent choice should be written in the procedure.

Ten indicators with formulas

Formulas, owners, frequencies and thresholds are an EcosAgile working model, not a published standard. The only exceptions are the legal limits cited in the text.

On the 3-month deadline (not peremptory, with the outcome to be communicated in any case) see the section on handling a report.

Aggregating without exposing personal data

Neither ANAC nor the Garante sets a minimum aggregation threshold. The rules below are a working proposal, to be written in the procedure.

• KPIs are calculated from dates, statuses, categories and outcomes, never from the text of reports.
• Every cell below 5 cases is shown as "< 5".
• With fewer than 10 reports in the period, the report shows only the process KPIs and the total.
• No cross-breakdown by site, department or role if the group has fewer than 5 people; no free-text fields.
• An aggregate with small numbers can still lead back to individuals: it remains under access control.

Example with fictitious data: in a six-month period an organisation receives 6 reports and 5 have the acknowledgement within 7 days. K2 is 5/6, about 83%. The board of directors is given this value and the total, not the breakdown by scope, which with 6 cases would make the cases recognisable. For the case that missed the deadline, the cause is analysed.

Training of the channel manager and staff

Article 4(2) requires specifically trained staff. ANAC asks for specific, periodic training for channel managers (the Decree, privacy, procedures, conflicts of interest, conduct) and, for all staff, training on who the whistleblower is, what and how to report, and what protections exist. It does not fix a frequency; in the context of the 231 Model, attendance at courses is mandatory. Documentable means programme, date, attendees and certificate.

The practical reason is seen in ANAC's numbers: in 2025, of 1,931 files on whistleblowing on the external channel, 460 were closed or are to be closed as inadmissible, and the Authority reads this as a need for training (2026 Annual Report, presented on 21 April 2026). The figure does not measure internal channels.

Periodic audit and continuous improvement

Once a year, as a working proposal, the procedure and organisational act, appointments and substitutes, DPIA and privacy notices, channels and website, training and coordination with the 231 Model are reviewed. The K9 tests use fictitious reports, marked and deleted after the test, so as not to mix with the statistics. The outcome of each audit goes into a compliance file to be shown to whoever asks for it.

In EcosAgile: the Analysis page has three indicators (total events, events of the last month, open events), charts by month and by priority, and filters by period, priority, status and reason, without confidential content. It does not include timing KPIs: K1-K4 are calculated by the organisation. The owner of the reason receives reminders at 5, 25 and 30 days, which contain no information about the report.

In EcosAgile: the Whistleblowing Kit collects templates and checklists for documentary, organisational, privacy and application checks; it does not replace the responsibilities of the channel owner.

16. How to choose whistleblowing software

Whistleblowing software is chosen after deciding who handles the reports, with what powers and in what timescales, and is assessed on what the supplier can demonstrate, not on what it declares. The Decree does not require buying a platform: it requires a compliant internal channel, and ANAC considers IT platforms preferable. The grid in this section collects twenty supplier-independent criteria, each with the evidence to request.

Procedure first, then the tool

A platform collects and safeguards reports; it does not appoint the channel manager, write the organisational act or carry out the DPIA (see governance and channel manager and privacy and DPIA). Those who do not adopt a platform have the alternative indicated by ANAC, confidential registration in a double envelope; for email and PEC, what is said in the section on the internal channel applies.

How to use the grid

Not all criteria weigh the same. Working position: criteria 1, 2, 3 and 6 are knock-out criteria, because no price compensates for a channel that can expose the identity of the reporting person. The others are weighted on the structure of the organisation: several companies or a group (8 and 20), oral reports (4), channel manager with substitute (7 and 9), reports for the governing body (19). The evidence in the last column is requested in a trial environment, not on slides.

The grid is an EcosAgile working model, not a published standard; the references to ANAC are to Guidelines No. 1/2025 (Resolution 478 of 26 November 2025), text as at 29 October 2026. Where the "Basis" says "proposal", the criterion is not set in these terms by a rule or guideline.

Questions to ask the supplier

• Who among your staff can read content and identities, and how are they authorised and monitored?
• Can you decrypt the data? How are the keys managed?
• What remains in the application, web server, WAF and CDN logs about the reporting person?
• Where are the data centres, which sub-processors are involved, from which countries is support provided?
• When was the latest penetration test carried out, by whom, and what can you show?
• What happens to the data, backups included, at the end of the contract and when the retention period expires?
• What documents do you give us for the DPIA and for the record of processing?
• What is the overall cost: activation, subscription, support, additional modules, exit?

The test before signing

Working proposal: ask for a trial environment and, with the DPO and IT present, run a complete path with fictitious data: a report from an external network and from the internal network, an anonymous one with subsequent dialogue, a reasoned request for the identity, reassignment to the substitute, an aggregated report, data export. The minutes of the test go into the compliance file and can be the first test recorded in K9 (section 15).

In EcosAgile: the software is in the cloud, in the Compliance module, with an entry point without credentials for non-employees and one for employees. The reporting person receives a KeyCode to follow the status and communicate confidentially; in anonymous mode the system is configured not to store identifying technical elements in application logs and notifications. Access is differentiated by reason, company and visibility groups, with multi-factor authentication available for channel managers. The DPIA remains the responsibility of the controller organisation; the supplier can provide supporting documentation. To see the product put to the test of the grid: whistleblowing.ecosagile.com.

17. Frequently asked questions