Directive 2006/54/EC — harassment is a form of discrimination. Employers must ensure effective access to remedies. How you handle this conversation IS the remedy process.
Art. 19 — Burden of proof — once Sofia establishes a prima facie case, the burden shifts to the employer to prove no discrimination occurred. Your documentation of this conversation is critical evidence.
GDPR Art. 5 — personal data must be “adequate, relevant and limited to what is necessary.” Share Sofia’s details only with investigators, not the wider team.
Whistleblower Directive Art. 16 — the identity of the reporting person must be kept confidential. Acknowledge receipt within 7 days; feedback within 3 months.