Is an email inbox a compliant whistleblowing channel?

The short answer: an email address can be a compliant whistleblowing channel, but most inboxes aren't. Neither the EU Whistleblowing Directive nor national laws such as Germany's HinSchG, France's Sapin II framework or Ireland's Protected Disclosures Act ban email. What they require is a channel built so that only the people handling reports can reach them, with deadlines met and records kept. A dedicated address with a short, controlled list of people who can open it can meet that. A shared ethics@ mailbox that IT can open, that gets archived, and that forwards to whoever set it up usually can't. In Italy, the regulator treats ordinary email as inadequate unless you add safeguards you can justify, and in Spain the requirement to accept anonymous reports is hard to meet by email.

If you already use an email address, this article will help you find out where yours stands. It covers what the law asks for, how that differs by country, a check you can run on your own inbox with a fix for each gap, the gaps no setting can close, and what switching to a dedicated channel changes.

What the law asks of a channel

The Directive (Directive (EU) 2019/1937) doesn't prescribe a technology. It describes outcomes. For an internal channel, the ones that matter for email are:

• Secure by design (Art. 9(1)(a)). The channel must be "designed, established and operated in a secure manner" that protects the reporter's identity and anyone named in the report, and "prevents access thereto by non-authorised staff members". That's a test of the system, not of the people using it.
• Identity kept to the people handling it (Art. 16). The reporter's identity can't be passed on beyond the staff authorised to receive or follow up on reports, without their explicit consent.
• Deadlines (Art. 9(1)(b) and (f)). Acknowledge within 7 days, give feedback within 3 months. See the 7-day/3-month clock, explained.
• A named, impartial handler (Art. 9(1)(c)). Someone specific is responsible for following up.
• Records (Art. 18). Every report received is recorded, in line with the same confidentiality rules, and kept no longer than necessary.
• Written, oral, or both (Art. 9(2)). The Directive lets a channel accept reports "in writing or orally, or both". Some national laws go further and require both, so a written-only inbox may not be enough on its own.
• Anonymity is a national choice (Art. 6(2)). The Directive leaves it to each member state to decide whether companies must accept anonymous reports.

Nothing in that list rules out email. All of it has to be true of the inbox, its backups and everyone who can reach it.

Country by country

The country guides go into each law in more depth: Germany, France, Spain, Italy, the Netherlands, Poland and Ireland.

When an email address is a reasonable choice

• Your organisation isn't required to have a channel. Below 50 workers in most EU countries, or in the UK, a well-run email address is better than nothing.
• Identified reports in a country that doesn't require anonymity, with the controls below actually in place. Germany, Ireland and Poland all allow this.
• As a fallback alongside a proper channel. Some reporters will email whatever address they can find. Your policy should say what happens to those emails (see "Switching from an inbox" below).

Email also has one real advantage over a web form: it's two-way. You can acknowledge a report, ask follow-up questions and give feedback, as long as the reporter is willing to be reached at that address.

Check your own inbox

Ten checks, in the order a report travels. Each one says how to check and how to fix it with the tools you already have. Most need your email administrator for half an hour. If you can't answer one, treat it as a "no".

1. The address is used for nothing else.

   Check: does the mailbox hold anything other than reports, such as HR queries, supplier mail or newsletters?

   Fix: create a new address only for reports. Don't reuse hr@ or an existing shared mailbox, whose access history you can't vouch for.

2. Only the named handlers can open it, each with their own login.

   Check: list everyone with full access, delegate access or "send as" rights on the mailbox. In Microsoft 365 that's the mailbox's delegation settings in the Exchange admin centre. In Google Workspace, check mail delegation for the account. Ask whether anyone shares a password.

   Fix: remove everyone who isn't a named handler, and give each handler their own access instead of a shared password.

3. No copies leave the mailbox.

   Check: look for forwarding on the mailbox, inbox rules set up by its users, and organisation-wide mail flow or routing rules that copy messages elsewhere (Exchange transport rules, Gmail routing and compliance rules). Check journaling too, which sends a copy of every message to an archive.

   Fix: turn off forwarding and inbox rules, and exclude the address from any journaling or copy-to rule.

4. You know who else can reach it, and have limited it as far as you can.

   Check: anyone who can reset the mailbox's password can read it. So can anyone who can run an eDiscovery or Google Vault search, or restore a backup. Write down who holds those roles.

   Fix: keep those roles to as few people as possible, turn on alerts for password resets and eDiscovery searches on this mailbox, and record the remaining access in your data protection impact assessment. You can narrow this list, but not remove it. That's the main reason Italy's regulator treats ordinary email as inadequate on its own.

5. Acknowledgements come from the channel, within 7 days.

   Check: who replies, from which address, and how quickly? A reply from a handler's own account puts their name, and the report thread, into a second mailbox.

   Fix: reply only from the dedicated address. An automatic reply that confirms receipt and says when to expect feedback covers the 7-day deadline, as long as it says nothing about the content.

6. Deadlines are tracked somewhere other than the inbox.

   Check: for the last report, can you say when it was acknowledged and when feedback is due?

   Fix: keep a register, a spreadsheet with access limited the same way, with a received date, an acknowledgement date and a feedback-due date three months later for each report. Name the person who reviews it weekly.

7. Every report is recorded and has a deletion date.

   Check: could you show a regulator a list of every report received this year and what happened to each? When a report's retention period ends, would it also go from archives, backups and retention holds?

   Fix: add an outcome and a deletion date to the register. Check that no retention policy preserves this mailbox's deleted items for years, and delete on schedule. See choosing a retention policy.

8. Reporters know the risks of writing from a work account.

   Check: does your policy say that an email sent from a work account leaves a copy in their sent items, on servers the company administers?

   Fix: say so, and tell reporters they can write from a personal address instead. If you must accept anonymous reports, as in Spain, explain how to do it, and accept that this puts the work on the reporter. See anonymous vs identified reporting.

9. There's an oral route where your country requires one.

   Check: can someone report without writing anything down, and ask for a meeting?

   Fix: publish a phone number or voicemail alongside the address, and say in your policy how to ask for a meeting. The Netherlands requires an oral route by law, and Italy's regulator expects one. See voice reports and anonymisation.

10. Reports about the handlers go somewhere else, and access survives staff changes.

    Check: if a report concerns someone with access to the mailbox, where does it go? When a handler leaves, who removes their access and checks nothing is left forwarding?

    Fix: name an alternative contact in your policy, such as a director or an external adviser, with their own route. Add the mailbox to your leaver checklist, and re-run checks 2 to 4 every quarter.

What no setting can fix

Some gaps come from how email works, not from how yours is set up:

• Someone can always get in. However tightly you limit it, an administrator can reset the password or search the mailbox. The channel is limited to authorised staff by policy, not by design.
• Anonymity costs the reporter effort. The only way to report anonymously is to set up a separate account first, and the message still carries headers and metadata.
• The reporter's own copy. A report sent from a work account leaves a trail on your servers that you can't remove without going into their mailbox.
• The record lives outside the channel. The register, the deadlines and the audit trail are a separate spreadsheet that has to be kept in step by hand. If a regulator or a court asks what happened and when, "here are the emails, and here's our spreadsheet" is a weaker answer than a timestamped log of every action. See audit logging: keeping a defensible record.

What it takes to keep running an inbox

If every check above passes, you have a channel that can comply. Keeping it that way is ongoing work:

• an access review every quarter, and after every leaver or IT change
• a register updated by hand for every report, and reviewed weekly against the deadlines
• a separate phone line or voicemail, with its own access limits, where an oral route is required
• deletion on schedule, in the mailbox, the register, archives and backups
• an impact assessment that explains the access you couldn't remove

None of it is difficult, but all of it depends on someone remembering to do it.

Why companies switch to Provoxis

Provoxis is built for this job, so most of the checks above are already done before your first report arrives:

There's no quarterly access review across mail systems, no spreadsheet to keep in step, and nothing to rebuild when a handler leaves. Setup is self-serve with a guided checklist, pricing is a fixed monthly fee (see pricing), and there's a 30-day free trial.

Switching from an inbox

1. Publish the new channel everywhere the email address appeared: your website, policy, staff handbook and supplier documents.
2. Keep the old address for a while, with an automatic reply that points to the new reporting page. Some people will still use it.
3. For reports that still arrive by email, there are two options. Reply from the dedicated address and ask the reporter to submit through the reporting page, so they get their own case reference. Or, if they'd rather not, submit the report on their behalf, note in it that it arrived by email, and send the case reference only to them so they can follow the case from there.
4. Deal with what's already in the mailbox. Finish open cases where they are, or move them across the same way. Delete the rest when their retention period ends, and then retire the mailbox.

Legal basis

• Art. 6(2), Art. 9(1)(a)–(f), Art. 9(2), Art. 16, Art. 18, Directive (EU) 2019/1937 — anonymity left to member states; secure design and access limited to authorised staff; deadlines; designated handler; reporting in writing, orally or both; confidentiality of identity; records.
• § 16 HinSchG — access limited to the people responsible; oral or written reporting, and a meeting on request. The explanatory memorandum (BT-Drs. 20/3442, p. 81) confirms either form is enough.
• Décret n° 2022-1284, Art. 4 and 6 (Légifrance) — written or oral reporting; integrity, confidentiality and no access for unauthorised staff.
• Ley 2/2023, Art. 5.2, 7.2 and 7.3 (BOE) — secure design; written and oral reporting; anonymous reports accepted.
• D.Lgs. 24/2023, Art. 4, and ANAC Guidelines 1/2025 on internal channels, Resolution 478 of 26 November 2025 (ANAC) — confidentiality including by encryption; written and oral reporting both to be guaranteed (§2.2); ordinary email and PEC in themselves not adequate without justified countermeasures.
• Wet bescherming klokkenluiders, Art. 2 (wetten.overheid.nl) — written and oral reporting and a meeting on request.
• Whistleblower Protection Act of 14 June 2024 (Poland), Art. 25–27 — procedure contents; oral and written (including electronic) reporting; no access for unauthorised people.
• Protected Disclosures Act 2014 (Ireland), s.5A and s.6A (revised act) — anonymous reports; secure, confidential internal channels.