Designating who handles reports

A channel isn't enough on its own — the law requires a person

It's possible to stand up a submission form and still not have a compliant channel, because the Directive doesn't just require somewhere for reports to land — it requires someone accountable for what happens next. Art. 9(1)(c) requires "the designation of an impartial person or department competent for following-up on the reports... which will maintain communication with the reporting person and, where necessary, ask for further information from and provide feedback to that reporting person." A form with nobody clearly responsible for it satisfies the letter of "we have a channel" while missing what the channel is actually for.

The same person or department can both receive reports and follow up on them — the Directive doesn't require two separate roles — but whoever it is has to be named, impartial, and actually resourced to do the follow-up work, not just nominally assigned.

In-house or outsourced — both are explicitly allowed

This is a genuine, open decision, not something the Directive nudges you towards one way. Art. 8(5) is explicit that reporting channels "may be operated internally by a person or department designated for that purpose or provided externally by a third party." Both are legitimate:

• In-house. Someone inside the company — often HR, legal, or a compliance lead — handles reports directly. They already understand the organisation's context, its people, and its history, which makes follow-up faster and better-informed. The trade-off is independence: the smaller the company, the harder it is to find someone with no proximity at all to whoever might end up being reported on.
• Outsourced. An external ombudsperson, law firm, or specialist provider handles reports (or at least the initial triage) instead of internal staff. This buys genuine distance from internal politics and reporting lines, at the cost of someone less familiar with the organisation's own context having to get up to speed on every case.

Neither choice is about the software you use to run the channel — a company can use a purpose-built platform and still handle every case in-house, or use the same platform and route cases to an external handler. The tooling and the handling decision are separate.

What "impartial" rules out in practice

"Impartial" is the operative word in Art. 9(1)(c), and it has a practical implication worth thinking through before a real report tests it: whoever is designated shouldn't be someone who'd end up investigating their own conduct, or their own direct manager's. In a company just over the 50-employee threshold, this is often genuinely hard — a small leadership team means a limited pool of people with no plausible conflict. That's frequently the exact moment companies decide to bring in an external handler for at least the cases where an internal conflict is likely, even if most reports are still handled in-house.

How many people should actually have access

There's a second balance to strike, separate from impartiality: how large the designated group is. Smaller is generally better for confidentiality — Art. 9(1)(a)'s requirement that a channel "prevents access thereto by non-authorised staff members" is easier to actually guarantee the fewer people are on the list. But a single named handler is a single point of failure: illness, leave, a conflict of interest on one specific case, or simply being overloaded can all leave reports genuinely unattended. A designated group of two or three, with clear backup coverage, is a more realistic floor than one person for most companies crossing the threshold.

How Provoxis fits into this decision

Provoxis doesn't make this decision for you — who your handlers are is an organisational choice the company has to make regardless of what platform runs underneath it, whether that lands on one person, a small internal team, or an external provider added as a handler on the platform. What Provoxis does is enforce the boundary once that decision is made: only the staff a company has explicitly added as handlers or admins can see an identified reporter's details, the audit log records each time one of them opens a report, and access isn't something that can quietly persist through a shared password or an old forwarding rule the way it can with a shared inbox.

Legal basis

• Art. 9(1)(c), Directive (EU) 2019/1937 — the requirement to designate an impartial person or department competent to follow up on reports.
• Art. 8(5) — internal reporting channels may be operated internally by a designated person or department, or provided externally by a third party.
• Art. 9(1)(a) — the requirement for channels to be designed and operated to prevent access by non-authorised staff, the basis for keeping the designated group deliberately small.