A law firm handling clients’ reports: access the client controls
The client wants the law firm to receive reports, but does not want to hand over control of the account or explain to an inspector how an outsider has access to everything. The firm, in turn, does not want to keep a spreadsheet of passwords to a dozen panels. The same mechanism solves both problems.
The situation
A legal counsel handles reports for twelve clients. Each wants the firm to receive the cases, but none wants to hand over control of the account or explain to an inspector why an outsider sees everything and where their authorisation came from.
How it works
The client invites the lawyer into their account and grants at most the director role, never administrator. The lawyer serves all clients from one login, and the written authorisation sits in the client’s repository. Ending the cooperation is one click by the client, logged.
- Audit log
- Legal compliance
- Statutory deadlines
In this scenario 4
What the Act says in this situation
A legal entity may authorise an external body, for example a law firm, to receive reports, acknowledge their receipt and provide feedback (Article 25(1)(1) and Article 28(1) of the Whistleblower Protection Act), under a contract that also covers the entrustment of data (Article 28(2)). Follow-up actions and the decision remain with the entity’s impartial internal unit (Article 25(1)(3)), the register is kept by the legal entity (Article 29), and responsibility does not pass outside (Article 28(4)).
Every person who sees reports, including a lawyer from the firm, needs a written authorisation from that specific entity (Article 27(2)), and disclosing a whistleblower’s identity contrary to the Act is a criminal offence (Article 56). Hence the “account in every company” model: the authorisation is per entity and per person, so an account at each client reflects the provision exactly.
This is a description of how the system reflects the law, not legal advice; the details of the procedure are set by the organisation with its own lawyer.
What to watch when implementing
- The client invites, not the firm. The client’s administrator adds the lawyer like any employee, by entering their e-mail. The lawyer accepts the invitation in their own account and from then on sees that client alongside the others. An invitation not accepted expires after 14 days.
- Director at most. An outside person will not become the client’s administrator: they cannot change settings, invite others or switch off safeguards. On the client’s team list they appear as “external person: name of the firm”.
- An authorisation at each client. The written authorisation sits in that client’s authorisation repository, with the date of issue and confirmation of receipt. An inspector at the client sees a document, not an assurance.
- One login, separate registers. The lawyer has one password and one 2FA app, and each client is a separate, isolated account. The “My organisations” screen shows at which client the 7-day acknowledgement or the feedback deadline is about to pass.
- Ending the cooperation with one click by the client. Detaching ends access at once, logged on both sides. The client does not have to change passwords or ask the firm to “hand back” the account.
- The firm as a billing partner. If the firm sets up and bills client accounts, it does so in the partner model: the client tests for 7 days without a card, the discount grows with the number of clients, and the client switches on metadata access themselves. The partner never sees report content.
Features that make the difference
- Control stays with the company and A trail of every outside access (corporate groups, law firms and DPOs).
- One login, many companies with the “My organisations” screen.
- Authorisation repository at each client (compliance and permissions).
- Identity disclosure requests: the lawyer cannot uncover a whistleblower’s identity alone; a request is approved by a second authorised person at the client (confidentiality).
- Partner model with a client trial and per-client billing (for partners).
Frequently asked questions
Can the law firm run the proceedings on the client’s behalf?
It can support: receive reports, acknowledge receipt, draft the feedback, advise the committee. The decision and the signature under the feedback stay with the client’s impartial internal unit, and the client keeps the register. That is how the Act arranges it and how the roles are set up in the system.
Does the client see which other organisations the lawyer works in?
No. The client’s administrator sees only that the person signs in through another organisation and is an external person from a given firm. The list of the firm’s other clients is shown to nobody.
More on roles in the article GDPR in whistleblower reports.
From the knowledge base
- The internal reporting procedure step by step What the internal reporting procedure must contain under Article 25, how to consult it in 5 to 10 days, when it takes effect and how to announce it.
- GDPR in whistleblower reports: controller, processor, retention Who controls report data, when the vendor is a processor, what the processing agreement must cover, retention and the rights of the person concerned.
From a procedure to a working channel
sygnadesk counts the deadlines, keeps the register and protects the reporter’s identity the way the knowledge base describes. See how it would look in your organisation.