In the article it is discussed the issue of personal data protection of participants in internal anti-harassment proceedings, including primarily data obtained in a secondary manner. In particular, the author analyses the employer's information obligation towards participants in internal anti-harassment proceedings resulting from Article 14 of the Regulation (EU) 2016/679 of the European Parliament and Council of Europe of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, GDPR). The author also interprets the provision of Article 15 of the GDPR, which guarantees the data subject the right of access to data concerning him / her. The analysis of the protection of participants in internal anti-harassment proceedings was also carried out in the context of the proposed changes in the protection of whistleblowers legislation. The completion of the article contains de lege lata and de lege ferenda conclusions resulting from the considerations.