Setting Up an Internal Reporting Channel

Setting up an internal reporting channel: the short answer

Under the Whistleblower Protection Act (Hinweisgeberschutzgesetz, HinSchG), every employer in Germany that usually employs at least 50 people must operate an internal reporting channel through which employees and temporary agency workers can report breaches of law covered by the Act (§ 12(1), (2) HinSchG). Certain financial-sector entities must do so regardless of headcount (§ 12(3) HinSchG).

The internal reporting office must acknowledge receipt within seven days, follow up diligently and give feedback within three months, keep the identity of the whistleblower confidential and document reports, deleting the documentation three years after the procedure ends. The channel may be outsourced to a third party, such as an external ombudsperson, but the employer remains responsible for remedying breaches. Failure to set up such a channel can be fined up to EUR 20,000.

For employers with 50 to 249 employees, the obligation has applied since 17 December 2023 (§ 42(1) HinSchG). This article explains the legal requirements, design options including outsourcing and group-wide solutions, the resources needed and how to integrate the channel with LkSG complaints procedures and compliance investigations.

Who must set up an internal reporting channel

Headcount includes all employees regardless of working time. Employees of different group companies are counted per employer, not per group, so each legal entity with 50 or more employees needs access to an internal reporting channel.

What can be reported

The material scope in § 2 HinSchG covers breaches of criminal law, breaches subject to administrative fines where the provision serves to protect life, limb or health or the rights of employees or their representative bodies, and breaches of a long list of federal, state and EU rules, including on public procurement, financial services, money laundering, product safety, environmental protection, data protection, competition law and tax law for companies. Statements by civil servants that breach the duty of loyalty to the constitution are also covered. Reports outside this scope do not trigger the Act's protection, but companies often accept broader reports, for example on breaches of internal codes of conduct, for compliance purposes.

Designing the internal reporting channel

The reporting channels must allow reports in writing or orally, and, at the request of the whistleblower, an in-person meeting within a reasonable time (§ 16(3) HinSchG). Only the persons responsible for receiving and processing reports, and those supporting them, may have access to incoming reports (§ 16(2) HinSchG). The internal reporting office should also process anonymous reports, but there is no obligation to design channels that allow anonymous reporting (§ 16(1) HinSchG). In practice, many companies use web-based systems that allow anonymous two-way communication, which increases trust and simplifies follow-up.

The channel must be open to employees and temporary agency workers and may be opened to other persons in contact with the employer through their professional activities, such as suppliers' staff or self-employed contractors. Opening the channel to external persons is useful where the same system also serves as the complaints procedure under the Supply Chain Due Diligence Act (LkSG).

Handling reports: deadlines and follow-up

Under § 17 HinSchG, the internal reporting office must:

1. acknowledge receipt of a report within seven days;
2. check whether the reported breach falls within the material scope of the Act;
3. maintain contact with the whistleblower;
4. check the validity of the report;
5. request further information if necessary; and
6. take appropriate follow-up measures under § 18 HinSchG, such as internal investigations, referral to a competent authority or closure of the procedure.

Feedback must be given within three months of the acknowledgment, or within three months and seven days of receipt if no acknowledgment was sent. Feedback includes planned and completed follow-up measures and the reasons for them, but only to the extent that internal enquiries or investigations and the rights of persons named in the report are not affected.

Confidentiality and documentation

The identity of the whistleblower, the persons named in the report and other persons mentioned must be kept confidential (§ 8 HinSchG), with exceptions, for example where disclosure is required in criminal proceedings or the whistleblower intentionally or grossly negligently reports false information. Reports must be documented in a permanently retrievable manner, respecting confidentiality; telephone reports may be recorded verbatim only with consent, otherwise a summary of content must be prepared (§ 11(2) HinSchG). Documentation is deleted three years after the procedure is concluded, unless longer retention is necessary and proportionate to meet legal requirements (§ 11(5) HinSchG).

Outsourcing and group-wide channels

Under § 14(1) HinSchG, employers can entrust the tasks of the internal reporting office to a person or unit within the company, or to a third party, for example an external lawyer acting as ombudsperson or a specialised service provider. Entrusting a third party does not release the employer from the duty to take appropriate measures to remedy a breach. Employers with 50 to 249 employees can establish a shared reporting office, while responsibility for remedial action and feedback remains with each employer (§ 14(2) HinSchG).

Many groups operate a central internal reporting channel at parent level. According to the explanatory memorandum to the HinSchG, a group company may be treated as a third party within the meaning of § 14(1), so that a central office can serve subsidiaries, provided that each subsidiary remains responsible for remedial action and that reports can be made in the language commonly used in the subsidiary. The European Commission has expressed a stricter view on group solutions for medium-sized subsidiaries, so many groups combine a central system with local access points or local responsible persons.

Independence, competence and resources

The persons entrusted with the internal reporting office must be independent in performing this task and have the necessary expertise (§ 15 HinSchG). They may perform other tasks, provided these do not create conflicts of interest. In practice, compliance officers, legal counsel or internal audit staff often run the office, supported by external ombudspersons. Employers must provide sufficient resources, including training, budget and access to investigation support. A channel that exists on paper but is not staffed adequately does not meet the legal requirements and undermines trust.

Protection against retaliation and fines

Retaliation against whistleblowers, including threats and attempts, is prohibited (§ 36(1) HinSchG). If a whistleblower suffers a disadvantage in connection with their professional activity and claims it resulted from a report, it is presumed to be retaliation, and the employer must prove that the measure was based on sufficiently justified other grounds (§ 36(2) HinSchG). Breaches can lead to damages claims.

Under § 40 HinSchG, fines of up to EUR 50,000 apply to obstructing reports, retaliation and breaches of confidentiality, up to EUR 20,000 to failing to set up and operate an internal reporting channel and to knowingly reporting false information, and up to EUR 10,000 in other cases. For companies, § 30(2) sentence 3 of the Administrative Offences Act applies in the specified cases, which allows a tenfold increase of the maximum fine.

From report to investigation

Many reports require an internal investigation. The reporting office should have a defined process for triage: is the report within scope, how serious and urgent is it, are there risks to evidence or to persons, and who should investigate? Conflicts of interest must be excluded; reports concerning senior management should be escalated to the supervisory board or an independent body. Investigations triggered by reports must respect the confidentiality of the whistleblower, which can limit how facts are put to the persons concerned. Clear rules for sharing information between the reporting office, investigators, HR and management prevent breaches of § 8 HinSchG.

Regular reporting to management and the supervisory board, in anonymised form, helps to identify patterns and shows that the system is taken seriously. Metrics such as the number of reports, categories, processing times and outcomes are useful indicators of effectiveness.

Works council and data protection

Introducing a reporting system can trigger works council co-determination, in particular where the system involves rules of conduct for employees (§ 87(1) no. 1 of the Works Constitution Act) or technical devices capable of monitoring employees (§ 87(1) no. 6). Many employers conclude a works agreement covering the channel, the investigation process and data protection. Processing of personal data in the channel must comply with the GDPR; a data protection impact assessment is often advisable, and information duties towards persons named in reports may be restricted temporarily to protect confidentiality and investigations.

Integration with the LkSG complaints procedure

Companies subject to the Supply Chain Due Diligence Act must also operate a complaints procedure for human rights and environmental risks in their supply chains. Using one system for both purposes is efficient, provided that it is open to external persons, available in relevant languages and governed by rules of procedure that reflect both laws. Case handlers should be trained to recognise whether a report falls under the HinSchG, the LkSG or both, because deadlines, confidentiality rules and follow-up obligations differ in detail.

Illustration: a hypothetical German mechanical engineering group with twelve subsidiaries, five of which have between 50 and 249 employees, sets up a central web-based internal reporting channel operated by the parent's compliance department with an external ombudsperson as an alternative contact. Each subsidiary appoints a local responsible person for remedial action, publishes information in local languages and documents its own follow-up. The system also serves as the LkSG complaints procedure and is open to suppliers' employees.

How TRW & Co helps with an internal reporting channel

We advise employers on setting up and running reporting channels under the HinSchG. We design processes and policies, assess outsourcing and group-wide models, act as external ombudspersons where appropriate, train case handlers and conduct follow-up investigations. We also integrate the channel with LkSG complaints procedures, data protection requirements and works council participation. Our work connects with our whistleblowing and internal investigations practices. See also whistleblower retaliation and the burden of proof and complaints procedures under the LkSG. To review your channel, contact us.