Spreadsheet, tool or consultant: how to run your whistleblowing register

For a few reports a year handled in house, a careful spreadsheet or an offline tool is enough. With many sites, a need for anonymous two-way contact, or serious cases, a hosted service or adviser is the better choice.

Whatever you choose, the job is the same: receive reports confidentially, acknowledge within seven days, follow up through an impartial handler, give feedback within three months of the acknowledgement [1], and keep records of every report for no longer than necessary [2]. The three options below differ in who does the work, where the data lives and what it costs. Prices for services vary widely, so this page compares them in kind rather than quoting figures.

The three options at a glance

	Spreadsheet	Offline tool (this one)	Consultant, law firm or hosted hotline
Cost	Free if you already have the software	$99 one-time	Usually a setup fee and a recurring fee or hourly rates
Setup time	Hours to build and test formulas	Minutes; open the file	Days to weeks, including contracts
Deadline tracking	Only if you build it and keep it correct	Built in, with overdue warnings	Usually built in
Letters	Write your own	Acknowledgement and feedback drafts	Often provided
Where data lives	Wherever the file is saved, often a shared drive or cloud	On your own computer, no upload	On the provider's servers
Anonymous two-way contact	No	No; you supply the contact route	Often yes, through a reporting portal
Investigation help	No	No	Yes, if you buy it
Main risk	Broken formulas, copies spreading	Single device; you handle backups	Cost; data held by a third party

Spreadsheet

A spreadsheet is a reasonable start if you expect very few reports and have someone who is careful with files. Use the register template as the column list.

The weak points are practical. Date formulas for "plus three months" behave differently at month ends. Spreadsheets get copied, emailed and synced, which works against keeping the reporter's identity within authorised staff [3]. Version history in cloud storage can keep deleted details around, which makes "no longer than necessary" harder to control [2].

Right choice when: you expect one or two reports a year, the handler is comfortable with spreadsheets, and the file sits somewhere only they can open.

Offline tool

The Whistleblower Case Register is a single HTML file that runs in your browser without a server, account or upload. It calculates both deadlines, counts feedback from the real acknowledgement date, flags overdue cases, drafts the two letters and exports the register as HTML or JSON.

It does not receive reports for you. You still need a mailbox, phone line or meeting route, and you still do the follow-up. Because the data stays on one device, backups and device security are your job. It is not a substitute for advice on a difficult case.

Right choice when: you run the channel in house, want deadline control without monthly fees, and prefer that reports do not sit on someone else's server.

Consultant, law firm or hosted hotline

A hosted platform gives reporters a web portal, often with anonymous two-way messaging and multiple languages. The Directive allows a third party to operate the channel, and the Article 9 safeguards then apply to that party too [4]. A law firm or investigator brings judgement that no register can.

The trade-offs are cost, a contract to manage, and the fact that very sensitive files sit with an outside provider, so check where and how they store data. Outsourcing receipt also does not remove your own duties to follow up and give feedback [4].

Right choice when: you have many sites, countries or languages; you need anonymous two-way contact without building it; reports could involve senior management, so an internal handler would not be impartial; or you face a serious case that needs legal or forensic work. In those situations, a hosted service or adviser is the better choice, and a register tool is at most a supplement.

Combining options

These are not exclusive. A common pattern for a company of 50 to 249 workers is an in-house channel with a register for routine cases, and a law firm on call for the rare case that needs it. Companies in that size range may also share resources for receiving and investigating reports, while each keeps its own duties for confidentiality and feedback [4].

Questions to decide

How many reports do you realistically expect per year?
Is there an impartial person in house who can handle them [1]?
Do you need anonymous two-way contact, and can you offer it yourself?
Where may this data be stored, according to your own data protection policy?
What budget is there, one-time and yearly?

For the basics, read the guide for companies with 50 or more employees and the deadline guide.

Related guides

Sources

This guide explains the rules in plain language. It is not legal advice. Check your own country's law and, when in doubt, ask a qualified adviser.