Skip to main content
Hafan

Whistleblower report

Organisation’s address (optional) This helps us to make sure we are investigating the right organisation.
What is your relationship to the organisation? This includes work as part of a temporary contract.

Give a short summary about what you witnessed. This helps us quickly understand what the problem is.

You can write up to 2,000 characters (around 500 words). You'll have a chance to share more later in this form.

Please include:

  • What happened- key events or actions that didn't feel right and raised concerns about data protection or information rights

  • When and where events happened- this doesn’t have to be exact

  • Who was involved- teams, departments or individuals within the organisation

  • Why you decided to make a report to the ICO

Don’t worry if you don't have all this information, just share as much as you can.

How many people are likely to have been affected? (optional)
Have you raised this issue with the organisation?
When did you raise the issue? (optional)
Has the organisation taken any action following your concerns being raised?
Do other people in the organisation already know this information?
Have you raised this issue (or similar) with us before?
What harm has been caused, or could be caused, if something isn't done? (optional) This could be harm you or someone else might experience as a result of what happened. We ask this so we can understand the impact the organisation or individual has had. You can select more than one option.

Evidence is facts or information that show the ICO what has happened.

This could include:

  • Screenshots, emails or letters that show what happened
  • Emails or letters you sent to the organisation raising your concerns and any responses you received

We only need to see evidence that relates directly to key events or concerns you've already described.

There’s no need to find new information, just share what you already have.

You can add up to five files of supporting evidence to your report. We accept Word, Excel and other Microsoft Office files, Open Office, txt, pdf, email and image files, up to 1.5MB each.

If you have more than five files to submit or prefer to send documents by post, we’ll share our email and postal address at the end of the form.

This can include any other information you think will help us understand what happened.

As part of your report, you can choose to provide contact details or remain anonymous.

If you choose to share your contact details:

  • we'll still deal with your concerns confidentially. We won’t reveal your identity or do anything that might risk revealing your identity when looking into your concerns; and

  • we may contact you for more information to help us understand your case better.

Do you want to share your contact details?
I’m submitting this report on behalf of someone else (optional)
Your email (optional) The address you want us to use for correspondence about this report
Is there any additional support or adjustments you need us to make when we're managing your report? (optional) For example do you need us to contact you only by phone, do you need information in large print or braille?
If the ICO spoke to the organisation about the information you’ve shared, how likely is it that they would be able to identify you as the person who made the report?
We ask this so we can make decisions about what action we should take to protect you as much as possible.
Are you happy for the ICO to contact you to discuss these concerns further or clarify any of the above information?