138. In particular, internal alert procedures should: a. be documented (e.g. staff handbooks); b. …

In particular, internal alert procedures should:

• a. be documented (e.g. staff handbooks);
• b. provide clear rules that ensure that information on the reporting and the reported persons and the breach are treated confidentially, in accordance with Regulation (EU) 2016/679, unless disclosure is required under national law in the context of further investigations or subsequent judicial proceedings;
• c. protect staff who raise concerns from being victimised because they have disclosed reportable breaches;
• d. ensure that the potential or actual breaches raised are assessed and escalated, including as appropriate to the relevant competent authority or law enforcement agency;
• e. ensure, where possible, that confirmation of receipt of information is provided to staff who have raised potential or actual breaches;
• f. ensure the tracking of the outcome of an investigation into a reported breach; and
• g. ensure appropriate record keeping.

1. Overview

1.1 References

1.2 Identified Requirements

1.3 Related Standards

2. Identified Requirements

3. Related Standards

• EBA - Published by the European Banking Authority at https://www.eba.europa.eu/