First recipient on a whistleblowing scheme
In short
The first recipient is the person who reads a report before anyone inside the company does. The role exists because a report may be about the very people who would otherwise handle it.
A whistleblowing scheme stands or falls on who reads the report first.
Put that role inside the company, and you have built a scheme that works in every case except the ones it exists for. A report about a chief executive that lands with the chief executive’s closest colleague is not a report. It is a problem for whoever received it.
The first recipient solves that by sitting somewhere the report can be read without consequences for the reader. From there, two routes: either the case goes on with a judgement on who should be kept away from it, or an assessment of the case itself comes with it.
The role is not to decide anything. That remains the company’s own responsibility, and it cannot be outsourced.
Questions we get
- Does the first recipient have to be external?
- No, that is not a requirement. But an internal first recipient cannot assess a case that is about themselves or about their own manager, and that is precisely the situation the scheme exists for.
- Is the first recipient a processor for the company?
- Not necessarily. Receiving reports yourself and turning away those that fall outside the scheme is an independent judgement, and that makes you an independent controller. What decides it is whether you follow an instruction or assess the matter yourself.
- What must the first recipient not do?
- Decide what the company should do about it. The role is to assess and pass on, not to settle the case.
Sources
- Opinion of the Danish Data Protection Authority on responsibility when an internal whistleblowing scheme is outsourced, 1 November 2022
- Timbed's own practice as first recipient for more than 40 Nordic companies, 24 September 2026
Last updated 24 September 2026