Internal Reporting Office (Section 12 HinSchG)

Mandatory whistleblower reporting office for 50 or more employees

26 April 2026 · Category: HinSchG · Compliance-Kit

Practitioner's note: This article is practice-oriented compliance documentation, not legal advice. We are a compliance specialist, not a law firm. For legally binding information please consult a licensed lawyer.

TL;DR

An internal reporting office under Section 12 of the German Whistleblower Protection Act (HinSchG) is the organizational unit of a company that receives and processes reports of violations. Mandatory for all employers with 50 or more employees. Sector-specific rules (banks, insurers) apply regardless of size. Three mandatory reporting channels: in writing, orally, and in person on request.

What is the Internal Reporting Office (Section 12 HinSchG)?

Under Sections 13-15 HinSchG, the internal reporting office must:

Make all three channels available (written, oral, in person)
Process anonymous reports — mandatory since 01.01.2025 (Section 16 (1) sentences 4-6)
Acknowledge receipt within 7 days
Provide feedback within 3 months
Maintain confidentiality (Section 8) — identity protection also within the corporate group
Enforce the prohibition of retaliation (Section 36) for all whistleblowers
Ensure the expertise of the reporting office officer (Section 15 (2))

Note: Section 22 HinSchG governs the external reporting office at the Federal Cartel Office (competition law / DMA) and not an audit obligation for companies. An annual effectiveness self-review of the internal reporting office is best practice (NOT a statutory obligation); see Audit Obligation (HinSchG) — clarification.

Practical example

Practical setup: - Reporting office officer appointed (letter of appointment) - Rules of procedure documented - Reporting channels: web form (written/anonymous), telephone hotline, email address - Training of the reporting office officer pursuant to Section 15 (2) (typically 8 teaching units) - DPIA and ROPA entry for the processing - Notice/intranet information for the workforce

Frequently asked questions

Must group companies each maintain their own reporting office?

In principle, yes (separate legal entity). Section 14 HinSchG permits a group-level reporting office as an option, but the European Commission objects to this. Recommended practice: hybrid model (group plus local contact points).

Is an email address alone sufficient as a reporting channel?

Not sufficient. Section 16 requires three channel types: in writing, orally (telephone/voicemail), and in person on request. Plus anonymous processing since 2025.

What does an internal reporting office cost?

SaaS: EUR 1,200-6,000 per year. External ombudsperson: EUR 5,000-25,000 per year. Compliance Kit HinSchG: one-time EUR 390-990 — all templates, no subscription.