Internal reporting channel

The Catalan Data Protection Authority provides its staff and the public with a channel to report potential serious or very serious criminal or administrative violations that may occur within the framework of a professional or employment relationship. This complies with Law 2/2023, of 20 February, regulating the protection of persons reporting legal infringements and anti-corruption measures.

This internal reporting channel is provisional until APDCAT has a permanent solution available, shared with other institutions.

The purpose is to provide a channel to report actions or omissions that may constitute criminal, administrative, or labour violations of the Authority’s internal regulations, under the terms established in Law 2/2023. Confidentiality is guaranteed, and therefore the identity of the complainant will remain confidential and will not be disclosed to the reported persons or third parties. The internal reporting channel cannot be used as a suggestion box or for complaints or claims related to working or contractual conditions. Nor for rights protection claims or data protection violations, which have their own channels and specific procedures.

Reports may be submitted anonymously or not, verbally or in writing:

Verbally:

• In person: By making an appointment with the internal channel management body at 93 552 78 00 or via email at alertainterna.apdcat@gencat.cat,Monday to Friday, during working days, from 9.00 am to 2.00 pm.

In writing:

• By postal mail: By means of a letter to be sent to the Catalan Data Protection Authority, Gran Via de les Corts Catalanes, 635, 1a planta, 08010 Barcelona,addressed to the internal channel management body.
• Electronically: By sending an e-mail to the following address alertainterna.apdcat@gencat.cat and, when available, via the designated form.

To submit an anonymous report, it must be sent by postal mail without identifying the sender, or via the form provided for this purpose.

When submitting a report, the complainant may expressly indicate whether they waive receiving any communications about the actions taken. An anonymous report implies a waiver of any such communications.

The identity of the complainant will always remain confidential and will not be disclosed to the persons involved or to third parties.

If the report is not anonymous, it must include at least:

1. Contact details of the complainant (full name, ID, passport or NIE, and email). The complainant will choose how to receive notifications regarding the processing of the report, providing either a postal address or an email.
2. Contact details of the reported person (full name).
3. Description of the facts being reported.

By submitting information through any of the available channels, the complainant guarantees that the personal data provided are true, accurate, and up to date, and that any changes to personal data will be notified promptly.

The Catalan Data Protection Authority will process the data to manage the receipt, investigation, and resolution of reports concerning actions or omissions that may constitute criminal, administrative, or labor violations, or breaches of the Authority’s internal regulations. You may access, rectify, or delete your data, object to its processing, and request its limitation by contacting APDCAT (Gran Via de les Corts Catalanes, 635, 1a planta, 08010 Barcelona) or via the electronic form. For more information about data processing, see this link.