On November 14, 2018, the German Data Protection Conference issued a Guidance on whistleblowing published. Accordingly, a legal obligation within the meaning of Article 6 (1) (c) of the GDPR can be considered as a legal basis, but also a legitimate interest; however, only with regard to information on violations of applicable law or human rights. In the case of violations of internal ethical rules, on the other hand, it must be assumed that the interests of the employees concerned generally prevail and that Art. 6 (1) (f) GDPR does not constitute a legal basis in this respect.