HinSchG for Associations + NPOs 2026: What Applies and What Does Not

1. Applicability of the HinSchG to associations

Associations, foundations and non-profit companies are employers like any other organization — as a rule, from 50 employees onwards they must set up and operate at least one internal reporting office. The HinSchG contains no special exemption for associations. Threshold: 50 employees (§ 12(1) sentence 1 in conjunction with (2) HinSchG — subsection (1) sentence 1 establishes the obligation to set up the office, subsection (2) ties it to 'as a rule at least 50 employees').

The EU-law origin confirms the scope: Art. 8(1) of Directive (EU) 2019/1937 requires legal entities in the private and in the public sector to establish internal reporting channels and procedures; for the private sector the obligation applies from 50 workers onwards (Art. 8(3)).

Those covered include, among others:

• Caritas + Diakonie + AWO + German Red Cross (DRK) + Paritätischer (in each case from 50 employees)
• Social welfare associations (services for people with disabilities, care homes)
• National sports federations
• Political foundations (Friedrich Ebert, Konrad Adenauer)
• Cultural funding associations

What matters is the individual legal entity, not the federation — legally independent district associations, non-profit limited companies (gGmbH) and regional associations are each their own employer and count separately; the consequences for umbrella organizations are set out in section 5.

Irrespective of the number of employees, the obligation to set up a reporting office applies to the employers listed in § 12(3) HinSchG; these include, among others, investment services firms, stock exchange operators, institutions under the German Banking Act (KWG) and the German Investment Firms Act, capital management companies, insurance undertakings as well as crypto and payment services institutions. Any association or foundation carrying out such an activity should clarify this classification before calculating the 50-employee threshold.

§ 39 HinSchG declares agreements that restrict the rights of whistleblowers under the Act to be invalid. Practitioner recommendation: review confidentiality and loyalty clauses in employment contracts, volunteer agreements and internal rules to see whether they could be read as an obstacle to reporting.

Austria: NPOs are governed by the HSchG, not by the HinSchG

Associations, foundations and NPOs established in Austria are governed not by the HinSchG but by the Austrian Whistleblower Protection Act (HSchG, Federal Law Gazette BGBl. I Nr. 6/2023). The 50-employee threshold is the same; the section numbers, the scope and the competent authorities are not. The remainder of this article describes the German legal position.

• Obligation from 50 onwards: § 3(1) in conjunction with § 11(1) HSchG — an internal whistleblowing system from 50 workers or public-service employees onwards (Germany: § 12(1) sentence 1 in conjunction with (2) HinSchG).
• Narrower material scope: § 3(3) HSchG essentially covers the EU areas plus corruption offences (§§ 302 to 309 of the Austrian Criminal Code, StGB) — the German HinSchG, by contrast, covers all breaches subject to criminal penalties (§ 2(1) no. 1 HinSchG).
• Deadlines: acknowledgement of receipt within seven calendar days at the latest (§ 9(1) HSchG), feedback on follow-up measures within three months at the latest (§ 13(9) HSchG).
• External body: the Federal Bureau of Anti-Corruption (BAK), § 15(1) HSchG — not the Federal Office of Justice. Sectoral special competences take precedence, including the Financial Market Authority (FMA), the Federal Competition Authority and the Auditor Oversight Authority (§ 15(2) HSchG).
• Sanction: administrative offence, fine up to EUR 20,000, and up to EUR 40,000 in case of repetition, imposed by the district administrative authority (§ 24 HSchG).
• Start of protection: protection covers reports to internal as well as to external bodies and applies from the moment the report is made, provided the whistleblower has sufficient reason to believe that the report is true and falls within the scope of the Act (§ 6(1) HSchG).
• Constitutional law: the remarks on Art. 140 GG in section 3 concern German constitutional law only.

2. The 50-employee threshold: what counts?

Counting is by headcount, not by full-time equivalents — a half-time employee counts the same as a full-time employee. The following count towards the 50-employee threshold (§ 12(1) sentence 1 in conjunction with (2) HinSchG; definition of employees: § 3(8) HinSchG):

• Permanent staff (full-time, part-time)
• Marginally employed staff (mini-jobbers)
• Apprentices
• Interns, in so far as they are employed for their vocational training (§ 3(8) no. 2 HinSchG — the wording does not require remuneration)
• Working students
• Temporary agency workers from six months of assignment onwards (practitioner reading — the HinSchG does not state a minimum assignment period)

The following do NOT count:

• Volunteers
• Association members without employment
• Unpaid board members
• Self-employed subcontractors (as a rule)

Why this is decisive for associations — example: 20 full-time staff, 25 part-time staff and 12 marginally employed staff add up to 57 heads; the obligation to set up a reporting office applies even though the full-time equivalents are below the threshold. Practitioner recommendation: document the count annually on a self-chosen reference date; under § 12(2) HinSchG what matters is the number of employees 'as a rule'.

Not being counted does not mean that a report from this group of people is irrelevant: the count determines only the obligation to set up a reporting office (§ 12(1) sentence 1 in conjunction with (2) HinSchG), not which reports the established reporting office handles. Practitioner recommendation: receive and handle reports from volunteers in the same procedure as reports from employees, and extend the staff information under § 13 HinSchG to them.

Austria: the counting list in this section applies to the German legal position; the Austrian threshold and its source are set out in section 1.

3. Religious organizations (Art. 140 GG)

The HinSchG itself contains no special rule and no exemption for religious organizations — church-affiliated bodies with, as a rule, 50 employees or more must set up an internal reporting office; the protection of church self-determination follows solely from constitutional law (Art. 140 GG in conjunction with Art. 137 of the Weimar Constitution, WRV).

"Every religious society regulates and administers its affairs independently within the limits of the law that applies to all." — Art. 137(3) WRV in conjunction with Art. 140 GG

§ 5 HinSchG governs the precedence of security interests as well as confidentiality and secrecy obligations (classified information, judicial deliberation secrecy, legal and medical professional secrecy) — not churches.

For church-affiliated bodies such as Diakonie and Caritas this means: church disciplinary law remains applicable alongside the HinSchG, and the churches' own confidentiality arrangements run in parallel; in the event of a conflict, religious constitutional law takes precedence (Art. 140 GG).

This gives rise to a data protection question for running both procedures in parallel: reports at church-affiliated and ideological bodies may touch on special categories of personal data — Art. 9(1) GDPR names religious or philosophical beliefs, trade union membership and health data; their processing is prohibited in principle, with exceptions set out in Art. 9(2) GDPR. At the same time, the identity of the whistleblower, of the person concerned and of other persons named may be disclosed only to the persons responsible for receiving reports and taking follow-up measures and to those supporting them (§ 8(1) HinSchG).

Practitioner recommendation: anyone conducting church disciplinary proceedings alongside the HinSchG procedure should determine in writing beforehand which person receives which information, and should keep the files of the two procedures physically and technically separate.

4. Public funding compliance

Misuse of state funding — funds from the Federal Ministry of Labour and Social Affairs (BMAS), EU funds, regional funding — can be reported via the material scope of the HinSchG: as a breach subject to criminal penalties such as subsidy fraud (§ 2(1) no. 1), as a procurement breach once the EU thresholds are reached (§ 2(1) no. 4) and as a breach affecting the financial interests of the EU (§ 2(2) no. 1); § 7 HinSchG, by contrast, governs only the choice between internal and external reporting. Typical cases:

• Misapplication of funds, in so far as subject to criminal penalties — § 2(1) no. 1 HinSchG
• Manipulated proof-of-use statements — subsidy fraud, § 2(1) no. 1 HinSchG
• Inadmissible procurement practices — § 2(1) no. 4 HinSchG once the EU thresholds are reached
• Corruption in procurement, in so far as subject to criminal penalties — § 2(1) no. 1 HinSchG; where EU funds are involved, additionally § 2(2) no. 1 HinSchG

Both strands are covered by EU law: Art. 2(1) of Directive (EU) 2019/1937 protects reports concerning public procurement as well as reports about breaches affecting the financial interests of the Union. For bodies operating care and support services, § 2(1) no. 2 HinSchG is added: breaches subject to administrative fines, in so far as the provision breached serves to protect life, limb or health or to protect the rights of employees or their representative bodies.

Funding bodies also impose their own compliance requirements and maintain their own reporting routes — for EU funds, the European Anti-Fraud Office (OLAF). Practitioner recommendation: name the internal reporting office and the OLAF reporting route together in the staff information under § 13 HinSchG.

Austria: narrower catalogue for funding matters

The HSchG covers funding-related matters in so far as they can be assigned to one of the listed areas — these include in particular public procurement and the corruption offences under §§ 302 to 309 StGB (§ 3(3) HSchG). Protection under the HSchG requires the whistleblower to have sufficient reason to believe that their report falls within that scope (§ 6(1) HSchG). Practical consequence for Austrian NPOs: before rejecting a report, examine and document which area of § 3(3) HSchG it can be assigned to. Whether a report outside those areas is nevertheless handled internally is an organizational decision for the legal entity and not a question of HSchG protection.

5. Practical solutions for SME associations

The form of organization is free, the obligation is not: the association must set up and operate at least one internal reporting office (§ 12(1) sentence 1 HinSchG), but may entrust the tasks to a third party — for example a law firm or an ombudsperson (§ 14(1) sentence 1 HinSchG). The obligation to take appropriate measures to remedy a breach remains with the association in any event (§ 14(1) sentence 2 HinSchG). Outsourcing therefore shifts the handling, not the responsibility.

The following table does not state lump sums but the cost drivers for each model; clarify specific amounts via quotes or your own staff costing. The allocation by association size is a practitioner recommendation, not a statutory requirement.

Umbrella organization and sub-units: § 14 subject to an EU caveat

§ 14 HinSchG allows the umbrella organization to take over the reporting-office tasks of its sub-units — the benchmark remains Art. 8 of Directive (EU) 2019/1937, which ties the obligation to have internal reporting channels to each legal entity with 50 employees or more. No infringement proceedings by the European Commission against Germany on this point are pending: proceedings INFR(2022)0052 for late transposition of the Directive ended with the Court of Justice judgment C-149/23 of 6 March 2025 (lump sum EUR 34 million) and were closed on 4 June 2026; § 14 HinSchG applies unchanged as at 17 August 2026. Practitioner recommendation: a hybrid model rather than pure centralization — an own internal reporting office in each legally independent sub-unit with 50 employees or more, whose tasks are entrusted under § 14(1) sentence 1 HinSchG to the central body of the umbrella organization as a third party.

6. 12-point audit checklist for associations

The twelve points are the auditable short version of this article and follow the German legal position; individual points additionally name the differing Austrian source, and the full delimitation for Austria is set out in sections 1, 2, 4, 7, 8 and 9. Each point either names the statutory source or expressly indicates that it is a practitioner standard without a statutory obligation.

1. 50-employee threshold reached? Count heads, not full-time equivalents (§ 12(1) sentence 1 in conjunction with (2) HinSchG) — counting list in section 2.
2. Reporting officer appointed? Document the appointment; the tasks may be entrusted to a third party (§ 14(1) sentence 1 HinSchG), while the obligation to remedy remains with the association (sentence 2).
3. 3 reporting channels (written, oral, in person)? A reporting channel in oral or text form plus an in-person meeting upon request (§ 16(3) HinSchG) — three parallel channels are a practitioner standard, not an obligation; details in section 7.
4. Handling of anonymous reports defined? No obligation to open the channels for anonymous submissions (§ 16(1) sentence 5 HinSchG) — decide internally whether and how anonymous reports are handled and document it; section 10 no. 1.
5. Confidentiality concept under § 8 documented? Protected group of persons and disclosure under § 8(1) HinSchG — section 3.
6. Prohibition of reprisals communicated? Threats and attempts are also prohibited (§ 36(1) HinSchG); in practice the prohibition is made known together with the staff information under § 13 HinSchG.
7. Retention periods under § 11 (3 years)? § 11(5) HinSchG, in Austria § 8(11) HSchG — deadlines in the table in section 7.
8. Data protection impact assessment carried out for the reporting office? Mandatory in Germany (Art. 35(1) GDPR), dispensable in Austria (§ 8(13) HSchG in conjunction with Art. 35(10) GDPR) — details in section 7.
9. Procedure for HR measures under § 36 documented? Because of the reversal of the burden of proof in § 36(2) HinSchG, the justification of every personnel measure that is independent of the report must be capable of proof; in Austria the weaker standard of prima facie evidence applies instead (§ 23 HSchG) — section 8.
10. Training of the reporting officer under § 15? § 15(2) HinSchG requires the necessary expertise — legal training is not prescribed; in practice 5 to 8 teaching units are customary.
11. Self-assessment of effectiveness documented? Best practice, NOT a statutory obligation; an annual cycle is a practitioner recommendation.
12. Communication to employees + volunteers? § 13 HinSchG requires the staff information, in practice by notice or intranet with a clear explanation of the reporting routes; including volunteers in the same communication is a practitioner recommendation.

7. Reporting procedure in the association: channels, deadlines, data protection

Once a report is received, two hard deadlines run — seven days for the acknowledgement of receipt and three months for feedback on follow-up measures. The channel obligation, by contrast, is narrower than the widespread practitioner standard.

§ 16(3) sentence 1 HinSchG requires internal reporting channels to allow reports in oral or in text form — the employer has a choice in this respect. If the oral channel is chosen, it must be possible by telephone or by another form of voice transmission (sentence 2). The only mandatory addition is an in-person meeting within a reasonable period upon request by the whistleblower (sentence 3); there is no statutory deadline in days for this, and an appointment within 14 days is a widespread practical value.

The following table contains statutory deadlines and competences only, no practitioner recommendations:

Two organizational duties are added for day-to-day operation: the necessary expertise of the persons entrusted with the tasks (§ 15(2) HinSchG) and the staff information under § 13 HinSchG. In Germany, alongside the Federal Office of Justice, BaFin operates an external reporting office for financial service providers (§ 21 HinSchG) and the Federal Cartel Office one for competition law breaches (§ 22 HinSchG).

Data protection at the association's reporting office

Every processing operation at the reporting office needs a legal basis under Art. 6(1) GDPR, and reports may additionally contain special categories under Art. 9(1) GDPR. In Germany, a data protection impact assessment under Art. 35(1) GDPR must be carried out for the reporting office; in Austria it is dispensable under § 8(13) HSchG in conjunction with Art. 35(10) GDPR.

If the reporting office or the software used is outsourced, the association may work only with processors providing sufficient guarantees of appropriate technical and organizational measures (Art. 28(1) GDPR); the cooperation must be governed by a contract with the minimum content of Art. 28(3) GDPR. Requests from data subjects must be answered without undue delay and in any event within one month, extendable by two months with reasons (Art. 12(3) GDPR); where the accused person requests access under Art. 15 GDPR, a redacted answer and deferral under § 29 of the German Federal Data Protection Act (BDSG) may be considered.

Data protection officers: alongside the basic cases in Art. 37(1) GDPR, § 38(1) BDSG applies in Germany — as a rule at least 20 persons constantly engaged in the automated processing of personal data; irrespective of that number, an officer must be designated where processing operations are subject to a data protection impact assessment under Art. 35 GDPR. Austria provides for no numerical threshold going beyond Art. 37 GDPR; the obligation follows directly from Art. 37 GDPR (§ 5 of the Austrian Data Protection Act, DSG).

8. Protection against reprisals and liability in the association

Reprisals against whistleblowers are prohibited, including threats and attempts (§ 36(1) HinSchG) — and if the person suffers a detriment in connection with their professional activity and claims that this is a consequence of the report, a reprisal is presumed; the party causing the detriment must then prove that the detriment was based on sufficiently justified grounds or was not based on the report (§ 36(2) HinSchG).

Legal consequence and limits: § 37 HinSchG obliges the party responsible to compensate the damage caused, but creates no claim to the establishment of an employment or training relationship and no claim to career advancement. Conversely, the whistleblower cannot be held legally responsible for obtaining the reported information, provided that obtaining it does not as such constitute a separate criminal offence (§ 35 HinSchG). Anyone who reports incorrect information intentionally or through gross negligence is, by contrast, liable in damages (§ 38 HinSchG); in such cases the protection of identity also ceases to apply (§ 9(1) HinSchG).

Practitioner recommendation for associations: document every personnel measure against a person who has made a report — warning, transfer, non-renewal — in writing beforehand, together with its justification independent of the report. The test has two stages: at stage 1 the whistleblower sets out the report and the subsequent detriment, and the presumption under § 36(2) HinSchG then applies; at stage 2 the association must prove the justification independent of the report. Confirmed by the Regional Labour Court of Lower Saxony, judgment of 11 November 2024 — 7 SLa 306/24.

Austria: retaliatory measures are legally ineffective (§ 20(1) HSchG); the responsible person owes restoration of the lawful situation, compensation for financial loss and damages for the personal impairment suffered (§ 20(1) last sentence and (2) HSchG). The standard of proof differs: the whistleblower need only show the retaliation as prima facie credible; retaliation is not to be assumed where there is a higher probability of another motive, which the person acting must in turn make prima facie credible (§ 23 HSchG) — a weaker standard than the German reversal of the burden of proof. Exemption from liability is governed by § 22(1) and (2) HSchG.

9. Fines and limitation periods: Germany and Austria

In Germany, a missing internal reporting office carries a penalty of up to EUR 20,000, while obstruction, reprisal and intentional or reckless breach of confidentiality carry up to EUR 50,000; in Austria, a range of up to EUR 20,000 applies to the offences under § 24 HSchG, and up to EUR 40,000 in case of repetition.

What is decisive for associations as legal persons is the reach of the tenfold increase: § 40(6) sentence 2 HinSchG expressly orders the tenfold increase under § 30(2) sentence 3 of the German Act on Regulatory Offences (OWiG) only for § 40(2) no. 1 and 3 as well as (3) and (4) — and precisely not for the missing internal reporting office (§ 40(2) no. 2). In practice this means: up to EUR 500,000 against the association for obstruction, reprisal or intentional or reckless breach of confidentiality, but EUR 20,000 where the reporting office is simply absent.

Competence in Germany: the HinSchGOWiZustV (BGBl. 2025 I Nr. 111, in force since 15 April 2025) transfers the prosecution and punishment of the regulatory offences under § 40 HinSchG to the Federal Office of Justice — but only in so far as the execution of the Act is incumbent on the Federal Ministry of Justice or an authority within its portfolio; otherwise the general rules on competence apply (§ 36 OWiG).

Austria: § 24 HSchG covers anyone who obstructs or puts pressure on a protected person in relation to a report, takes a retaliatory measure, breaches confidentiality (§§ 7 or 17(1) HSchG) or knowingly gives a false report: administrative offence, fine up to EUR 20,000, and up to EUR 40,000 in case of repetition, imposed by the district administrative authority. The HinSchGOWiZustV and the infringement proceedings concerning § 14 HinSchG have no equivalent in Austria.

10. What does NOT apply to associations: five misconceptions from compliance publications

Five assumptions circulating in compliance publications have no basis in German law: anonymous reporting channels as an obligation, three mandatory channels, an audit obligation, the replaceability of the internal reporting office by the state one, and a six-figure fine for the missing reporting office alone.

1. No obligation to open anonymous reporting channels. § 16(1) sentence 4 HinSchG formulates a recommendation ('should'), and sentence 5 expressly clarifies that there is no obligation to design the reporting channels so as to enable anonymous reports to be submitted. The frequently cited reference date of 1 January 2025 comes from a draft bill that did not become law; the transitional provision in § 42 HinSchG concerns only the deadline for setting up a reporting office for employers with 50 to 249 employees (17 December 2023) and the applicability of § 40(2) no. 2 (1 December 2023).
2. No three mandatory channels. Three parallel channels are a practitioner standard, not a statutory obligation — the wording and sources of § 16(3) HinSchG are in section 7.
3. No 'HinSchG amendment 2026' with an audit obligation. The circulating claim relies on § 22 HinSchG. That provision, however, governs the external reporting office at the Federal Cartel Office for competition law breaches (in particular antitrust law, market abuse, Digital Markets Act) and does not establish any review obligation for internal reporting offices. An annual effectiveness review is best practice for compliance officers, but not a statutory obligation.
4. The state external reporting office does not replace the internal one. The choice between internal and external reporting rests with the whistleblower alone (§ 7(1) HinSchG); obstructing reports or the subsequent communication is prohibited (§ 7(2) HinSchG). What is permissible, by contrast, is entrusting the tasks to a third party (§ 14(1) sentence 1 HinSchG). In Austria, protection covers reports to internal as well as external bodies (§ 6(1) HSchG).
5. No six-figure fine for the missing reporting office alone. For § 40(2) no. 2 HinSchG the figure remains EUR 20,000, because § 40(6) sentence 2 HinSchG does not order the tenfold increase for that offence — details and the counter-examples in section 9.