A whistleblowing hotline processes personal data of persons accused in reports. Which design principle is most aligned with GDPR expectations?
Select an answer to reveal the explanation.
Short Explanation
A hotline is a locked evidence room, not a gossip channel. Protect the reporter, lock down who sees the file, and only use accused persons’ data for the investigation purpose. Wide sharing defeats both trust and purpose limitation.
Full Explanation
Whistleblowing schemes process personal data of reporters and reported persons and must apply confidentiality, purpose limitation, and security. Access should be restricted to authorised investigators, retention tied to investigation needs, and fairness safeguards applied to accused individuals. Controllers should document roles, procedures, and lawful bases consistent with GDPR and applicable whistleblowing legislation.