Whistleblower Channel Checklist: HinSchG Compliance for Employers in Germany
The German Whistleblower Protection Act (HinSchG) obliges employers with, as a rule, at least 50 employees in Germany to run an internal reporting channel that protects the identity of whistleblowers. For international companies this is a classic hidden obligation: the duty attaches to the German workforce, and standard group hotlines often miss German specifics such as the statutory acknowledgment and feedback deadlines.
A compliant channel is more process than technology. Reports must be possible in writing or orally, handled by impartial and trained persons, acknowledged within seven days, and answered substantively within three months. Confidentiality must be safeguarded end to end — including metadata in submitted documents, which can betray an anonymous reporter's identity. The checklist below covers the setup in order.
Your checklist
- 1Confirm the threshold: count employees per German entity; at 50 or more, the internal channel duty under the HinSchG applies (some financial-sector firms are in scope regardless of headcount).
- 2Choose the channel model: internal case handlers, an external ombudsperson or provider, or a shared group resource — and verify the chosen model meets German requirements.
- 3Enable written and oral reporting: provide at least a written channel and a voice option, with an in-person meeting available on request.
- 4Appoint impartial case handlers: designate trained persons free of conflicts of interest and give them authority to follow up on reports.
- 5Protect confidentiality technically: restrict access to reports, and strip metadata from submitted files so anonymous reporters cannot be identified from documents.
- 6Implement the statutory deadlines: acknowledge receipt within 7 days and give the reporter substantive feedback within 3 months — build both into the workflow with reminders.
- 7Document processing compliantly: keep records of each report in line with the HinSchG retention and deletion rules and the GDPR.
- 8Communicate the channel: publish clear, accessible information for employees (in German and English where relevant) on how to report and what protections apply.
- 9Train managers on the retaliation ban: ensure HR and line managers understand the reversed burden of proof before any measure affecting a known reporter.
Frequently asked questions
Can our group-wide hotline serve as the German whistleblower channel?
Only with care. Companies with up to 249 employees may share reporting-channel resources, but German guidance expects larger entities to maintain their own channel, and any solution must meet HinSchG standards on confidentiality, deadlines, and follow-up. Many groups keep the global hotline and add a German-compliant layer on top.
Do we have to accept anonymous reports?
The internal channel should also allow anonymous reports to be submitted and processed. Independently of the legal minimum, accepting anonymity is widely regarded as best practice — reporters who fear exposure will otherwise go external, which is the outcome the internal channel exists to avoid.
What deadlines apply once a report comes in?
Receipt must be confirmed to the reporter within seven days, and within three months the reporter must receive feedback on the follow-up action taken or planned. Both deadlines should be tracked per case; missing them undermines the channel's legal effect and the reporter's trust.