Can you use Google Forms as a whistleblowing channel?

The short answer: a Google Form or Microsoft Form can collect whistleblowing reports, but it can't reply to the person who made one. That's the problem. The EU Whistleblowing Directive expects you to acknowledge a report within 7 days, ask follow-up questions where you need to, and give feedback within 3 months. A form only collects. If the reporter stayed anonymous, there's no way to reach them again, and if they left an email address, they're no longer anonymous. On top of that, a few settings that are easy to miss can identify the reporter or shut out people the law protects.

If you already use a form, this article will help you find out where yours stands: what a form does well, the gap no setting can fix, a check you can run on your own form with a fix for each problem, and what switching to a dedicated channel changes.

What a form gets right

Forms have real advantages over an email inbox:

• No email address needed. A reporter can submit without an account or a mail trail, if the form is set up that way. Email can't offer that without the reporter creating a separate account first.
• Structure. Questions guide the reporter towards what a handler needs: what happened, when, who was involved, how they know.
• It's free and quick to set up. For a company with no legal obligation to have a channel, a carefully set-up form is a reasonable start.

The gap no setting can fix: no way back to the reporter

The Directive's deadlines assume a conversation, not a one-off message:

• Acknowledge within 7 days (Art. 9(1)(b)).
• Follow up diligently (Art. 9(1)(d)). In practice, that usually means asking the reporter something. Reports are rarely complete the first time.
• Give feedback within 3 months (Art. 9(1)(f)): what's been done and why.

See the 7-day/3-month clock, explained. A form has no reply function. The only way round it is to ask for contact details, which means the reporter has to choose between staying anonymous and hearing back. Many will choose not to report.

Dedicated channels close this gap with a case reference: the reporter gets a code when they submit, and uses it to read the acknowledgement, answer questions and see feedback, without ever giving a name or an email address. See anonymous vs identified reporting.

What your country adds

The Directive leaves several choices to national law, and some of them bear directly on a form:

• Anonymous reports. Spain requires internal channels to accept them. A form can take an anonymous report more easily than email can, but the reply gap above means you then can't acknowledge it or give feedback.
• An oral route. The Netherlands requires one by law, and Italy's regulator expects both written and oral reporting. A form is written-only, so it can't be the whole channel there.
• A meeting on request. Germany allows a written-only channel, but a reporter can still ask to meet in person. Your policy has to say how.

The country guides cover each law in more depth.

Check your own form

Ten checks. Each one says how to check and how to fix it with the tool you already have. Start with the first: it shows you exactly what your form records.

1. A test report records nothing about the reporter.

   Check: on a personal device, signed out of every work account, submit a test response. Then open the responses and see what was recorded alongside it.

   Fix: if anything identifies you (a name, an email address, a sign-in prompt you couldn't get past), work through checks 2 to 4.

2. Anyone can respond, without signing in.

   Check: in Google Workspace, a new form only accepts responses from people in your organisation, who have to sign in. In Microsoft Forms, "Only people in my organization can respond" and "Specific people in my organization can respond" both require sign-in, and the owner can tick "Record name".

   Fix: turn the organisation restriction off in Google Forms, or choose "Anyone can respond" in Microsoft Forms. As well as protecting anonymity, this lets in people the Directive protects who don't have a work account: contractors, suppliers' staff, job applicants, former employees (Art. 4; see who is protected).

3. Email addresses aren't collected.

   Check: Google's "collect email addresses" setting records each respondent's address, either verified from their Google account or typed in by them.

   Fix: turn it off. If you want a way to reach reporters, see check 7.

4. There's no file-upload question.

   Check: Google's help page says responders need to sign in to a Google Account to answer a file-upload question, and the files are stored in the owner's Drive. Microsoft's says file upload only works on organisation-only forms, with files stored in the owner's OneDrive.

   Fix: remove the question. Tell reporters how to share documents some other way, and that doing so may identify them.

5. Only the named handlers can see responses.

   Check: list everyone added as a collaborator or co-owner. People get added to help design a form and are rarely removed. In Microsoft Forms, a form created in a group can be read by every member of that group. Check whether a link to a summary of responses has ever been shared, and in Google Forms, whether respondents can see a summary of everyone's responses.

   Fix: remove everyone but the named handlers, move the form out of any group, and turn off any summary sharing.

6. Linked spreadsheets are locked down too.

   Check: if responses go to a Google Sheet, Google gives form collaborators access to it automatically, and anyone the sheet is shared with can read every report. Microsoft Forms can send responses to an Excel workbook in OneDrive or SharePoint.

   Fix: check who the spreadsheet is shared with, limit it to the named handlers, and check again every quarter.

7. Reporters know the trade-off between anonymity and hearing back.

   Check: does the form explain that without contact details you can't acknowledge a report, ask questions or give feedback?

   Fix: add an optional contact field and explain the trade-off in plain words beside it. A reporter who leaves a personal address can still be kept apart from their name by the handlers, but they're no longer anonymous.

8. Deadlines and the case record live somewhere reliable.

   Check: a response is a row in a table. Where is each report's status, acknowledgement date, feedback-due date and outcome kept, and who can see it? Article 18 requires records of every report.

   Fix: keep a register with access limited to the handlers, with a named person who reviews it weekly. See audit logging.

9. The form doesn't depend on one person's account.

   Check: is the form on a personal Gmail account, or a named employee's work account? A personal account sits outside your company's agreements altogether. On a work account, when that person leaves, someone else inherits their files, including every report.

   Fix: move the form to a company account that belongs to the handling function. Decide how long responses are kept, and delete them from the form, the spreadsheet and any storage folder when that time is up. See choosing a retention policy.

10. There's a second route, and an oral one where it's needed.

    Check: where does a report about one of the form's collaborators go? Can someone report without writing anything down?

    Fix: name an alternative contact in your policy, such as a director or an external adviser. Publish a phone number or voicemail where your country requires an oral route. See voice reports and anonymisation.

What no setting can fix

• No way back to an anonymous reporter. Covered above. Every workaround costs the reporter their anonymity.
• Anonymity and evidence don't mix. A reporter who wants to attach a document has to sign in to do it, on both Google Forms and Microsoft Forms.
• The record lives outside the form. The register, the deadlines and the record of who did what are a separate spreadsheet, kept in step by hand.
• Access is managed in a general-purpose tool. Collaborators, linked sheets, group membership and shared links all move independently. Nothing tells you when one of them changes.

What it takes to keep running a form

If every check above passes, the form can be a workable written channel for identified reporters, and a one-way one for anonymous reporters. Keeping it that way means:

• re-checking collaborators, linked spreadsheets and sharing every quarter, and after every leaver
• a register updated by hand for every report, and reviewed weekly against the deadlines
• a separate route for questions and feedback, for every reporter who leaves contact details
• a separate phone line or voicemail where an oral route is required
• deletion on schedule from the form, the spreadsheet and any linked storage

Why companies switch to Provoxis

Provoxis keeps what's good about a form (a structured, public page that needs no login) and closes the gaps a form can't:

Setup is self-serve with a guided checklist, pricing is a fixed monthly fee (see pricing), and there's a 30-day free trial.

Switching from a form

1. Publish the new channel everywhere the form's link appeared.
2. Close the form to new responses, and replace its description with a link to the new reporting page. Both Google Forms and Microsoft Forms can show a message to anyone who opens a closed form.
3. Finish open cases with the reporters you can reach. Where you can't, record that in the case file.
4. Delete responses from the form, the spreadsheet and any storage folder when their retention period ends, then delete the form.

Legal basis

• Art. 4, Directive (EU) 2019/1937 — who is protected, including people outside the employer's workforce.
• Art. 6(2) — whether anonymous reports must be accepted is left to member states.
• Art. 9(1)(a) — channels designed and run securely, with no access for non-authorised staff.
• Art. 9(1)(b), (d) and (f) — acknowledgement within 7 days, diligent follow-up, feedback within 3 months.
• Art. 9(2) — written reporting, oral reporting, or both, and a physical meeting on request.
• Art. 18 — records of every report received.
• Google Forms Help, add a file-upload question and Google Workspace form sharing settings; Microsoft Support, choose who can fill out a form and file-upload questions.