Internal Reporting Office (Section 12 HinSchG)

Obligation to set up a whistleblower reporting office from 50 employees

26 April 2026 · Category: HinSchG · Compliance-Kit

TL;DR

An internal reporting office under § 12 of the German Whistleblower Protection Act (HinSchG) is the organisational unit of a company that receives and processes reports of breaches. Mandatory for all employers with ≥50 employees. Sector-specific special rules (banks, insurers): irrespective of size. Three mandatory reporting channels: in writing, orally, and in person on request.

What is an Internal Reporting Office (Section 12 HinSchG)?

Under §§ 13-15 HinSchG, the internal reporting office must provide:

Availability of all three channels (in writing, orally, in person)
Anonymous reports received should be processed (§ 16(1) sentence 4 HinSchG, a 'should' provision) — there is expressly no obligation to provide anonymous reporting channels (§ 16(1) sentence 5)
Acknowledgement of receipt within 7 days
Feedback within 3 months
Confidentiality (§ 8) — protection of identity, including within a group of companies
Prohibition of reprisals (§ 36) for all whistleblowers
Expertise of the reporting office officer (§ 15(2))

Note: § 22 HinSchG governs the external reporting office at the Federal Cartel Office (competition law/DMA), not an audit obligation for companies. An annual self-assessment of the effectiveness of the internal reporting office is best practice (NOT a statutory obligation), see Audit Obligation (HinSchG) — clarification.

Legal position in Germany and Austria

In both countries the internal reporting office is based on the EU Whistleblower Directive (EU) 2019/1937, but is implemented nationally in each case — in Germany through the HinSchG, in Austria through the Austrian Whistleblower Protection Act (HSchG). The deadlines are largely identical; the provisions and authorities differ.

Germany (HinSchG)

Obligation to set up an internal reporting office from, as a rule, 50 employees (§ 12(1) sentence 1, (2) HinSchG)
Acknowledgement of receipt within 7 days at the latest (§ 17(1) no. 1 HinSchG)
Feedback within 3 months (§ 17(2) HinSchG)
Confidentiality (§ 8), prohibition of reprisals (§ 36); fine of up to EUR 50,000 (§ 40 HinSchG)

Austria (HSchG)

Obligation to set up an internal office from 50 employees (§ 3(1), § 11(1) HSchG)
Procedure and impartiality of the internal office (§ 13 HSchG)
Acknowledgement of receipt within 7 calendar days at the latest (§ 9(1) HSchG)
Feedback no later than 3 months after receipt of the report (§ 13(9) HSchG)
The external office is the Federal Bureau of Anti-Corruption (BAK); administrative fine of up to EUR 20,000, and up to EUR 40,000 in the event of a repeat offence (§ 24 HSchG)

Practical example

Practical setup:

Reporting office officer appointed (letter of appointment)
Rules of procedure documented
Reporting channels: web form (in writing/anonymous), telephone hotline, e-mail address
Training of the reporting office officer under § 15(2) (8 teaching units is typical)
DPIA + entry in the record of processing activities for the processing
Notice board/intranet information for the workforce

Frequently asked questions

Does each company in a group need its own reporting office?

In principle yes (per legal entity). § 14 HinSchG permits a group reporting office as an option, but the European Commission has criticised this. Practical recommendation: a hybrid model (group level + local contact points).

Is an e-mail address enough as a reporting channel?

Not sufficient. § 16 requires three types of channel: in writing, orally (telephone/voice message), and in person on request. Anonymous reports received should indeed be processed (§ 16(1) sentence 4), but there is no obligation to provide anonymous reporting channels (§ 16(1) sentence 5).

What does an internal reporting office cost?

SaaS: EUR 1,200-6,000 per year. External ombudsperson: EUR 5,000-25,000 per year. Compliance-Kit HinSchG Kit: a one-off EUR 390-990 — all templates, no subscription.