14 Reporting of breaches to competent authorities

Competent authorities should establish effective and reliable mechanisms to enable institution s’ staff to report to competent authorities relevant potential or actual breaches of regulatory requirements, including, but not limited to, those of Regulation (EU) No 575/2013 and national provisions transposing Directive 2013/36/EU. These mechanisms should include at least:

• a. specific procedures for the receipt of reports on breaches and follow-up, for instance a dedicated whistleblowing department, unit or function;
• b. appropriate protection as referred to in Section 13;
• c. protection of the personal data of both the natural person who reports the breach and the natural person who is allegedly responsible for the breach, in accordance with Regulation (EU) 2016/679 (GDPR); and
• d. clear procedures as set out in Section 13.

Without prejudice to the possibility of reporting breaches through the competent authorities’ mechanisms, competent authorities may encourage staff to first try and seek to use their institution s’ internal alert procedures .