Analytics, export and data privacy

The Whistleblowing module gives you two oversight tools: the Analytics tab, which measures activity and deadline compliance, and the Data Privacy page, which sets the retention period, anonymises finished cases and produces a case export for the right of access. This article describes both. It is aimed at scheme administrators, HR, auditors and the DPO.

Before you start #

• The Whistleblowing module must be subscribed and open to your account.
• Reports — View (Access level) opens the Analytics tab; the Administrator, HR and Auditor roles carry it by default. Without that right, the tab does not appear.
• Reports — Export lets you download the CSV; the Administrator and HR roles carry it at Execute level.
• Settings — Compliance (GDPR / EU 2019/1937) shows the Programme compliance card on the dashboard and lets you change the retention period.
• Settings — Anonymization / consent lets you anonymise a case; only the Administrator role carries it by default.
• As everywhere in the module, you only see the cases of the channels you handle: the analytics, the export and the list of cases to anonymise cover those cases.

Reading the analytics #

Open Whistleblowing › Analytics. The Reports & Analytics page presents:

• four indicators: Total reports, Resolution rate, Unassigned and Average resolution time (in working days);
• the Monthly trend over the last six months;
• the breakdowns By status, By category, By channel and By priority;
• Manager activity: for each handler, their assigned and resolved cases, their rate and their channels;
• the Compliance card: Acknowledgements on time, Feedback on time, Overdue, Anonymous reports and With messages, each marked Compliant or Warning against its target.

Choosing the period #

At the top right, choose the Analysis window: 30 d, 90 d, 12 months or All. The indicators and breakdowns are recalculated for that period. The Monthly trend, however, always covers the last six months, and the screen says so. If no case falls within the period, the message “No reports in this period” invites you to widen it: no rate is shown on zero cases.

Exporting cases to CSV #

1. In the Analytics tab, choose the period.
2. Click Export (CSV). The button changes to “Exporting…”, then “Exported”.

The file covers the period displayed and the cases you are allowed to see. It contains neither summary nor description, and each exported case leaves a Case exported line in its audit log: you always know who holds a copy of which case.

Monitoring compliance from the dashboard #

With the Settings — Compliance (GDPR / EU 2019/1937) right, the module’s Dashboard shows the Programme compliance card at the top, marked DPO view. Across every channel — including those you do not handle — it counts the cases overdue for acknowledgement (Acknowledgement · 7 d) and for feedback to the reporter (Response · 90 d), and the cases to purge under retention. It shows no case data: counts only. A DPO who handles no channel can thus spot delays without reading a single case. See Getting started with whistleblowing.

Setting the retention period #

1. Open Settings › Whistleblowing › Data Privacy.
2. Under Retention period, enter the number of months (36 by default).
3. Click Save changes.

The screen states the rule: closed cases become eligible for anonymisation after that number of months. The closing date is what counts. At the top of the card, three counters sum up the situation: Total cases, Already anonymized and To anonymize.

Anonymising cases #

Anonymisation erases the reporter’s identity and tracking password, the content of the messages and the attachments. The reference, status and audit log are kept for traceability. It applies to closed or resolved cases.

1. Under Data anonymization, find the cases marked To anonymize.
2. Click Anonymize on a case, or Anonymize N case(s) to process them all.
3. Read the Confirm anonymization dialog: the action is irreversible, and the reporter will permanently lose access to their case and will no longer be able to exchange with you.
4. Click Anonymize permanently (or Anonymize the N cases). The message “N case(s) anonymized” confirms; the case becomes Anonymized.

Anonymisation is sent to the server on confirmation, without going through Save changes, and cannot be undone. You need both the Settings — Anonymization / consent right and to handle the case’s channel: the list only shows your cases. If some cases fail, the screen names them under “Cases not anonymized”.

Exporting a case for the right of access #

1. Under GDPR Export — Right of access (Art. 15), click Choose a case.
2. In Select a case to export, search for the case by reference or summary, then click Export.
3. The message “GDPR export downloaded for …” confirms; an HTML document is downloaded.

The document brings together the case information, the messages, the list of attachments, the audit log and the consent. It is produced in your browser from the loaded case: unlike the CSV export, it is not recorded in the audit log. Keep it somewhere safe.

The consent log #

When a reporter chooses to give their email address, they tick the GDPR consent. The Consent log lists those consents with their date (Given on). An anonymous report produces none.

Good to know #

• The analytics only read the cases of the channels you handle; the dashboard’s Programme compliance card counts every channel without showing any case.
• Each case exported to CSV is traced in its audit log; a case’s HTML export is not.
• Anonymising permanently cuts the reporter off from their case: do it once the exchanges are over.
• To set the legal deadlines, see Configuring the scheme.

Frequently asked questions #

I cannot see the Analytics tab. #

Your role does not carry the Reports — View right. It is set under Manage Employees › Employee Roles.

The Anonymize button does not appear for a case. #

Only closed or resolved cases are offered, and only if they belong to a channel you handle. You also need the Settings — Anonymization / consent right.

What does the CSV contain? #

The tracking data of the cases in the period (reference, channel, category, status, priority, dates…), without summary or description.