Confidentiality is central to whistleblowing and internal investigations, but it is rarely absolute in practice. Sensitive concerns often require witness interviews, management action, internal reporting and, in some cases, engagement with external advisers or regulators. The challenge is not simply to promise confidentiality, but to manage information in a way that protects the process and those involved as far as possible.
Insights based on a Multilaw webinar presented by Juha Rönkä, Dottir Attorneys; Barbara Martinez, Holland & Knight; Claudine Gemeiner, Heussen; Lester Fung, Howse Williams; and Tom Walker, Penningtons Manches Cooper
That challenge becomes even sharper where allegations involve sexual harassment, senior personnel, anonymous reporting or reputational risk.
1 Confidentiality matters from the start
Employees are more likely to raise concerns if they believe those concerns will be handled carefully. The same is often true of witnesses. Confidence in the process depends heavily on whether people trust that information will be controlled and disclosed only where necessary.
At the same time, an organisation should be realistic about what confidentiality can mean in practice. In some matters, particularly interpersonal misconduct cases, it may become difficult to investigate properly without revealing enough information for individuals to infer who has made the complaint or who is involved.
That does not remove the obligation to protect confidentiality. It does, however, mean that confidentiality should be described and managed carefully, rather than presented as something absolute that can always be guaranteed.
2 Anonymous reports create particular challenges
Anonymous whistleblowing channels can be an important part of a reporting framework, especially where individuals are reluctant to come forward openly. But they can also make investigation more difficult.
The organisation may have incomplete information, limited ability to test the allegation and no direct way to seek clarification unless the reporting mechanism allows continued communication. For that reason, anonymous reports require especially careful assessment and documentation.
Where an anonymous allegation is not taken further, there should still be a clear record of why. The fact that a report is anonymous does not mean it can be handled casually.
3 Sensitive allegations may require protective measures
Where the allegation is particularly serious, temporary measures may be needed while the investigation is underway. These can include suspending the accused person, separating reporting lines, restricting access, or otherwise protecting the integrity of the process.
Those steps can be necessary, but they are not neutral. They may have reputational, professional and social consequences for those involved. Rumours can begin quickly. In some cases, information may reach the press or other external parties before the investigation is concluded.
For that reason, organisations need to think carefully about who is told what, when and why. The interests of the whistleblower, the accused and the business all need to be balanced properly.
4 Privilege requires care, especially at the reporting stage
Privilege was another important theme. A common practical risk arises when final investigation reports are circulated more widely than necessary after the matter appears to have concluded.
If privileged material is shared carelessly, questions may later arise about waiver. That can become highly significant if the same matter returns through litigation, regulatory scrutiny or a further whistleblowing complaint.
The safest approach is to think carefully about whether a final written report is needed, how it is framed, and exactly who should receive it. Where there is any doubt, that should be considered with legal counsel before circulation takes place.
5 Internal trust also matters
One of the practical points raised in the discussion was that people may sometimes have greater confidence in external investigators than in an internal team, particularly in sensitive workplace matters. That is not always the case, but it is a factor worth considering.
If a business chooses to investigate internally, the individuals involved in that process need to be trusted. People must believe that information will be handled discreetly and that the process will not be compromised by internal relationships or informal disclosure.
In some cases, the credibility of the investigation depends as much on this internal confidence as on the formal structure itself.
6 Jurisdiction remains important
As with other aspects of whistleblowing and investigations, confidentiality and privilege do not operate identically across jurisdictions. Rules around anonymity, disclosure, employee rights, board reporting and legal privilege may differ considerably.
For cross-border matters, that means assumptions should be avoided. An approach that is standard in one country may create risk in another. Confidentiality and privilege need to be assessed in the relevant legal and factual context.
7 Practical takeaways for in-house teams
For in-house teams, the central discipline is to control information flow carefully.
That includes:
limiting knowledge of the matter to those who genuinely need to know
being realistic about what confidentiality can and cannot mean
documenting the handling of anonymous reports properly
considering protective measures carefully in sensitive cases
taking advice before widely sharing investigation findings or reports
assessing privilege issues early, not only once the investigation is complete
Just as importantly, organisations should avoid making promises they may not be able to keep. A better commitment is that concerns will be handled seriously, discreetly and only shared as necessary.
Conclusion
Confidentiality and privilege are not only legal concepts. They are also practical disciplines. They require good judgement, controlled communication and realistic expectations.
When handled well, they help protect the integrity of the investigation and the people involved. When handled poorly, they can create additional risk even where the underlying issue was initially manageable.
Published: June 2026
Disclaimer: This article is provided for general information purposes only and does not constitute legal or other professional advice. Readers should seek specific advice from qualified legal advisers in the relevant jurisdiction, including appropriate Multilaw member firms, before taking or refraining from any action based on the content of this article.