HinSchG · 2023 · whistleblowing

A whistleblowing channel for companies with 50 or more staff — confidential, on time and documented

We set up your internal reporting channel, or run it for you as an external provider — with a secure channel, deadline management, documentation, reporting and clear processes.

  • An outsourced internal reporting channel from 99 €/month
  • Full-service setup from 1,490 €
  • 7 days to acknowledge receipt · 3 months to report back
  • Anonymous reports possible on request
  • 30 minutes assessment
Book a free appointment Send a short enquiry
notivia since 2003· +50 ISMS clients*· +20 Full-service projects*· Reporting channel from 99 €/month· ★★★★★5.0

* Audit success relates to completed full-service certification projects since 2019.

Quick check

This page is for you if …

  • … you want to prepare for 50 or more staff (the HinSchG duty).
  • … you have to set up or run an internal reporting channel .
  • … you want to prepare for to protect whistleblowers properly .
  • … you want to respond to reports in a structured way and on time .
  • … you want to know what HinSchG compliance costs and how long it takes.
Our services for the HinSchG

Three routes to HinSchG compliance

From running the channel for you, through the full-service setup, to doing it yourself in the platform. Optional: an annual function test of the channel from 290 €/year

Ongoing

An outsourced internal reporting channel

Entry price

We run your internal reporting channel as a neutral external provider — with a confidential channel, deadline management, documentation and reporting.

This suits you if you want to outsource running the channel and handling the cases.
  • A 24/7 channel (web + telephone)
  • Anonymous & pseudonymous reports
  • Receipt acknowledged within 7 days, feedback within 3 months
  • Annual reporting for the management board
from €99 / month
Enquire about consulting
12-month minimum term · 3 months' notice
Maximum support

Full-service support

We set your HinSchG channel up completely: the policy, the processes, the communication, the training and the platform.

This suits you if you want a HinSchG channel set up with as little internal project load as possible.
  • Channel setup with the platform
  • An internal policy for the channel
  • Training for managers
  • Process documentation
from €750 one-off · M from 1,490 € · L from 2,500 €
Request a quote
Self-service

Build it yourself

Build HinSchG compliance yourself — the ISMS platform takes you through the requirements step by step.

  • The guide shows the next step
  • AI produces your documents
  • 800+ templates to build on
  • Support can be added at any time
from€249/ month · cancellable monthly
See the self-service option

Additionally for the HinSchG

Standard-specific extras — bookable individually

Training for managers

The mandatory training on reporting channels and staff protection.

from €490

Function test of the channel

An annual test of your channel for availability and response time.

from €290/year

Escalation advice on complex cases

An assessment, a proposed course of action and coordination with legal counsel where needed.

from €190/hour
Retainer services (external officer, reporting channel): 12-month minimum term · 3 months' notice to the end of the month · all prices exclude VAT.
Free initial assessment

Whistleblower protection in 2–4 weeks

Which reporting system fits? What do you have to put in place? A personal assessment, with no sales pressure.

Lead consultant
Lead consultant
Your contact
  • A quick answer
  • Realistic figures for time and cost
  • No sales pressure, no obligation
  • From notivia GmbH, Stuttgart — since 2019
think why NETFORMIC Animus Intelligence Crest Digital Veoma VERDURE
Book directly — the quickest way
Pick a 30-minute slot yourself
or send us a message

    No spam·No obligation·A quick answer·GDPR-compliant
    Prefer to call? +49 711 35 15 705
    Start on your own

    Two tools — ready to use right now

    Before you get in touch: work out the cost and explore the platform — free and without obligation.

    Free whistleblowing check · 3 min

    Is your reporting channel compliant?

    10 questions on the reporting channel, confidentiality, deadlines and the ban on retaliation. See where you stand in 3 minutes.

    Start the check

    Or do it yourself

    The ISMS platform with its reporting-channel module

    The multi-standard ISMS digitalises taking in reports, handling the cases, tracking the deadlines and reporting — made for internal teams that want to implement the HinSchG in a structured way.

    Explore the platform
    Guide · PDF

    Whistleblowing guide for mid-sized companies

    What the law requires, what a compliant reporting channel looks like, which deadlines apply — explained plainly.

    Download the guide
    The act in brief

    What has to be in place for the ISO 27001?

    Eight building blocks — the mandatory set for a compliant reporting channel.

    1. Set up the internal channel (Section 12)
    2. Confidentiality & data protection (Sections 8, 9)
    3. Acknowledge receipt within 7 days (Section 17)
    4. Follow-up & feedback (3 months, Section 17)
    5. Protection from retaliation (Section 36)
    6. Informing staff (Section 13)
    7. Documentation & retention (Section 11)
    8. Training & awareness

    In the initial call we show you which points you already meet.

    Book a free initial assessment
    WHO IS IN SCOPE?

    Does your company need a reporting channel?

    Whether you must set up an internal channel depends on how many people you employ.

    250+
    Employees

    Since 2 July 2023

    Companies with 250 or more employees have had to run an internal channel since then.

    Required now
    50+
    Employees

    Since 17 December 2023

    Companies from 50 employees must also have an internal channel in place.

    Required now

    Also in scope, whatever their size:

    • Investment firms and asset management companies
    • Insurers and credit institutions
    • Companies working in anti-money-laundering
    • Listed companies
    REPORTING CHANNELS

    Three routes for whistleblowers

    The HinSchG sets out a three-tier system — the internal route comes first.

    Internal channel

    The preferred route: a report through the company's own internal channel. It can be made in writing, verbally or in person.

    External channel

    A report to the federal external channel at the Federal Office of Justice (BfJ) or to a sector body (BaFin, BKartA).

    Public disclosure

    Only as a last resort: public disclosure, where no channel responded within the deadline.

    CORE REQUIREMENTS

    What the HinSchG asks of you

    The main duties for employers

    Set up an internal channel (Section 12)

    Offer written, verbal and in-person ways to report. It may be run internally or by a third party.

    Independent channel officers (Section 15)

    The people handling reports must be independent and free of conflicts of interest.

    Preserve confidentiality (Section 8)

    The whistleblower's identity must be kept confidential. It may only be passed on in exceptional cases.

    Meet the deadlines (Section 17)

    Acknowledge receipt within 7 days. Report back on the action taken within 3 months.

    Documentation (Section 11)

    Every report must be documented and kept for 3 years after the case is closed.

    Ban on retaliation (Section 36)

    Whistleblowers must not be put at a disadvantage: no dismissal, warning, transfer or other reprisal.

    Fines of up to €20,000 / €50,000

    Up to €20,000 where no channel exists · up to €50,000 for obstruction, retaliation or breach of confidentiality.

    Liability for damages

    Whistleblowers are entitled to damages where they are retaliated against — with the burden of proof reversed in their favour.

    THE REPORTING PROCESS

    From the report to the action

    1
    Receipt

    A report comes in

    The whistleblower reports a breach through the internal channel — in writing, verbally or in person.

    2
    Within 7 days

    Acknowledge receipt

    The channel confirms receipt and explains what happens next.

    3
    Review

    Check whether it holds up

    The channel officers check whether the report holds up and start follow-up action where needed.

    4
    Within 3 months

    Report back to the whistleblower

    Information on the action taken or planned, with the reasons for the decision.

    5
    Closure

    Documentation & archiving

    Complete documentation of the case, kept for 3 years after it is closed.

    OVERLAP

    HinSchG & the ISMS — stronger together

    An ISO 27001 ISMS provides the infrastructure the HinSchG needs for secure and confidential reporting channels.

    HinSchG requirementCovered by the ISMS
    Section 8 confidentiality ISO 27001 A.5.9–A.5.14 classification
    Section 11 documentation ISO 27001 cl. 7.5 documented information
    Section 12 a secure channel ISO 27001 A.8 technical controls
    Section 15 access control ISO 27001 A.8.1–A.8.5 access management
    Section 17 deadline management ISO 27001 A.5.24–A.5.28 incident management
    ~40 %
    of the infrastructure is shared between the ISMS and the HinSchG
    OUR SOLUTION

    Implementing the HinSchG with iso-easy

    1

    Take stock

    Reviewing the ways people can already report and analysing what the HinSchG requires.

    2

    Set up the channel

    Setting up a secure, confidential channel — with processes for written and verbal reports.

    3

    Processes & training

    Defining how cases are handled, appointing the channel officers and training them.

    4

    Operation & reporting

    Day-to-day operation with deadline management, documentation and regular reporting.

    A digital channel Anonymous reports Deadline management Case management Documentation Reporting
    FAQ

    Frequently asked questions about the HinSchG

    What is the Hinweisgeberschutzgesetz?
    The HinSchG (the German Whistleblower Protection Act) transposes the EU whistleblowing directive (2019/1937) into German law. It protects people who report legal breaches in their working environment from retaliation, and obliges companies to set up secure reporting channels.
    What can be reported?
    Breaches of EU and German law, among them criminal offences, regulatory offences and breaches of consumer protection, data protection, IT security, environmental law, anti-money-laundering, product safety, procurement law and many further areas.
    Does the channel have to allow anonymous reports?
    The HinSchG does not strictly require it, but it recommends accepting and handling anonymous reports too. In practice the option of reporting anonymously markedly increases use of the channel.
    Can I outsource the channel?
    Yes. The HinSchG allows a third party to be engaged to run the internal channel (Section 14). Responsibility stays with the company. Groups may also run one shared channel for all their entities.
    How does the HinSchG relate to the ISMS?
    An ISMS provides the technical and organisational infrastructure a secure channel needs: encryption, access control, documentation and incident management. Our multi-standard platform builds whistleblower protection straight into the ISMS.
    What happens if I have no reporting channel?
    Fines of up to €20,000 where no channel exists, and up to €50,000 for obstruction, retaliation or a breach of confidentiality. Beyond that, whistleblowers can go straight to the external channel or to the public — without giving you the chance to sort the matter out internally.
    How much internal work does this really mean for us?
    Setting the HinSchG up from scratch the conventional way swallows 15–30 person-days of internal time (building the channel, documenting the procedure, informing staff, training). With our approach plus the ISMS platform we bring that down to 5–10 person-days — because we set up most of the procedure templates, the training decks and the documentation templates for you.
    Must we run the channel ourselves, or can it be external?
    Both are allowed under Section 14 HinSchG. An internal channel: one of your own staff, bound to confidentiality — cheaper, but with a risk of conflicts of interest. An external channel: a third party (iso-easy as your external channel officer, from €99/month, for example) — better accepted, more trusted, clearly a third party. For groups we recommend the external option.
    How high are the penalties for breaching the HinSchG?
    Where the channel is missing or inadequate: fines of up to 20,000 € (Section 40 HinSchG). For obstructing whistleblowers or retaliating: up to 50,000 €. On top of that, damages to the whistleblowers affected. The fine risk is modest, but the reputational risk in a scandal is high.
    Who can be appointed as the internal channel officer?
    Suitable are people with a duty of confidentiality and no conflict of interest — typically the compliance officer, the data protection officer, in-house counsel or possibly the head of HR. Not suitable: the managing directors (too close to day-to-day business) or the whistleblower's own manager. For mid-sized companies without a compliance function the external option is often the more workable one.
    Can we outsource the channel?
    Yes, explicitly allowed under Section 14(1) HinSchG. External providers like us take on availability, acknowledging receipt within 7 days, the first legal review, passing the case to you and the three-month feedback to the whistleblower — all confidential and compliant with the act.