Show contents
Germany’s Whistleblower Protection Act (Hinweisgeberschutzgesetz, HinSchG) requires many employers to operate an internal reporting office. The reporting channel is only one part of that duty. Someone must receive reports confidentially, assess whether they fall within the Act, document the process, take appropriate follow-up action and respond to the reporting person within the statutory time limits.
The Act has applied since 2 July 2023. The transitional deadline for private employers with normally 50 to 249 employees ended on 17 December 2023. Those dates are historical milestones, not future implementation deadlines. The rules below concern Germany; obligations in other EU countries depend on their national laws.
Who needs an internal reporting office?
Under section 12 HinSchG, employers with normally at least 50 employees must establish and operate an internal reporting office. Certain regulated employers listed in section 12(3) must do so regardless of their workforce size. For municipalities, municipal associations and employers they own or control, the obligation is determined under the relevant state law. A simple “under 50 employees means exempt” rule is therefore unsafe.
Private employers with normally 50 to 249 employees may operate a joint office for receiving reports and other statutory measures. Each employer still remains responsible for remedying breaches and providing feedback where required. An employer may also entrust a third party with the internal office’s tasks; section 14 does not transfer the employer’s responsibility for suitable remedial action to that provider.
Before buying a tool or outsourcing a service, establish which legal entity is the employer, how many people it normally employs, whether a sector-specific exception applies and, for a municipal body, what its state law requires.
What must the reporting channel make possible?
Section 16 HinSchG requires reports in text form or orally. Oral reporting must be possible by telephone or another voice-transmission method. On request, the reporting person must also be offered a meeting within a reasonable time. Access to incoming reports must be limited to those responsible for receiving and processing them and people assisting with those tasks.
Internal reporting offices should also process reports received anonymously. The Act does not, however, impose a general duty to design the channel so that anonymous submissions are possible. Whether to offer that option is a separate design decision, not a substitute for confidentiality controls.
What happens after a report arrives?
The internal office must confirm receipt within seven days. It then checks whether the matter falls within the Act, maintains contact with the reporting person, assesses the report, requests further information where necessary and takes appropriate follow-up measures. Section 17 HinSchG requires feedback within three months of the receipt confirmation. If no confirmation was sent, the outer limit is three months and seven days after receipt. Feedback must not compromise investigations or the rights of people named in the report.
Follow-up does not always mean an internal investigation. Depending on the facts, section 18 allows the office to investigate, refer the reporting person to another competent body, close a case for lack of evidence or pass it to a competent internal unit or authority. The reasons and decision path should remain traceable.
Confidentiality, documentation and protection
The identities of reporting persons and people named in a report are protected under the statutory confidentiality rules. Incoming reports must be documented in a permanently retrievable form while respecting confidentiality. Section 11 HinSchG sets conditions for recording oral reports and generally requires the documentation to be deleted three years after the procedure closes; longer retention is possible only where necessary and proportionate under the Act or other law. A workflow should therefore record the closure date and review any retention exception rather than keep every case indefinitely.
Section 36 prohibits reprisals, including threats and attempts. Protection depends on the statutory conditions; it is not a blanket assurance that every allegation or form of public disclosure is covered. Employers should train the people handling reports to avoid conflicts of interest and to separate fact-finding from decisions about affected employees.
A practical setup sequence
- Determine which legal entities must operate an office and document the applicable threshold or exception.
- Appoint an independent, competent reporting-office team or a suitable third party; define substitute arrangements and access rights.
- Offer compliant text and oral channels, with a process for requested meetings. Decide deliberately whether anonymous submission will be supported.
- Define how receipt, scope check, communication, follow-up, feedback and closure will be recorded without exposing identities unnecessarily.
- Set reminders for the statutory response periods and a retention review after closure.
- Tell employees clearly how to use the internal channel and where to find information about external reporting routes.
- Test the process with a fictional report. Verify that only authorised people can see it and that the office can provide feedback without disclosing confidential information.
An internal reporting office is a continuing responsibility, not a one-off form. If your organisation wants to discuss how reporting, responsibilities and documentation fit into its existing compliance work, see Robin Data’s whistleblower-protection application or book a discovery call.
Legal sources checked on 14 October 2026. This overview does not replace an assessment of the organisation, sector and applicable state law.