What it's about
The Hinweisgeberschutzgesetz (HinSchG, Whistleblower Protection Act) implements the EU Whistleblowing Directive. It protects people who obtain and report information about breaches in a work-related context — against dismissal, warnings, transfer, bullying or other forms of disadvantage. Protection covers employees, temporary agency workers, applicants, interns, self-employed people, shareholders and suppliers.
Who must set up a reporting office?
| Employees | Obligation |
|---|---|
| 250 or more | Internal reporting office required since 2 July 2023 |
| 50 to 249 | Internal reporting office required since 17 December 2023; a shared office run by several companies is permitted |
| Under 50 | No obligation — exceptions apply, for instance in the financial sector, regardless of size |
Which breaches are covered
The material scope covers criminal offences, certain breaches subject to fines that protect life, limb, health or employee rights, as well as breaches of numerous EU legal acts — for example in the areas of public procurement, product safety, environmental protection, data protection, consumer protection and money laundering. Purely employment-law conflicts without an underlying breach of law are not covered.
Requirements for the internal reporting office
- Reports must be possible verbally, in writing and, on request, in person.
- Anonymous reports should be processed; there is, however, no obligation to offer an anonymous reporting channel.
- Acknowledgement of receipt within seven days.
- Feedback on measures taken within three months.
- Confidentiality of the identity of the whistleblower and of the persons concerned.
- Documentation of all reports, generally retained for three years.
- Independence and expertise of the responsible persons; conflicts of interest must be avoided.
External reporting offices
Whistleblowers are free to choose whether to report internally or externally. External offices include the Federal Office of Justice (Bundesamt für Justiz) and, for certain areas, BaFin (the Federal Financial Supervisory Authority) and the Federal Cartel Office. Public disclosure is protected only under narrow conditions.
Reversal of the burden of proof and sanctions
If a whistleblower suffers a disadvantage after making a report, it is presumed to be retaliation — the employer must prove the opposite. Fines of up to €50,000 can be imposed for obstructing reports or breaching confidentiality; failing to set up a reporting office can be penalised with a fine of up to €20,000.
Implementation in five steps
- Determine headcount and whether the obligation applies.
- Define reporting channels and implement them technically.
- Draft procedural rules: responsibilities, deadlines, escalation, documentation.
- Involve the works council and review data protection implications.
- Provide staff with demonstrable information and training.
Informing the workforce should be documented. A notice on the board alone is rarely sufficient — a personal letter provides clearer evidence.