The GDPR (General Data Protection Regulation) and the Whistleblowing Directive are two separate regulations that both address data protection in the EU, but they have different focuses and objectives. The GDPR is a comprehensive data protection regulation that became effective in May 2018. It establishes rules for the processing of personal data by organizations operating within the EU, as well as by organizations outside the EU that offer goods or services to EU citizens or monitor their behavior. The GDPR sets out requirements for data controllers and processors, including the collection, storage, and processing of personal data, and provides individuals with certain rights, such as the right to access and control their personal data. The Whistleblowing Directive, which was adopted in December 2019 and became effective in December 2021, is a directive that establishes rules for the protection of whistleblowers across the EU. It requires Member States to establish comprehensive and effective whistleblower protection mechanisms in both the public and private sectors, including in the financial sector. The Directive sets out requirements for internal reporting channels, external reporting options, protection against retaliation, and confidentiality, among others. Whistleblowers may disclose personal data when reporting misconduct or wrongdoing, and organizations that receive reports under the EU Whistleblowing Directive must ensure that they comply with the GDPR's requirements when handling and processing personal data.