Ilmoo2026-09-21
Why a written internal reporting channel comes first
This page is not legal advice.
Directive (EU) 2019/1937 is built around internal reporting as the primary route where an organisation must have a channel, with an external route to a competent authority. Finland’s Act 1171/2022 follows that structure. This article explains the policy design in the public sources — not a sales claim, and not legal advice.
Internal first, then external
The Chancellor of Justice’s office, which runs Finland’s centralised external channel, states that an external report is available where the general conditions of protection are met and, among other things, the person cannot use an internal channel, or has a justified reason to believe that internal measures were not taken in time or cannot address the breach effectively, or that they are at risk of retaliation. The Office forwards reports; it does not investigate the substance. That design assumes many organisations actually operate an internal channel that people can use.
Section 10 of the Act is the duty to establish that internal channel for the listed organisations at the 50-person threshold (with the pension-institution exception). Section 15 requires the organisation to inform people, in clear and accessible form, about reporting internally and about the Chancellor’s central channel. Hiding the external route is not what the statute describes.
What “written” means — and what it does not
Section 15 says the internal channel must allow reporting in writing or orally. A web form can be the written path. Oral reporting, if offered, must be possible by telephone or another voice-message system, and a meeting must be arranged on request within a reasonable time. A software product that only provides a form does not by itself discharge the oral and meeting duties. Ilmoo publishes the organisation’s own oral and meeting instructions when they have been filled in; it does not place calls or take bookings.
Confidentiality of the internal channel is set out in section 32 of the Act (and related duties). The product’s audit log records administrative actions; it is not a substitute for the organisation’s confidentiality instructions to handlers.
Why the clocks exist
Seven days to acknowledge and three months to give feedback (sections 15–16) are organisation duties, counted in the Act from receipt or from the acknowledgement rules described there. Software can display clocks; it cannot acknowledge a report or investigate a breach on the organisation’s behalf. Designating impartial handlers (section 14) is also the organisation’s act, including when the channel software is outsourced under section 11.
Anonymous reports are a choice
Section 17 lets the organisation decide whether to accept anonymous internal reports, and it relaxes acknowledgement and feedback duties for those reports. A form that allows a reporter not to type a name is not the same as a legal decision to accept anonymous reports. The organisation still has to say what its channel rules are.
None of this is a customer case study. Read Finlex, EUR-Lex, and the Chancellor of Justice’s pages for the operative rules, and take advice for your organisation.