The recent intervention of the Italian Data Protection Authority (Garante per la protezione dei dati personali) represents a significant step in the implementation of national whistleblowing regulations, an area that in recent years has gained increasing relevance for the proper functioning of both public and private organizations.

With Decision No. 581 of 9 October 2025, the Authority issued a formal opinion on the new ANAC Guidelines concerning internal and external reporting channels, adopted pursuant to Legislative Decree No. 24 of 10 March 2023, which transposes Directive (EU) 2019/1937 and aims to ensure effective protection for individuals who report breaches discovered within their work environment.

The regulation applies to a wide range of unlawful conduct, with particular emphasis on violations relating to personal data protection and the security of networks and information systems areas in which compliance with legal obligations is essential to preserving user trust and ensuring high security standards.

The handling of reports inevitably involves the processing of personal data, including special categories of data and data relating to criminal convictions and offences, concerning both whistleblowers and individuals involved in the reported facts.

On this point, the Authority considered such processing to be lawful insofar as it is necessary to comply with legal obligations and to carry out tasks in the public interest, in accordance with Articles 6(1)(c) and (e) and 9(2)(b) and (g) of the GDPR.

The opinion also highlights the need to adopt appropriate technical and organizational measures to ensure the confidentiality of the whistleblower, the security of the reporting channels used, and the protection of the information processed, as well as to provide clear and comprehensive information on the processing of personal data within the reporting procedure.

The guidance provided by the Authority contributes to establishing a more solid and coherent framework, strengthening the safeguards provided under the legal system and promoting responsible and transparent management of internal information flows within organizations.

This underscores, in particular, the importance of an integrated approach to whistleblowing, understood not only as a tool for uncovering wrongdoing but also as a fundamental component of prevention and the promotion of legality.

The Law Firm remains available for any further clarification.