Skip to main content
iBlow logo
iBlow Logo
  • About
  • Services
  • Features & Packages
  • Resources
  • Contact
  • FAQ
  • Request a demo
  • EnglishEnglish
    • PortuguêsPortuguês
  • About
  • Service
  • Features & Packages
  • Resources
  • Contact
  • FAQ
iBlow logo
  • About
  • Services
  • Features & Packages
  • Resources
  • Contact
  • FAQ
  • Request a demo
  • EnglishEnglish
    • PortuguêsPortuguês

What are the obligations of an entity following an internal report?

What are the obligations of an entity following an internal report?

Topic of this article: obligations following an internal report.

Did you know that

The entity receiving an internal report is obliged to notify, within a maximum of 7 days, the receipt to the reporting person, as well as provide him/her with complete and accurate information as to the possibility of making an external report to the competent authorities, including information on its form and admissibility requirements.

The obliged entity should take appropriate internal actions to verify the reported breach, and may put an end to the breach by opening an internal investigation or reporting it to the competent authority for investigation. It is also obliged to notify the reporting person of the procedures adopted or to be adopted, within a maximum of three months from the receipt of the report and to communicate the result of the examination of the report, if the reporting person has requested it, within 15 days.

Breach of these obligations may lead to the commission of an administrative offence of between €1,000 and €125,000.

DLA Piper Portugal Team

obligations following an internal report - iBlow guideWoman in white blazer, long hairWoman in blue shirt, long hair

Dr. Daniel Reis

Dr.ª Marta Albuquerque Coelho

Drª Mariana Martins Fernandes

Obligations following an internal report: further reading

To go deeper on obligations following an internal report, see also:

  • Reports submitted through internal or external reporting channels, or publicly disclosed? What does the RGPDI include?
  • What steps should companies take to ensure compliance with the directive, and what are the most common challenges they face?
  • The importance of having a report channel

Official source: Directive (EU) 2019/1937.

Make compliance a confident part of how you grow.

Tell us what your organisation needs. We’ll help you find the right next step.
Talk to our team
Stylized text with abstract design
Secure reporting and practical compliance support for organisations that want to build trust and act with confidence.

Explore

About iBlow
Services
Features & packages
Resources
Law 93/2021 in 9 points
FAQs

Choose your next step

Book a demonstration
Request a proposal
Get the practical guide
Request a free trial

Contact

+351 210 987 308
[email protected]
Rua Mouzinho da Silveira 32
Lisboa, Portugal

Privacy policy · Terms · Cookies
© 2026 iBlow Europe. All rights reserved.
iBlow Europe
Manage Consent

To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.

Functional Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes. The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
O armazenamento ou acesso técnico é necessário para criar perfis de utilizador para enviar publicidade, ou para localizar o utilizador num site ou em vários sites para fins de marketing semelhantes.
  • Manage options
  • Manage services
  • Manage {vendor_count} vendors
  • Read more about these purposes
View preferences
  • {title}
  • {title}
  • {title}