Whistleblowing register template: what to log for each report

Log each report with a neutral case number, the dates received, acknowledged and answered, the channel, the handler and a review date. Keep anything that could identify the reporter in a separate, restricted file.

The Whistleblower Directive does not hand you a form. It does say three things that shape the register you need. Every legal entity that runs an internal channel must keep records of every report it receives [3]. Those records fall under the duty of confidentiality, so the reporter's identity must not reach anyone beyond the authorised staff who receive or follow up on reports, unless the reporter explicitly agrees [2]. And reports may be stored no longer than is necessary and proportionate to meet the Directive or other Union or national law [3].

The procedure in Article 9 adds the dates you have to track: an acknowledgement of receipt within seven days, and feedback within a reasonable period of no more than three months from that acknowledgement [1]. A good register makes those dates impossible to miss.

What a whistleblowing case log should contain

Think of the register as two layers. The first layer is the case list: one row per report, with dates and status, and nothing that points to the reporter. The second layer is the case file: the summary, the follow-up actions and the letters you sent. Keeping the layers apart helps you share a status overview with management without sharing anything that could identify someone.

Fields for the case list

Case number. A neutral reference such as WB-2026-004. Never use names or departments in the number.
Date received. The day the report arrived. Both deadlines depend on it.
Channel. Written form, letter, phone line, voice message or meeting. Article 9 lets you accept reports in writing, orally, or both, and oral reports can come by phone, voice message or, on request, a physical meeting [1].
Topic category. A broad label, for example "procurement" or "data protection".
Handler. The impartial person or department designated to follow up [1].
Acknowledgement due and sent. Due date is received date plus seven days [1]; record the actual send date as well.
Feedback due and sent. At most three months after the acknowledgement [1].
Status. Open, under assessment, investigating, closed.
Delete or review date. When you will check whether you still need the file [3].

Fields for the case file

Short factual summary of what was reported, in neutral wording.
Whether the reporter is anonymous, and how you can reach them (for example a reply box or a case code).
Follow-up actions with dates: who was asked what, which documents were checked.
Copies of the acknowledgement and feedback letters.
Outcome and the reason for closing.

Copyable template

Paste this into a document or a protected spreadsheet. One block per case.

CASE NUMBER:        WB-____-___
Date received:      __/__/____
Channel:            written / phone / voice message / meeting
Topic category:     ______________________
Handler:            ______________________
Reporter:           named (identity stored separately) / anonymous
Contact route:      ______________________

Acknowledgement due:  received + 7 days = __/__/____
Acknowledgement sent: __/__/____
Feedback due:         acknowledgement + 3 months = __/__/____
Feedback sent:        __/__/____

Summary (facts only):
______________________________________________

Follow-up log:
  __/__/____  action: __________________  by: ______
  __/__/____  action: __________________  by: ______

Outcome:            ______________________
Closed on:          __/__/____
Review / delete on: __/__/____
Access limited to:  ______________________

Worked example

A warehouse employee reports through the web form on Monday 2 November 2026 that safety inspections were signed off without being carried out. Here is how the entry fills in.

Field	Entry
Case number	WB-2026-004
Date received	2 Nov 2026
Channel	Written (web form)
Topic	Health and safety
Handler	Compliance officer
Acknowledgement due	9 Nov 2026
Acknowledgement sent	4 Nov 2026
Feedback due	4 Feb 2027
Status	Investigating

Notice that the feedback date counts from 4 November, the day the acknowledgement actually went out, not from the latest allowed date. Sending the acknowledgement early moves the feedback deadline earlier too. The deadline guide covers this in more detail.

The employee's name does not appear in the case list. It sits in the case file, which only the compliance officer can open.

Five mistakes that make a register a risk

Storing it where everyone can open it. A shared drive folder that HR, IT and managers can browse does not fit a duty to keep the identity within authorised staff [2].
Names in file names. "Report about J. Smith.docx" shows up in search results and backups.
Only one date. Logging the received date without the actual acknowledgement date makes the feedback deadline guesswork.
No review date. Without one, files stay forever, which conflicts with storing them no longer than necessary [3].
Free-text status. "Looking into it" cannot be filtered. Use a short fixed list.

Where to keep the register

Pick a place where you can control who opens it and where a copy will not quietly spread. A spreadsheet in a restricted folder can work for a handful of cases a year. As volume grows, formulas break and access drifts. You may also hand the channel to an outside provider; the Article 9 safeguards then apply to that provider as well [4]. The comparison page sets out when a spreadsheet, an offline tool or a hosted service fits best. If you are still setting up the channel itself, start with the guide for companies with 50 or more employees.

Related guides

Sources

This guide explains the rules in plain language. It is not legal advice. Check your own country's law and, when in doubt, ask a qualified adviser.