GDPR Data processing modelCollection of reports of bribery or corruption

Function: Legal and complianceOrganisation: Private

The purpose of this processing is to collect reports from employees of the organisation about conduct or situations that are contrary to the organisation's code of conduct and likely to constitute bribery or corruption.

Purposes (1)

A purpose is the objective pursued by the setting up of your file. It indicates what the processing of personal data will be used for, its purpose. This purpose must be clear and understandable

Collection of reports from employees of the organization concerned

Enable the collection of reports from employees of the organisation about conduct or situations contrary to the organisation's code of conduct and likely to constitute bribery or corruption

Legitimate interest

UK GDPR Art. 6(1)(f): there is no general legal duty in the UK to set up an internal reporting channel; it supports the 'adequate procedures' defence to the offence of failure to prevent bribery (Bribery Act 2010, s.7) and the protection of whistleblowers making qualifying disclosures (Employment Rights Act 1996, Part IVA, s.43B). Firms within the scope of FCA SYSC 18 must have internal whistleblowing arrangements and may rely on Art. 6(1)(c). Criminal offence data: DPA 2018 Schedule 1, Part 2, para 10 (preventing or detecting unlawful acts).

Data categories (4)

Personal data is any information relating to an identified or identifiable natural person. A natural person can be identified either directly (eg surname and first name) or indirectly (eg phone number, social security number, email or postal address, but also voice or image)

Persons involved in the collection or processing of the alert

Data details

Functions and coordinatesrequired

Identityrequired

Data conservation rules

Active base:

Under UK GDPR Art. 5(1)(e), personal data must be kept in identifiable form only for as long as necessary for the purposes of the reporting channel. Data relating to a report that the controller considers outside the scope of the channel is deleted or anonymised without delay. Anonymisation should follow the Information Commission (ICO) guidance on anonymisation and pseudonymisation. Where no action is taken on a report within scope, the data is deleted or anonymised promptly after the verification is closed; no UK statute sets this period, so the controller should set and document a short period (for example two months). Where disciplinary or legal proceedings are brought against the person concerned or the author of a malicious report, the data may be kept until the end of the proceedings and of the time limit for appeal.

UK GDPR, Art. 5(1)(e); Information Commission (ICO) guidance on anonymisation and pseudonymisation

Destruction

Alert data

Data details

Alert follow-uprequiredsensitive data

Reports of verification operationsrequiredsensitive data

Information gathered during the verification of the reported factsrequiredsensitive data

Reported incidentsrequiredsensitive data

Data conservation rules

Active base:

UK GDPR, Art. 5(1)(e); Information Commission (ICO) guidance on anonymisation and pseudonymisation

Destruction

People subject to alert

Data details

Functions and coordinatesrequired

Identityrequired

Data conservation rules

Active base:

UK GDPR, Art. 5(1)(e); Information Commission (ICO) guidance on anonymisation and pseudonymisation

Destruction

Alert sender

Data details

Functions and coordinatesrequired

Identityrequired

Data conservation rules

Active base:

UK GDPR, Art. 5(1)(e); Information Commission (ICO) guidance on anonymisation and pseudonymisation

Destruction

Data subject (2)

A data subject is any person whose data is collected, retained or processed by the data processing. e.g. In a recruitement process, any candidate for a position proposed in recruitement management process

Employees
other

Created at:07/08/2023

Updated on:10/05/2026

Nb using:0