HinSchG: Setting Up an Internal Reporting Office 2026

1. Mandatory from 50 employees

Short answer: § 12(2) HinSchG requires all employers with at least 50 employees to set up an internal reporting office. Headcount basis — no full-time equivalents.

The substance of the obligation is set out in § 12(1) sentence 1 HinSchG: employers must ensure that at least one internal reporting office is set up and operated. The law therefore requires both: the setting up and the ongoing operation. The threshold in subsection 2 refers to "as a rule at least 50 employees". The basis in Union law is Art. 8 of Directive (EU) 2019/1937: paragraph 1 obliges legal entities in the private and the public sector to establish internal reporting channels and procedures, paragraph 3 sets the threshold for the private sector at 50 workers.

Obligation regardless of size: § 12(3) HinSchG

For the employers listed in § 12(3) HinSchG the obligation applies regardless of the number of employees. These include, among others, investment services firms, stock exchange operators, institutions under the German Banking Act and the German Investment Firm Act, capital management companies, insurance undertakings as well as crypto and payment institutions. Many of these houses are themselves SMEs — the 50-employee threshold does not help them. Check this list first before you count heads.

What happens without a reporting office

Anyone who does not set up and operate the office at all commits a regulatory offence: a fine of up to EUR 20,000 under § 40(2) no. 2 in conjunction with (6) HinSchG. The tenfold increase for legal persons under § 30(2) sentence 3 OWiG does not apply here, precisely because § 40(6) sentence 2 HinSchG expressly orders it only for § 40(2) no. 1 and 3 as well as (3) and (4).

What can be reported at all

Protection does not apply to every complaint, but only to the three categories of breach set out in § 2(1) no. 1 to 3 HinSchG (details in the FAQ). For the procedural rules, a documented assessment scheme is advisable for the question of whether an incoming report falls within the material scope — the documented scheme is a practice recommendation, not a statutory requirement. The answer determines protection against reprisals and follow-up measures.

2. 8 steps to an audit-proof reporting office

Short answer: Eight steps lead from the decision to an audit-proof reporting office — resolution, appointment, procedural rules, channels, expertise, data protection, workforce information, self-assessment. Each step names its source: the resolution and the appointment are the practice evidence for § 12(1) sentence 1 HinSchG, the annual self-assessment (step 8) is a practice recommendation without a statutory basis.

1. Management resolution: formal establishment of the reporting office. In practice: minutes of the managing directors or a board resolution. Why: the addressee of the obligation is the employer, not an individual department — § 12(1) sentence 1 HinSchG requires establishment and operation. In practice, the resolution is the first robust evidence that the office exists with a budget, responsibilities and deputising arrangements.
2. Appoint the reporting office officer: deed of appointment + declaration of independence. Also possible in personal union (compliance officer, in-house counsel). Why: under § 8(1) HinSchG, the identity of the whistleblower may only become known to the persons responsible for receiving reports and taking follow-up measures and to the persons supporting them. In practice, this group of persons should therefore be identified by name (practice recommendation, not a statutory requirement). Alternatively, the tasks may be transferred to a third party under § 14(1) sentence 1 HinSchG; the obligation to take appropriate measures to remedy a breach remains with the employer under sentence 2.
3. Document the procedural rules: 7-day receipt, 3-month feedback, escalation to the external reporting office (BfJ). Why: § 17(1) no. 1 and (2) HinSchG set both deadlines and the content of the feedback (planned as well as already taken follow-up measures and the reasons for them). The procedural rules should also reflect the whistleblower's right to choose under § 7(1) HinSchG and the prohibition of obstruction under § 7(2) HinSchG (set out in step 7).
4. Set up 3 reporting channels: written (email/web form), oral (telephone hotline), in person on request (only one form is mandatory — oral or text form, § 16(3) sentence 1 HinSchG — plus the meeting on request, sentence 3; three parallel channels are the practice standard). Anonymous reports "should" be handled by the reporting office (§ 16(1) sentence 4 HinSchG) — not an obligation, but a clear expectation of the legislator. Why: section 3 explains the scope of the obligation and the practice standard.
5. Expertise training for the reporting office officer: the necessary expertise under § 15(2) HinSchG, customarily 5-8 teaching units. With a certificate. Why: § 15(2) HinSchG only requires "the necessary expertise"; the point becomes audit-proof through dated evidence — for the content, see the FAQ.
6. DPIA + entry in the record of processing activities: processing activity 'reporting office' in the record of processing activities, carry out a DPIA under Art. 35 GDPR. Why: the DPIA must be carried out in advance (Art. 35(1) GDPR); in Austria it is dispensable under § 8(13) HSchG in conjunction with Art. 35(10) GDPR; the entry in the record of processing activities remains. Details in section 7.
7. Workforce information: notice/intranet under § 13 HinSchG with a clear explanation of the reporting routes. Why: anyone who does not know the routes reports externally or not at all. The information should expressly state that the choice between the internal and the external reporting office rests with the whistleblower alone (§ 7(1) HinSchG) — wording that can be read internally as a "mandatory route" touches on the prohibition of obstruction in § 7(2) HinSchG.
8. Effectiveness self-assessment: document annually (best practice, NOT a statutory obligation) — compliance with deadlines, confidentiality, handling of anonymous reports, training status. Why: a "HinSchG amendment 2026" with an audit obligation does not exist; § 22 HinSchG governs the external reporting office at the Federal Cartel Office for competition and DMA breaches. The annual cycle is a practice recommendation for management reporting (modelled on ISO 37301), not a legal obligation.

For Austrian sites: the eight steps can be adopted, the sources cannot — the HSchG applies, with the key figures from the Austria box in section 1. Deviating: in step 6 the DPIA is dispensed with (reasons given there), the entry in the record of processing activities remains; the escalation address is the BAK (§ 15(1) HSchG).

3. 3 reporting channels + handling of anonymous reports

Short answer: Only one form of reporting is mandatory — oral or text form (§ 16(3) sentence 1 HinSchG) — plus the physical meeting on request within a reasonable time (sentence 3); the law does not provide for a fixed 14-day deadline. The reporting office should handle anonymous reports (§ 16(1) sentence 4), whereas opening the channels for anonymous submission is not mandatory (sentence 5). The table shows which arrangement per channel is mandatory and which is the practice standard.

In this respect the employer has a right to choose: text form and oral form do not have to be provided in parallel. With the whistleblower's consent, the physical meeting may also take place by video and audio transmission (§ 16(3) sentence 4 HinSchG). Anyone who makes a channel effectively unusable (voicemail without a call-back, a form behind the employee login) risks the accusation of having obstructed a report — prohibited under § 7(2) HinSchG.

Clarification on the cut-off date: there is no statutory cut-off date for an "anonymity obligation". The transitional provision in § 42 HinSchG concerns exclusively the deadline for setting up the office for employers with 50 to 249 employees (17 December 2023) as well as the applicability of § 40(2) no. 2 (1 December 2023). The frequently cited date of 1 January 2025 comes from an earlier draft bill that did not become law.

Practice recommendation (not a statutory obligation): define for each channel who checks incoming reports and when — a mailbox without a named deputy breaches the 7-day deadline of § 17(1) no. 1 HinSchG in the first week of holidays. A review on every working day with documented deputising arrangements has proven effective.

4. Procedure: 7 days / 3 months

Short answer: The HinSchG procedure has two hard deadlines: receipt of a report must be acknowledged within 7 days (with a confidentiality notice), and substantive feedback on follow-up measures or the discontinuation of the procedure must be given within 3 months. Where necessary, escalation to the management or the external reporting office (BfJ) follows.

The decisive point is the anchor for the deadline: under § 17(2) HinSchG, the three-month period runs from the acknowledgement of receipt — anyone who forgets the acknowledgement does not gain time but owes the feedback at the latest three months and seven days after receipt. In substance it covers planned as well as already taken follow-up measures and the reasons for them; in Union law this corresponds to Art. 9(1)(b) and (f) of Directive (EU) 2019/1937.

Before the 7-day deadline comes the documentation of receipt: date of receipt, channel, confidentiality level and the responsible reporting office officer belong in the report form — the documented date of receipt is the anchor for the 7-day deadline and, as long as no acknowledgement of receipt has been issued, also for the feedback deadline (§ 17(1) no. 1, (2) HinSchG).

Deadlines compared: Germany and Austria

The lengths of the deadlines for the acknowledgement of receipt and for feedback are the same in Germany and Austria, the reference points are not; the retention period, by contrast, differs (Germany 3 years, Austria 5 years): in Germany the internal feedback deadline runs from the acknowledgement of receipt, in Austria from receipt of the report. All rows in the following table state statutory deadlines, not practice recommendations.

Practice rhythm (not a statutory deadline): between day 7 and month 3 the law leaves the pace open. A follow-up review six weeks after receipt has proven effective: early enough to still hear witnesses before the deadline expires, and it documents the handling even where the case is ultimately discontinued. Record such interim steps separately from the statutory deadlines so that it remains clear in an audit what is an obligation and what is a self-imposed commitment.

External reporting office — competence: which authority receives an external report depends on the reported facts.

5. § 8 Confidentiality

Short answer: Protection of identity for the whistleblower AND the accused person AND third parties. An intentional or reckless breach carries a fine of up to EUR 50,000 (legal person up to EUR 500,000), a negligent breach up to EUR 10,000 (§ 40(3), (4) and (6) HinSchG).

§ 8(1) HinSchG obliges the reporting offices to maintain the confidentiality of the identity of the whistleblower, of the persons concerned by a report and of the other persons named in the report. The identity may only become known to the persons responsible for receiving reports and taking follow-up measures and to the persons supporting them. In Union law this corresponds to Art. 16(1) of Directive (EU) 2019/1937, which also covers any information from which the identity can be derived. In Austria, § 7(1) HSchG likewise protects the identity, including information from which it can be indirectly derived; § 7(2) HSchG prohibits persons who learn the content of a report outside the group of competent staff from disclosing the content or the identity.

Access restrictions, encryption and logging are described in the TOM concept (section 7, point 5).

• Access requests by the accused person (Art. 15 GDPR): redacted response, examine a deferral under § 29 of the German Federal Data Protection Act (BDSG)
• Conduct the investigation of the facts in such a way that the whistleblower cannot be indirectly identified from the choice of witnesses or the case file

Limit of protection: the protection of identity ceases to apply where the whistleblower intentionally or through gross negligence reports incorrect information (§ 9(1) HinSchG). In these cases § 38 HinSchG applies in addition: "The whistleblower is obliged to compensate the damage arising from an intentional or grossly negligent report or disclosure of incorrect information." The evidentiary threshold for intent or gross negligence nevertheless remains high in practice.

Sanctions side: an intentional or reckless breach of confidentiality under § 8(1) HinSchG carries a fine of up to EUR 50,000 (§ 40(3) in conjunction with (6) sentence 1 HinSchG), a negligent breach up to EUR 10,000 (§ 40(4) in conjunction with (6) sentence 1 HinSchG). Since 15 April 2025, the Federal Office of Justice has been competent for the prosecution and sanctioning of regulatory offences under § 40 HinSchG — but only to the extent that the execution of the act falls to the Federal Ministry of Justice or an authority within its portfolio (§ 1 HinSchGOWiZustV, Federal Law Gazette 2025 I No. 111, promulgated on 14 April 2025). Outside this portfolio, the general rules on competence continue to apply. On the limitation period for prosecution, see the FAQ.

6. § 36 Protection against reprisals

Short answer: Prohibited reprisals: dismissal, transfer, formal warning, salary reduction, bullying. Reversal of the burden of proof under § 36(2): where a person suffers a detriment, a reprisal is presumed — the employer must provide evidence to the contrary.

§ 36(1) HinSchG prohibits reprisals against whistleblowers, including the threat and the attempt thereof. The presumption in subsection 2 applies where the person suffers a detriment in connection with their professional activity and claims to have suffered it as a result of a report or disclosure; the person causing the detriment must then prove that the detriment was based on sufficiently justified grounds or was not based on the report. The law does not provide for a 6-month period as a trigger for the presumption.

The Regional Labour Court of Lower Saxony, judgment of 11 November 2024 (7 SLa 306/24), confirmed the two-stage assessment scheme. Practice recommendation (not a statutory obligation): for every HR measure following a report, record in writing the date of the decision, the basis for the decision and the state of knowledge of the managers involved — the most robust documents are those dated before the report was received.

Legal consequences: under § 37 HinSchG, the party causing the breach compensates the damage arising from it; the scope and evidence are governed by general damages law — the act does not contain a statutory lump sum such as the amount of all lost remuneration up to retirement. § 37(2) HinSchG clarifies that a breach does not give rise to a claim to the establishment of an employment or training relationship and no claim to career advancement. In addition, § 35 HinSchG protects the whistleblower from liability for obtaining the reported information, provided that this does not itself constitute a separate criminal offence. Agreements restricting these rights are void under § 39 HinSchG — clauses in termination agreements are ineffective to that extent.

Consider Austria separately: under § 20(1) HSchG, retaliatory measures are legally ineffective — named are, among others, suspension, dismissal, demotion, refusal of a promotion, reassignment of duties, reduction of remuneration, disciplinary measures and the withdrawal of a licence. The responsible person owes restoration of the lawful situation, compensation for the pecuniary damage and compensation for the personal impairment suffered (§ 20(1) last sentence and (2) HSchG); § 37 HinSchG does not provide for such an express non-material claim. Procedurally, § 23 HSchG applies, with prima facie evidence instead of a reversal of the burden of proof. The exemption from liability follows from § 22(1) and (2) HSchG.

7. GDPR obligations of the reporting office

Short answer: A HinSchG reporting office must meet six GDPR obligations: an entry in the record of processing activities, a DPIA under Art. 35 GDPR (mandatory in Germany; dispensable in Austria under § 8(13) HSchG), data protection notices for whistleblowers and accused persons, a data processing agreement where IT is outsourced, a reporting-office-specific TOM concept and 3-year retention after the procedure is closed (§ 11(5) HinSchG; Austria 5 years).

1. Entry in the record of processing activities for the processing activity 'reporting office' — with the purpose, the group of recipients (the narrowly limited group of persons under § 8(1) HinSchG) and the deletion period
2. DPIA under Art. 35 GDPR. Art. 35(1) GDPR requires it in advance; Art. 35(3) GDPR names as standard examples, among others, the large-scale processing of special categories of data under Art. 9 GDPR — reports may contain references to health, trade union membership or beliefs, the processing of which is in principle prohibited under Art. 9(1) GDPR and requires an exception
3. Data protection notices for whistleblowers + accused persons. Expect access requests: under Art. 12(3) GDPR you must respond without undue delay and at the latest within one month; the period may be extended by two months where the matter is complex, which must be notified within the first month stating the reasons
4. Data processing agreement with the IT service provider in case of outsourcing. Art. 28(1) GDPR permits the selection only of data processors providing sufficient guarantees of appropriate technical and organisational measures; Art. 28(3) GDPR sets out the minimum content of the contract (subject matter, duration, nature and purpose, types of data, categories of data subjects, rights and obligations of the controller)
5. TOM concept specifically for the reporting office — access restricted to the group under § 8(1) HinSchG, encryption, logging; where operation is outsourced, it can also serve as evidence of the "sufficient guarantees" under Art. 28(1) GDPR
6. Retention 3 years after the procedure is closed (§ 11(5) HinSchG); Austria 5 years. The German three-year period matches the 3-year limitation period for prosecution applying to those regulatory offences carrying a fine of more than EUR 15,000 (§ 31(2) no. 1 OWiG) — anyone who deletes earlier can no longer demonstrate compliance with deadlines in fine proceedings

Data protection officer and personal data breaches

Where the processing by the reporting office is subject to a data protection impact assessment under Art. 35 GDPR, a data protection officer must be appointed in Germany under § 38(1) BDSG irrespective of the 20-person threshold; a personal data breach must be notified without undue delay and where feasible within 72 hours (Art. 33(1) GDPR), unless a risk to the rights and freedoms of natural persons is unlikely. In Austria there is no numerical threshold going beyond Art. 37 GDPR; the obligation to appoint follows directly from Art. 37 GDPR, supplemented by the duty of secrecy under § 5 of the Austrian Data Protection Act (DSG).

In an emergency: if reporting data is leaked, a notification must be made to the competent supervisory authority — unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons; if the notification is not made within 72 hours, it must be accompanied by reasons for the delay (Art. 33(1) GDPR). Where a high risk is likely, communication to the data subjects under Art. 34(1) GDPR is added; it may be dispensed with where appropriate protective measures — in particular encryption — have been applied (Art. 34(3) GDPR). This is precisely why encryption in the TOM concept is more than cosmetic.

8. 30-point audit checklist

Short answer: The following 30 points are the checklist with which an existing reporting office can be assessed in one pass. The "Basis" column states, for each row, the statutory source, practice evidence for a statutory obligation or a practice recommendation without a statutory obligation — for mixed points, both.

Additional checks for Austria: point 11 does not apply (§ 8(13) HSchG), point 21 is extended to 5 years (§ 8(11) HSchG), point 20 refers to the BAK (§ 15(1) HSchG), and the sanctions side is governed by § 24 HSchG with competence of the district administrative authority — not by § 40 HinSchG.