Whistleblowing: keeping the reporter's identity confidential when you share case files

Most organisations put real effort into the reporting channel itself: a hotline, an encrypted web form, an option to report anonymously. Far fewer think about what happens once the report becomes a case file. The file gets downloaded, forwarded to HR, attached to a board paper, shared with external counsel or sent to a regulator. Every copy can carry names, email signatures, document metadata and small details that point straight back to the person who spoke up. This article looks at what the law expects in the UK and the EU, and at a practical way to prepare investigation documents so that each recipient sees only what they need.

The UK position: strong protection, no statutory confidentiality duty

In Great Britain, whistleblowers are protected by the Public Interest Disclosure Act 1998 (PIDA), which inserted Part IVA into the Employment Rights Act 1996. A worker who makes a qualifying ‘protected disclosure’ is protected against dismissal and detriment. The UK is not bound by the EU Whistleblowing Directive, and PIDA does not impose a general statutory duty on employers to keep the whistleblower's identity confidential.

That does not mean confidentiality is optional in practice. The government's whistleblowing guidance for employers describes it as best practice to keep disclosures confidential, to handle them anonymously if the worker asks, and to share information only with those who need to know. A leak of the reporter's identity is also the most direct route to the detriment PIDA prohibits. On top of that, the case file is personal data under the UK GDPR and the Data Protection Act 2018, so the principles of data minimisation, security and storage limitation apply to every copy you make.

There is a further trap: the subject access request. The person under investigation can ask for their personal data, and the file is full of it. The ICO's guidance on information about other people in a SAR explains that third-party information can be withheld or redacted unless the third party consents or it is reasonable to disclose without consent. In a whistleblowing case, the reporter is precisely that third party, so the response needs careful, irreversible redaction.

If you operate in the EU: Article 16 of Directive 2019/1937

Groups with EU subsidiaries must also meet the national laws transposing Directive (EU) 2019/1937. Its Article 16 requires that the reporter's identity is not disclosed, without their explicit consent, to anyone beyond the staff authorised to receive or follow up reports, and that the same protection covers any other information from which the identity may be directly or indirectly deduced. Article 17 says data that is manifestly irrelevant to a report must not be collected, or must be deleted without undue delay; Article 18 requires records of every report, kept only as long as necessary and proportionate. Several member states add fixed retention periods, such as three years after closure in Germany or five years in Italy and Portugal.

How identity leaks out of a case file

A typical file mixes the intake form, emails with the reporter, screenshots, spreadsheets (timesheets, expenses, access logs), interview notes and sometimes scanned pages with handwriting. The usual leaks are:

• Direct identifiers: name, staff number, work email, phone extension, signature on interview notes.
• Email headers and signatures: a forwarded .msg or .eml file keeps sender, recipients, job title and department.
• Metadata: the ‘Author’ field of a Word file or PDF, tracked changes and hidden comments. See hidden metadata in Word and PDF files.
• Indirect identifiers: ‘the only night-shift supervisor at the Leeds depot’, a sick-leave date, a specific project, or a sentence only someone present at a meeting could have written.
• Screenshots: logged-in usernames, profile pictures, device names in the taskbar.
• Fake redaction: black boxes drawn on top of a PDF, leaving the text underneath selectable and searchable.

One case, several versions

The most reliable approach is to prepare a different version of the file for each audience and log who received which version. An illustrative (fictitious) example for a bullying complaint:

Pseudonymisation is particularly useful during the investigation: replacing each person with a consistent label keeps the narrative readable and lets the investigator compare statements without exposing anyone. Remember that pseudonymised data is still personal data; the distinction is explained in anonymisation vs pseudonymisation.

A working method for preparing the file

Two points are often missed. First, the narrative: ‘as I told my manager at Tuesday's stand-up’ identifies someone more surely than a name, so some passages need to be generalised, not just blacked out. Second, unrelated third parties (family members, customers, colleagues mentioned in passing) should be removed altogether. And when a case is closed, anonymising the file rather than keeping it whole lets you retain the useful learning while respecting storage limitation; just make sure combinations of date, site and role do not allow re-identification.

Where Anonimatum fits

Anonimatum lets you produce these versions without manual black boxes. Its pseudonymisation replaces each person with the same alias throughout a document and stores the mapping encrypted, so only whoever holds it can reverse the process. Its own AI detects names, organisations, dates, addresses and amounts, and patterns catch emails, phone numbers or bank details; a person reviews the preview before anything is applied and can draw manual zones over signatures or stamps. It handles PDF (including scanned), Word, Excel, images and emails with attachments, removes metadata and keeps the original format. Processing runs on servers in the European Union without sending text to external language-model APIs; the details are on our security page. You can compare the plans and get started online.