Cap. 527 Art. 6AProcessing of personal data.

Any processing of personal data carried out pursuant to this

Act, including the exchange or transmission of personal data by the whistleblowing reporting officer or whistleblowing reports Unit, shall be carried out in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), the Data Protection

Act and the Data Protection (Processing of Personal Data by Competent Authorities for the Purposes of the Prevention, Investigation, Detection or Prosecution of Criminal Offences or the Execution of Criminal Penalties) Regulations:

Provided that, personal data which are manifestly not relevant for the handling of a specific report shall not be collected or, if accidentally collected, shall be deleted without undue delay.