Whistleblowing and the HinSchG

Whistleblowing in Germany: the HinSchG at a glance

Whistleblowing in Germany is governed by the Whistleblower Protection Act (Hinweisgeberschutzgesetz, HinSchG), which implements the EU Whistleblowing Directive (EU) 2019/1937. The Act requires employers with usually at least 50 employees to set up and operate an internal reporting office (§ 12 HinSchG), establishes external reporting offices at federal level, and protects people who report or disclose information about breaches against retaliation. Employers with 50 to 249 employees have had to operate an internal channel since 17 December 2023 (§ 42(1) HinSchG); larger employers were covered earlier.

The HinSchG matters for employers in three ways. First, it is an organisational obligation: failure to set up an internal reporting office is an administrative offence. Second, it shapes how reports must be handled, with strict confidentiality and deadlines for acknowledgment and feedback. Third, it changes the dynamics of employment disputes, because a whistleblower who suffers a disadvantage after a report benefits from a presumption that the disadvantage was retaliation.

Whistleblowing systems are also the most important source of information about misconduct within companies. A well-designed channel lets management learn about problems before regulators, prosecutors or the press do, and is a core element of any compliance management system. This page explains who is covered, how internal channels must work, the options for groups, external reporting and public disclosure, protection against retaliation and the fines for breaches.

Scope: who and what is protected

The Act protects natural persons who have obtained information about breaches in connection with their professional activities, or in advance of them, and report or disclose it. This includes employees, trainees, temporary workers, applicants, former employees, self-employed persons, shareholders, members of management and supervisory bodies, and employees of suppliers. People who are the subject of a report or are affected by it are also protected by the confidentiality rules.

The material scope is broad (§ 2 HinSchG). It covers all breaches that are punishable as criminal offences, breaches punishable by administrative fines where the rule protects life, limb or health or the rights of employees or their representative bodies, and breaches of a long list of federal, state and EU rules, for example on money laundering, product safety, environmental protection, food safety, consumer protection, data protection, information security, public procurement, financial services, accounting of listed companies, and competition law. Reports outside this catalogue, for example about purely internal policy breaches, are not protected by the Act, although many companies accept them voluntarily.

Certain information is excluded, for example information concerning national security or covered by specific professional secrecy obligations, such as those of lawyers and doctors (§ 5 HinSchG). Protection also depends on good faith: the whistleblower must have had reasonable grounds to believe that the information was true and within the scope of the Act at the time of the report (§ 33 HinSchG).

Internal reporting channels: set-up and procedure

The internal reporting office can be staffed by an employee, a team, or a third party such as an external ombudsperson or a law firm; appointing a third party does not relieve the employer of its own duty to take measures to remedy a breach (§ 14(1) HinSchG). The persons entrusted with the task must be independent in performing it and have the necessary expertise; they may have other duties as long as these do not create conflicts of interest (§ 15 HinSchG).

Channels must allow reports orally and in text form, and on request a personal meeting must be offered within a reasonable time (§ 16(3) HinSchG). Anonymous reports should be processed, but there is no obligation to design channels that allow anonymous reporting.

The procedure is regulated in detail. The internal reporting office must acknowledge receipt within seven days, check whether the report falls within the scope, keep in contact with the whistleblower, assess the validity of the report, request further information where necessary and take appropriate follow-up measures (§ 17 HinSchG). Within three months of the acknowledgment, it must give feedback on planned and completed follow-up measures and the reasons for them, to the extent that this does not affect internal inquiries or investigations or the rights of the persons concerned. Follow-up measures include internal investigations, referral to a competent authority and closure of the procedure for lack of evidence (§ 18 HinSchG).

Handling reports in practice

Good whistleblowing practice goes beyond the statutory minimum. Each report should be triaged promptly by a small team that assesses its credibility, urgency and seriousness, checks for conflicts of interest, and decides whether to investigate, refer the matter to another function such as HR, or close it. Reports involving senior management should be escalated to the supervisory board or audit committee. Investigations triggered by reports follow the same rules as other internal investigations, including data protection and works council rights. Throughout, the reporting office should keep the whistleblower informed, and record what was done, by whom and why, so that the company can later demonstrate that it handled the report properly.

Data protection

Operating a whistleblowing channel involves processing personal data of whistleblowers, accused persons and witnesses. The HinSchG provides a legal basis for processing by reporting offices to the extent necessary for their tasks (§ 10 HinSchG), but the GDPR continues to apply in full. Companies should carry out a data protection impact assessment for the reporting system, conclude processing agreements with external providers, define deletion periods in line with § 11(5) HinSchG, and decide how and when persons named in a report are informed, since information can be delayed where it would jeopardise the investigation.

Confidentiality is the core duty. The identity of the whistleblower, of the persons who are the subject of the report and of other persons named in it may be disclosed only to the people responsible for receiving and handling reports and those who assist them (§ 8 HinSchG), subject to limited exceptions, for example at the request of prosecuting authorities. Documentation must respect this, and access rights in the case management system should be restricted accordingly.

Whistleblowing systems in groups

Groups usually prefer a single central whistleblowing system rather than separate channels for each entity. The HinSchG allows employers with 50 to 249 employees to share a reporting office, while the duty to remedy breaches and give feedback remains with each employer (§ 14(2) HinSchG). For larger subsidiaries, the position is debated: the European Commission has taken the restrictive view that each legal entity with 50 or more employees needs its own channel, while the German legislator considered in the explanatory memorandum that a group company, including the parent, can be appointed as a third party under § 14(1) to operate the internal reporting office for subsidiaries.

A central group channel is therefore common practice in Germany, but it should be structured carefully. Each subsidiary should formally appoint the central office as its internal reporting office, retain responsibility for follow-up measures and feedback, and ensure that whistleblowers can also make reports locally, in their own language and in person. Confidentiality must be preserved within the group, and data transfers to group companies outside the EU require a GDPR-compliant basis. Where a works council exists, its co-determination rights over technical systems and conduct rules must be respected when the channel is introduced; see our page on works councils.

A whistleblowing implementation checklist for German employers typically includes the following steps:

• Determine the headcount of each group company and which entities must have a channel.
• Choose the whistleblowing operating model: internal staff, external ombudsperson, shared office or group channel.
• Select a reporting tool that supports oral and text reports, anonymity and secure communication.
• Involve the works council and the data protection officer before launch.
• Publish clear information on internal and external reporting for employees and third parties.
• Train reporting office staff, HR and managers on confidentiality and anti-retaliation.

External reporting and public disclosure

Whistleblowers can choose between internal and external reporting (§ 7 HinSchG). The Act states that they should prefer internal reporting where the breach can be addressed effectively internally and they do not fear retaliation, and employers that must operate an internal channel should create incentives for internal reporting, but they may not prevent external reports. The federal external reporting office is located at the Federal Office of Justice (Bundesamt für Justiz); BaFin and the Federal Cartel Office are external reporting offices for their areas, and the federal states may set up their own offices.

Public disclosure, for example to the media, is protected only in narrow circumstances: where the whistleblower first reported externally and no appropriate follow-up measures were taken or no feedback was given within the deadlines, or where they had reasonable grounds to believe that the breach could constitute an imminent or manifest danger to the public interest, or that an external report would lead to retaliation or would be ineffective (§ 32 HinSchG). Knowingly disclosing false information is an administrative offence, and whistleblowers are liable for damage caused by intentionally or grossly negligently reporting false information (§ 38 HinSchG).

Protection against retaliation and fines

Retaliation against whistleblowers is prohibited, including threats and attempts (§ 36(1) HinSchG). Retaliation covers any act or omission in connection with the whistleblower's professional activity that is a reaction to a report and causes or may cause an unjustified disadvantage, such as dismissal, demotion, transfer, denial of promotion, negative assessments, disciplinary measures or harassment. If a whistleblower suffers a disadvantage in connection with their work and claims that it was a consequence of the report, it is presumed to be retaliation; the person responsible must then prove that the disadvantage was based on sufficiently justified grounds or was not based on the report (§ 36(2) HinSchG).

The burden-of-proof rule has a direct effect on employment law. Employers who take measures against an employee who has made a report, even for unrelated reasons, must be ready to document those reasons. In breach of the prohibition, the employer must compensate the resulting damage, although the whistleblower has no claim to be hired or promoted (§ 37 HinSchG). Agreements that restrict whistleblowers' rights under the Act are invalid (§ 39 HinSchG), so confidentiality clauses in employment and settlement agreements must carve out protected reports.

Fines apply to the main breaches (§ 40 HinSchG). Obstructing reports, taking retaliatory measures and intentionally or recklessly breaching confidentiality can be fined up to EUR 50,000, failing to set up and operate an internal reporting office and knowingly disclosing false information up to EUR 20,000, and other cases up to EUR 10,000. For obstruction, retaliation and breaches of confidentiality, § 30(2) sentence 3 OWiG applies, so the maximum fine against a company is multiplied by ten.

Illustration: an employee of a logistics company with 180 staff reports via the shared reporting office operated by an external ombudsperson that safety inspections of forklifts are being falsified. The ombudsperson acknowledges the report within seven days and passes it, without identifying the employee, to the managing director. An inspection confirms the problem and the company retrains staff and changes its inspection records.

Two months later, the employee's fixed-term contract is not renewed for budget reasons. Because the decision followed the report, the company must be able to prove that it was based on documented, unrelated grounds, which it can do only because the budget decision had been recorded before the report was made.

How TRW & Co helps

We help employers set up and run whistleblowing systems that meet the HinSchG. We design group-wide reporting structures, draft procedures, policies and employee information, negotiate works agreements on reporting systems, and advise on data protection and the selection of reporting tools. We can assess reports, conduct the resulting internal investigations and advise on follow-up measures and feedback. In employment disputes, we advise employers on measures affecting whistleblowers and defend them against retaliation claims. We also train reporting office staff and managers. To discuss your whistleblowing system, please contact us.