<!-- headlesslaw {"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2026-10-26","gaps":[],"covered":["2015/2392 — ITS — Whistleblowing procedures [in force] L2"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/mar/level-2/its/2015-2392-whistleblowing-procedures/articles/9","url":"https://www.headlesslaw.com/mar/level-2/its/2015-2392-whistleblowing-procedures/articles/9","title":"Article 9 — Protection procedures for personal data","family":"l2_unit_view","work_id":"spaces/mar/level-2/its/2015-2392-whistleblowing-procedures","view_of":"/mar/level-2/its/2015-2392-whistleblowing-procedures","status":"in_force","force_status":"in_force","date_state":"current","requested_date":null,"as_of":"2026-11-02","applies_from":null,"application":null,"version_label":"Commission Implementing Directive (EU) 2015/2392, OJ L 332, 18.12.2015","check":{"against":"EUR-Lex","on":"2026-10-26"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/eli/dir_impl/2015/2392/oj/eng","valid_from":"2016-01-07","valid_until":null,"content_id":"f5a5af753dc7da97","versions":["2016-01-07"],"version_url":"https://www.headlesslaw.com/mar/level-2/its/2015-2392-whistleblowing-procedures/articles/9/versions/2026-10-26","revision_url":"https://www.headlesslaw.com/mar/level-2/its/2015-2392-whistleblowing-procedures/articles/9/versions/2026-10-26/rev/f5a5af753dc7da97","versions_url":"https://www.headlesslaw.com/mar/level-2/its/2015-2392-whistleblowing-procedures/articles/9/versions","relations_url":"https://www.headlesslaw.com/mar/level-2/its/2015-2392-whistleblowing-procedures/articles/9/relations","act_url":"https://www.headlesslaw.com/mar/level-2/its/2015-2392-whistleblowing-procedures#art-9","source_line":"Commission Implementing Directive (EU) 2015/2392 · binding · OJ L 332, 18.12.2015 · dated 17 Dec 2015 [in force]","attribution":{"prepared_by":"European Commission","published_by":"Publications Office of the EU","published_in":"Official Journal of the European Union","document_type":"implementing_directive","legal_nature":"binding_adopted","addressees":["the Member States"],"dates":{"document_date":"2015-12-17","entry_into_force":"2016-01-07","locators":{"document_date":"CELLAR 32015L2392 work_date_document","entry_into_force":"CELLAR 32015L2392 resource_legal_date_entry-into-force (earliest)"}},"adoption":null},"context":{"act":{"work_id":"spaces/mar/level-2/its/2015-2392-whistleblowing-procedures","path":"/mar/level-2/its/2015-2392-whistleblowing-procedures","name":"Commission Implementing Directive (EU) 2015/2392","number":"2015/2392","celex":"32015L2392","title_official":"COMMISSION IMPLEMENTING DIRECTIVE (EU) 2015/2392 of 17 December 2015 on Regulation (EU) No 596/2014 of the European Parliament and of the Council as regards reporting to competent authorities of actual or potential infringements of that Regulation","document_date":"2015-12-17"},"position":{"kind":"article","key":"9","index":9,"articles":15,"annexes":0},"prev":{"path":"/mar/level-2/its/2015-2392-whistleblowing-procedures/articles/8","key":"8","title":"Article 8 — Protection of persons working under a contract of employment"},"next":{"path":"/mar/level-2/its/2015-2392-whistleblowing-procedures/articles/10","key":"10","title":"Article 10 — Transmission of data inside and outside of the competent authority"},"act_anchor":"#art-9"}}} -->
# Article 9 — Protection procedures for personal data

**Commission Implementing Directive (EU) 2015/2392 · binding · OJ L 332, 18.12.2015 · dated 17 Dec 2015 [in force]**

*In force · Commission Implementing Directive (EU) 2015/2392, OJ L 332, 18.12.2015 · Checked against EUR-Lex on 26 Oct 2026 · [Official source](https://eur-lex.europa.eu/eli/dir_impl/2015/2392/oj/eng)*

1. <a id="art-9-p-1"></a>Member States shall ensure that competent authorities store the records referred to in Article 7 in a confidential and secure system.
1. <a id="art-9-p-2"></a>Access to the system referred to in paragraph 1 shall be subject to restrictions ensuring that the data stored therein is only available to staff members of the competent authority for whom access to that data is necessary to perform their professional duties.