When implementing these obligations, many companies rely on “tried and true” methods and believe that the protection of whistleblowers and the fulfillment of the corresponding processes can be guaranteed by e-mail, mailboxes and open-door reporting options. This misconception is put to rest by Section 9 of the Whistleblower Protection Act in Austria.
In this provision, companies are required to document all reports and at the same time meet the required deadlines. In Section 9 (6), the law expressly provides that “internal and external bodies shall store the records pursuant to subsections (1) to (5) in a confidential and secure system and shall log and restrict access to this system in such a way that the data stored therein is only accessible to those employees who need access to the data in order to process the whistleblowing.”
The legally correct implementation of the legal obligations thus appears to be fulfilled exclusively by a digital whistleblowing system.