Whistleblower Protection Check
Is your reporting channel legally sound?
20 questions, 5 categories, 3 minutes. Check whether your internal reporting channel meets the requirements of the German Whistleblower Protection Act.
Is your internal reporting channel legally sound?
The German Whistleblower Protection Act (HinSchG) implements the EU Whistleblowing Directive and has applied since July 2023. It asks for more than a letterbox or an e-mail address: you need a defined process, assured confidentiality, deadlines that are kept, and documentation that stands up to review. The check above looks at exactly these points.
Who has to set up an internal reporting channel?
| Company size | Duty |
|---|---|
| 250 employees and above | since the Act came into force in July 2023 |
| 50 to 249 employees | since December 2023 |
| fewer than 50 employees | no duty in principle — exceptions apply, for example to financial service providers regardless of size |
Companies with 50 to 249 employees may run a shared reporting channel together with other companies — a practical relief that many are unaware of.
A common misconception: “We have an e-mail address, that will do.” It will not. The law requires that the confidentiality of the identity is preserved — and with an ordinary mailbox half the IT department often has access. On top of that, deadlines have to be demonstrably met and reports documented. Without a system, neither is easy to show.
The duties in detail
Deadlines that run
- 7 days — acknowledgement of receipt to the person reporting.
- 3 months — feedback on the follow-up taken or planned.
Both deadlines are hard and run from the moment the report arrives — even if the responsible person is on holiday.
Confidentiality and the ban on retaliation
As a rule, the identity of the person reporting may be known only to those responsible for handling the case. Equally central is the ban on retaliation: disadvantaging someone because of a report is prohibited. And there is a reversal of the burden of proof — if a reporter suffers a disadvantage after reporting, it is the company that must prove it had nothing to do with the report. Without clean documentation, that proof is hard to produce.
Anonymous reports
The Act provides that anonymous reports should be processed. On the wording there is no duty to provide anonymous channels technically — but in practice it is strongly advisable: anonymity markedly increases willingness to report and stops people turning to outside bodies or the press instead.
How to read your result
- Not compliant — there is no reporting channel, or no defined process. That is immediately relevant to a fine and easy to establish.
- Partly implemented — a channel exists, but confidentiality, deadline management or documentation will not bear weight. The typical state of affairs.
- Legally sound — process, deadlines and documentation are in place. What is left is usually communication to staff and training for those responsible.
The check is a self-assessment and is no substitute for legal advice.
Run it internally or externally?
The Act expressly allows you to entrust the tasks of the internal reporting channel to a third party. For most mid-sized companies that is the more pragmatic route: you get independence, assured confidentiality and dependable deadline management without having to build capacity and expertise in house. The responsibility stays with you — the handling does not.
Common questions about the HinSchG
From how many employees does the duty apply?
From 50 employees. For companies with 250 or more it has applied since July 2023, for those with 50 to 249 since December 2023. Certain sectors, such as financial services, are subject to special rules regardless of size.
Do we have to allow anonymous reports?
Anonymous reports should be processed. The wording does not impose an express duty to offer anonymous channels technically. In practice it is nevertheless strongly advisable, because it increases willingness to report and keeps matters from being taken outside.
What fines are possible?
The ceiling is €50,000 — for obstructing a report, breaching confidentiality or retaliating, for example. For failing to set up a channel at all the ceiling is lower. The greater risk is usually not the fine but the damage to reputation and the reversed burden of proof in a dispute.
May the HR department run the reporting channel?
In principle yes, but those appointed must work independently and must have no conflict of interest. That is exactly where it often fails: reports frequently concern managers, or HR itself. Which is why many companies choose an external body.
How long do we have to keep documentation of reports?
As a rule documentation has to be deleted three years after the procedure closes; it may be kept longer as long as that is necessary and proportionate. What matters most is that it is kept completely and on time at all.
Can several companies share one reporting channel?
Yes — companies with 50 to 249 employees may share the resources of a joint reporting channel. Responsibility for meeting the duty stays with each company.
