Step 1: Identify the specific concern clearly

Before raising a concern, articulate it as specifically as possible. Specific concerns are easier for your employer to investigate and for regulators to assess. Identify what you have observed, what policy or legal obligation you believe may be breached, and what impact it has had or could have.

Step 2: Raise it internally first

Write to your manager, HR, or the data protection officer — whoever is most appropriate. Put it in writing. Be factual, not emotional. Reference the specific policy or legal obligation you believe is relevant. Ask for a response by a specific date. Keep a copy of everything you send and receive.

Step 3: External escalation if internal channels fail

For data protection concerns, file with your national data protection authority. For discrimination concerns, file with your employment regulator or equality body. For serious legal violations, consult your national whistleblowing authority or a specialist employment lawyer. In most jurisdictions, raising genuine compliance concerns in good faith is protected.