Who may handle whistleblower reports within a company?

An impartial person or department handles the report

The law does not prescribe a job title: a compliance officer, a trusted person, someone from HR, a lawyer, or an external party can all be the designated handler. What matters is not the title, but the position: the person who handles the report must be impartial and able to work independently, separate from the person or department that the report concerns. An employer chooses who this will be themselves, and may also have this handled by an external party that manages the intake and follow-up.

What often plays a role in practice: the person who handles it must not also be the person whose conduct can be in question, and their other tasks in the organization must not influence the handling. Protecting the confidentiality of the reporter's identity is also part of that role — that works poorly if a manager with a vested interest in the outcome is involved. For that reason, the handling is often kept separate from the regular line in practice, or outsourced.

Where this follows from Article 9 and Article 2

Article 9 of Directive (EU) 2019/1937 refers to the 'impartial person or department responsible for following up on reports' as a core requirement for an internal reporting channel, without prescribing a specific function or title. Article 2 of the Whistleblower Protection Act elaborates on this with requirements for the internal reporting procedure — including who receives and follows up on a report — and leaves the precise implementation, which function or which person this will be, to the employer themselves.