HR & Verbraucher10 September 2026·8 min read

German Whistleblower Protection Act: set up an internal reporting channel in 5 steps

From 50 employees, an internal reporting channel is mandatory. What the HinSchG requires, which feedback deadlines apply, and how to set up a reporting office that works in practice.

Who the HinSchG obliges

The German Whistleblower Protection Act (HinSchG) implements the EU Whistleblower Directive and requires companies with 50 or more employees to set up an internal reporting office. For certain sectors, such as financial services, the obligation applies regardless of headcount. Companies without a reporting channel risk a fine and also lose the chance to resolve reports internally before they end up with the external reporting office at the Federal Office of Justice.

Step 1: Assign responsibility

Appoint an independent person or unit to run the reporting office: an internal compliance function, an ombudsperson lawyer, or an external service provider. What matters is that the person can work independently and has no conflicts of interest. Several group companies may share a joint reporting office.

Step 2: Open the reporting channels

The channel must allow reports in text form and orally, and, if the whistleblower requests it, also in a face-to-face meeting. In practice, a combination of a digital reporting system and a phone option works well. You are not strictly required to enable anonymous reports, but you should process them if they come in.

Step 3: Define deadlines and process

Confirm receipt to the whistleblower within 7 days at the latest.
Provide feedback on follow-up measures taken within 3 months at the latest.
Keep the identity of the whistleblower and affected third parties confidential.
Document each report; deletion is generally due 3 years after the case is closed.

Step 4: Take the ban on retaliation seriously

The HinSchG prohibits any disadvantage for whistleblowers, from dismissal to a withheld promotion. If a dispute arises, the burden of proof is reversed: the company must show that a measure had nothing to do with the report. Train managers accordingly before the first case lands on your desk.

Step 5: Inform the workforce

The reporting office only works if it is known and trusted. Publish clear information about the channel, responsibilities and process on the intranet and in your privacy policy. Anyone who wants to anonymise a report before sending it can strip documents of metadata and real names with the Whistleblower Sanitizer.

Matching tool

Operate a HinSchG-compliant reporting channel.

Set up your reporting channel →

Frequently asked questions

From how many employees is a reporting channel mandatory?

The internal reporting office is mandatory from 50 employees. For certain financial-sector companies, the obligation applies regardless of headcount. Below the threshold, a reporting channel remains voluntary, but it builds trust and keeps reports in-house.

Which deadlines apply to the reporting office?

The reporting office must confirm receipt of a report within 7 days and give the whistleblower feedback on planned or implemented follow-up measures within 3 months.

Do anonymous reports have to be possible?

The HinSchG does not oblige companies to set up anonymous reporting channels. If anonymous reports do come in, however, they should be processed. Many companies enable anonymity voluntarily because it significantly increases willingness to report.

What fines apply without a reporting office?

Companies that fail to set up a mandatory internal reporting office risk a fine of up to 20,000 euros. Retaliation against whistleblowers is far more expensive: fines of up to 50,000 euros plus damages claims are possible.

Cybersicherheit

The 7 most expensive compliance mistakes made by German SMEs

From the missing LUCID registration to the late data breach notification: these seven omissions regularly cost mid-sized companies five- to seven-figure sums.

HR & Verbraucher

Pay transparency: How to prepare for the reporting obligation

What the EU directive specifically requires and how to spot an unexplained pay gap in time.