Establishing a Whistleblowing Hotline in Companies: A Guide to the KVKK and Employment Law

A whistleblowing hotline is an important compliance tool that enables companies to identify risks such as corruption, harassment, conflicts of interest, occupational health and safety violations, or breaches of ethical rules at an early stage. However, merely establishing the hotline is not sufficient: the reporting person, the employee against whom allegations are made, witnesses and evidence must all be protected throughout the same process. A well-designed system brings reports to light without unnecessarily multiplying personal data and ensures a fair investigation from an employment law perspective.

What Is a Whistleblowing Hotline in Companies and Why Is It Established?

A whistleblowing hotline enables employees, suppliers, or other stakeholders to report, through a secure channel, conduct that they believe may violate the law, company policies, or ethical principles. The channel may take the form of an online form, telephone, email, mobile application, face-to-face meeting, or a combination of these methods.

In Türkiye, the legal design of a whistleblowing hotline cannot be based on a single piece of legislation. Law No. 6698 on the Protection of Personal Data (the KVKK) in relation to the processing of personal data, and the Labour Law and the Turkish Code of Obligations in relation to employees’ rights, the employer’s duty of care, the duty of loyalty and potential sanctions, must be considered together. Where matters such as competition, bribery, money laundering, capital markets, or occupational health and safety are involved, sector-specific obligations must also be examined separately.

Directive (EU) 2019/1937 on the protection of whistleblowers is also relevant for companies operating in the European Union or forming part of a European-based group. The 50-employee threshold, 7-day acknowledgement period and 3-month feedback period under the Directive are not general rules directly applicable to all private companies in Türkiye. Nevertheless, the Directive provides a strong governance benchmark for confidentiality, impartial investigation and protection against retaliation.

Personal Data Processed Through a Whistleblowing Hotline and Data Mapping

A report file does not consist solely of the whistleblower’s name. Contact details, position, department, the time and place of the incident, information concerning the person against whom allegations are made, witness statements, correspondence, access logs, CCTV footage and investigation notes may all be included in the same file. Depending on the nature of the allegation, special categories of personal data, such as health information, trade union membership, data concerning sex life, or information relating to criminal convictions and security measures, may also be involved.

The first step, therefore, is not to create a large pool of data under the heading of ‘whistleblowing hotline data’, but to map data flows by processing activity. The company should provide concrete answers to the following questions:

• From whom and through which channels are data collected?
• Who may access the file, and at what level of authorisation?
• Which third parties provide support during the investigation?
• Which data are genuinely necessary for each type of report?
• Where are data stored, when are they deleted, and are they transferred abroad?

Legal Grounds for a Whistleblowing Hotline Under the KVKK and the Role of Explicit Consent

Compliance with the KVKK cannot be achieved simply by adding an explicit consent checkbox to the reporting interface. Particularly in an employment relationship, the imbalance of power between employee and employer may call into question whether explicit consent is freely given. Moreover, where another lawful ground for processing is available under the law, additionally requesting explicit consent for the same activity may create a misleading impression of choice for the data subject.

The legal ground must be determined separately for each purpose and category of data. Depending on the circumstances of the case, compliance with the employer’s legal obligations, the establishment, exercise or protection of a right, or the legitimate interests of the data controller may be relevant. Where legitimate interests are relied upon, a documented and auditable balancing test must be carried out between the legitimate interests of the data controller and the fundamental rights and freedoms of the data subjects.

For special categories of personal data, the conditions set out in Article 6 of the KVKK must be assessed separately. The amendment that entered into force in 2024 introduced grounds relating to legal obligations in the fields of employment, occupational health and safety, social security and social services, as well as the establishment, exercise or protection of a right. However, these grounds do not confer unlimited authority to collect data; necessity, proportionality, and security measures specific to special categories of data must be maintained.

Confidentiality, Anonymous Reporting, and the Obligation to Inform in Whistleblowing Processes

A ‘confidential report’ and an ‘anonymous report’ are not the same. In a confidential report, the company knows the whistleblower’s identity but shares it only with those who need to know. In an anonymous report, the whistleblower does not disclose their identity. If technical logs, device information, or user accounts are used to collect data that could indirectly identify an anonymous person, the channel may not in fact be considered anonymous.

The company should not promise absolute confidentiality. There may be circumstances in which disclosure of identity information is necessary due to a request from a competent authority, judicial proceedings, or the right of defence of the person against whom allegations are made. The appropriate approach is to limit disclosure to its purpose, record access, and explain possible exceptions clearly in advance.

The obligation to inform should not be considered solely in relation to the whistleblower. The person who is the subject of a report and witnesses are also data subjects whose personal data are processed. Each group must be informed of the identity of the data controller, the purposes of processing, to whom and for what purposes data may be transferred, the method of data collection, the legal grounds and the rights under Article 11 of the KVKK. Where data are not collected directly from the data subject, the periods prescribed by the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform must be observed; informing data subjects should not be postponed indefinitely on the grounds of preserving the integrity of the investigation.

Rights of the Employee Who Is the Subject of a Report: Defence and Fair Investigation

A report is not a proven violation but an allegation requiring investigation. File names, the wording of correspondence, and internal reports should preserve this distinction, and prejudicial expressions such as ‘guilty employee’ should be avoided. At an appropriate stage, the substance of the allegation should be explained to the person concerned, who should be given an opportunity to respond. Conversely, the whistleblower’s identity or unnecessary details concerning other persons in the file should not automatically be disclosed.

Article 19 of the Labour Law requires an employee’s defence to be obtained before termination on grounds relating to the employee’s conduct or performance, without prejudice to the circumstances set out in subparagraph (II) of Article 25. Accordingly, an automatic decision to suspend or dismiss an employee immediately upon receipt of a report creates a significant risk of dispute. If an interim measure is necessary, it should be based on concrete purposes, such as preventing interference with evidence, protecting the parties and ensuring business continuity, and its duration and scope should remain proportionate.

Prohibition of Retaliation Under Employment Law and Risks of Dismissal Following a Report

Trust in a whistleblowing hotline depends on credible assurance that a good-faith report will not be penalised through career decisions, pay, shifts, work location, or performance appraisals. The employer’s duty to protect the employee’s personality under Article 417 of the Turkish Code of Obligations and the employment protection provisions of the Labour Law may be relevant when assessing retaliatory measures.

Nevertheless, submitting a report does not afford an employee absolute immunity in all circumstances. A report that is knowingly false or constitutes an insult or defamation should not be treated in the same way as a good-faith report based on reasonable suspicion that is subsequently not substantiated. If disciplinary action is contemplated, the decision should be based not on the fact that a report was submitted but on concrete conduct established through an impartial investigation, evidence and an assessment of proportionality.

The prohibition of retaliation should not remain a single sentence in a code of ethics; it should be implemented together with employment law policies. Having decisions concerning duties, pay, and performance following a report reviewed by a second person, training managers on examples of retaliation, and enabling the whistleblower to raise new concerns safely make this protection effective.

Internal Investigation and Review Process Following a Report

A standard workflow ensures that files are managed according to the same principles rather than depending on the individuals involved. Although each case is different, the following sequence provides a sound starting point:

1. Conduct a preliminary assessment. Identify urgent risks involving danger to life, ongoing harassment, loss of evidence, or a requirement to notify a competent authority; determine whether the matter falls within the scope of the whistleblowing hotline.
2. Check for conflicts of interest. Assess whether those conducting the investigation report to managers named in the allegation. If necessary, appoint an independent lawyer or expert.
3. Document the scope and legal framework. Identify from the outset the allegations to be investigated, data sources, access permissions, legal grounds, and potential points of transfer.
4. Collect evidence in a targeted manner. Limit searches to periods, persons and systems connected with the allegation. Record the steps taken and preserve the integrity and source of the evidence.
5. Hear the parties. Conduct witness interviews with confidentiality warnings; give the person against whom allegations are made an opportunity to respond and submit evidence at an appropriate time.
6. Distinguish findings from allegations. Assess each allegation using consistent categories such as ‘substantiated’, ‘unsubstantiated’ or ‘inconclusive on the available evidence’. Document the reasons for any measure to be taken.
7. Close and monitor the file. Provide the whistleblower with feedback that the process has been completed without violating the privacy of others; monitor corrective actions and possible signs of retaliation.

Evidence Collection in Whistleblowing Investigations: Limits on Email and Device Monitoring

Corporate email, messaging records, access logs, or CCTV footage may be used during an investigation. However, the term ‘company device’ does not mean that all data on the device may be examined without restriction. Decisions of the Turkish Personal Data Protection Board concerning employee emails indicate the need to consider prior notification, a specified purpose, necessity, proportionality and less intrusive methods.

Accordingly, search criteria should be limited to keywords, dates and persons connected with the allegation, and interference with personal accounts or private correspondence should remain exceptional. Rather than copying an entire mailbox or retaining it indefinitely, relevant records should preferably be separated in a controlled manner. Employee monitoring policies and the whistleblowing investigation procedure should be consistent with one another.

KVKK Standard Contracts and Cross-Border Data Transfers in Whistleblowing Software

Where a whistleblowing platform is obtained from a technology provider, responsibility is not thereby transferred to that provider. The company must determine, on an activity-by-activity basis, whether the provider acts as a data processor or, for certain activities, as a separate data controller. The contract should expressly address hosting locations, access by support teams, subcontractors, access logs, breach notifications, data return and deletion.

Where personal data are transferred abroad or made accessible from abroad, the current transfer regime under Article 9 of the KVKK applies. In the absence of an adequacy decision, appropriate safeguards may include binding corporate rules for groups of companies, standard contracts, or other mechanisms specified by law. If a standard contract is used, the obligation to notify the Authority within 5 business days of its signing must also be taken into account.

Retention Periods and Role-Based Access for Whistleblowing Records

The argument that records ‘may be needed in a possible dispute’ does not justify indefinite retention of all whistleblowing files. A report being deemed outside the scope at the preliminary assessment stage, proceeding to an investigation, becoming subject to disciplinary proceedings, or entering a court file creates different retention needs. Accordingly, a retention and disposal policy should be established based on the stage of the case and legal limitation-period risks, rather than applying a single lengthy retention period.

Access should also be granted according to duties rather than job titles. Ethics and compliance, human resources, legal, internal audit, information security and governing bodies should not all have the same degree of access to the entire file. Role-based permissions, multi-factor authentication, encryption, and activity logs should be implemented, and unnecessary permissions should be removed through periodic access reviews. Once the retention period expires, data must be erased, destroyed, or, where appropriate, anonymised.

Provisions to Include in a Sample Whistleblowing Hotline Policy

The policy should not be a short document that merely announces the address of the reporting channel. To ensure that employees and the teams managing the process share the same expectations, at least the following matters should be expressly regulated:

• Who may submit reports and the available reporting channels
• Proportionate and anonymised reporting to the governing body
• Reportable matters and alternative channels to be used in emergencies
• Service providers, sub-processors and cross-border transfer mechanisms
• Independence of the investigation team and resolution of conflicts of interest
• Receipt of reports, preliminary assessment, investigation and feedback stages
• Categories of data processed, legal grounds, data subject rights and retention periods
• The distinction between anonymous and confidential reporting and the limits of confidentiality
• Prohibition of retaliation against good-faith whistleblowers and consequences of deliberately false reports

Training is as important as the policy itself. Employees should be informed of which incidents to report and where; persons receiving reports should be trained in asking questions, maintaining confidentiality, and refraining from interfering with evidence. Annual management reports should use aggregated indicators, such as report categories, case closure times, substantiated findings and corrective actions, rather than lists of names.

The Most Common Legal Mistakes Companies Make in Managing Whistleblowing Hotlines

In practice, the main risk is that a hotline established with good intentions becomes an uncontrolled archive of personal data and rumours. Relying on explicit consent in every process, promising anonymity while technically retaining identifying records, sharing files with an excessively broad group of managers, and imposing disciplinary sanctions without investigating a report are common mistakes.

Other mistakes include failing to determine retention periods, presuming the person reported to be guilty, treating a good-faith but unsubstantiated report in the same way as a deliberately false one, and failing to examine the external platform’s cross-border data flows. The effective solution is to design the hotline not merely as a software purchase, but as an end-to-end process jointly managed through personal data protection, employment law, information security and corporate governance.

Whistleblowing Hotline Advisory Services for Your Company in Compliance with the KVKK and Employment Law

A poorly designed whistleblowing hotline may give rise to personal data breaches, claims of wrongful dismissal, and loss of trust within the organisation rather than serving as an early-warning mechanism for the company. Where the reporting channel, investigation, evidence, access, retention, and protection against retaliation are considered together, risks can be managed at an early stage and in a proportionate manner.

Esenyel Partners provides companies with comprehensive legal support in preparing whistleblowing hotline policies, identifying KVKK data flows and legal grounds, reviewing service provider agreements, conducting internal investigations, and managing employment law risks.

You may contact Esenyel Partners to establish a new whistleblowing hotline in your company or to assess your existing system against current legislation and standards of practice.

Contact