HinSchG Confidentiality Concept (Section 8): How to Make It Audit-Ready

1. Obligations under § 8 HinSchG

§ 8(1) of the German Whistleblower Protection Act (HinSchG) obliges reporting offices to keep the identity of three groups of persons confidential: the reporting person, the persons who are the subject of a report, and any other persons named in the report. A concept that addresses only the Whistleblower reflects the statutory mandate incompletely — accused persons and named third parties need the same level of protection in the authorisation matrix, the case files and the audit trail.

"Reporting offices shall preserve the confidentiality of the identity of the following persons: 1. the reporting person, provided that the information reported concerns breaches falling within the scope of this Act, or the reporting person had reasonable grounds at the time of reporting to believe that this was the case, 2. the persons who are the subject of a report, and 3. any other persons named in the report. The identity of the persons referred to in sentence 1 may be disclosed exclusively to the persons responsible for receiving reports or for taking follow-up measures, as well as to the persons supporting them in performing those tasks." — § 8(1) HinSchG

Practical consequence: the permissible circle of knowledge under § 8(1) sentence 2 HinSchG does not stop at the reporting office — the supporting persons (e.g. IT administration, external investigative support) belong by name in the authorisation concept and in the audit trail. Any disclosure of the identity beyond that circle is permissible only under § 9 HinSchG; the confidentiality requirement also applies irrespective of whether the reporting office is competent for the incoming report (§ 8(2) HinSchG).

Who is subject to the obligation: an internal reporting office must be set up and operated from, as a rule, 50 employees upwards (§ 12(1) sentence 1 in conjunction with (2) HinSchG); for the employers listed in § 12(3) HinSchG — including investment firms, institutions under the KWG, capital management companies and insurance undertakings — the obligation applies regardless of size. The EU-law benchmark is Art. 16(1) of Directive (EU) 2019/1937: without the explicit consent of the reporting person, their identity may not be disclosed to anyone beyond the authorised staff members competent to receive reports or to take follow-up measures, including any information from which the identity may be directly or indirectly deduced.

Who may report where: the choice between internal and external reporting rests with the reporting person; the Act encourages them to report internally where the matter can be effectively remedied internally and no reprisals are to be feared (§ 7(1) HinSchG). Obstructing reports or the subsequent communication, or attempting to do so, is prohibited (§ 7(2) HinSchG).

Where the protection ends: identity protection for the reporting person ceases in the case of intentionally or grossly negligently incorrect reports (§ 9(1) HinSchG). What a breach costs and who sanctions it is set out in section 8.

Brief note on Austria: HSchG instead of HinSchG

This article follows the German HinSchG. For Austrian entities, the Austrian Whistleblower Protection Act (HSchG, BGBl. I Nr. 6/2023) applies instead — the core obligations are comparable, but the references and deadlines differ:

• Identity protection: § 7(1) HSchG — protection of the identity by internal, external and mandated bodies, including any information from which the identity can be directly or indirectly deduced; where staff who are not competent learn of the content, they are prohibited from disclosing it (§ 7(2) HSchG).
• Disclosure: § 7(3) and (4) HSchG — only where an administrative authority, a court or the public prosecutor's office considers it indispensable and proportionate in the proceedings; the reporting person must be informed in advance and the reasons must be set out in writing.
• Retention: § 8(11) HSchG — personal data must be retained for 5 years from the last processing or transmission; the differing German period and its rationale are set out in section 5.
• Penalty: § 24 no. 3 HSchG — a breach of confidentiality is an administrative offence; a fine of up to EUR 20,000, and up to EUR 40,000 in the event of repetition, is imposed by the district administrative authority (Bezirksverwaltungsbehörde), not by the Federal Office of Justice (BfJ).
• Acknowledgement of receipt: § 9(1) HSchG — receipt of written reports must be acknowledged in writing without undue delay, at the latest after seven calendar days; the acknowledgement is omitted where the reporting person has expressly objected or where it would compromise the protection of their identity.
• Data protection: § 8(13) HSchG in conjunction with Art. 35(10) GDPR — a data protection impact assessment is not required in Austria; in Germany it must be carried out for the reporting office under Art. 35 GDPR.
• External body: § 15(1) HSchG — the Federal Bureau of Anti-Corruption (BAK); sectoral special competences take precedence, including the Financial Market Authority (Finanzmarktaufsicht), the Federal Competition Authority (Bundeswettbewerbsbehörde) and the Auditor Oversight Authority (Abschlussprüferaufsichtsbehörde) (§ 15(2) HSchG).

2. Technical measures

Technically, an audit-ready confidentiality concept rests on six building blocks: an encrypted intake channel, encrypted storage, an anonymous reporting route, a documented authorisation concept, a gapless audit log and separation from HR IT. Each building block needs evidence that you can produce from your own files during an audit — including where the evidence originates from the provider (SOC 2 report, test record).

The "Legal anchor" column names the provision whose purpose the measure serves. The specifications in the "Implementation" column — TLS 1.3, AES-256, SOC 2 — are not prescribed verbatim by any of those provisions; they are practice standards.

Why encryption counts twice: under Art. 34(3) GDPR, notification of the data subject is not required where appropriate protective measures — encryption is expressly mentioned — have been applied. Evidence of encryption at rest therefore belongs in the incident file, not only in the system documentation.

Anonymous channel and retention: under § 16(1) sentence 4 HinSchG the internal reporting office should process reports received anonymously; sentence 5 clarifies that there is no obligation to design the reporting channels so as to allow anonymous submission — the anonymous web form with a reply channel is therefore a practice recommendation. Retention periods and their rationale are set out in section 5; anyone operating both jurisdictions in one system needs separate retention profiles.

3. Organisational measures

Organisationally, the concept consists of five building blocks, each of which produces its own document. Without these papers, it cannot be demonstrated in an audit that the circle of persons under § 8(1) sentence 2 HinSchG was in fact limited.

• Reporting office officer bound to secrecy (separate declaration) — it records who belongs to the permissible circle under § 8(1) sentence 2 HinSchG, supporting persons included. For Austria, § 7(2) HSchG supports this point (section 1).
• Annual training plus refreshers after incidents — the annual rhythm is a practice recommendation. In law, § 15(2) HinSchG requires the necessary expertise; legal training is not required for this. In practice, 5 to 8 teaching units on procedure, confidentiality, the GDPR interface, protection against reprisals and fact-finding are customary.
• Record keeping on separate storage (not the regular file server) — so that rights from general IT administration do not extend to case files; the evidence is the architecture document from section 2.
• Handover processes when staff change in the reporting office team — withdrawal of rights as at the leaving date, a recorded handover of ongoing cases, and an update of the authorisation matrix. Access that is not withdrawn keeps the circle under § 8(1) sentence 2 HinSchG permanently open.
• Emergency procedure in the event of a Personal Data Breach — with a named notification chain, running deadlines and a decision template; deadlines and the sanctions side are set out in section 8.

Outsourcing changes the organisation, not the responsibility: the tasks of the internal reporting office may be assigned to a third party (§ 14(1) sentence 1 HinSchG); the employer nevertheless remains obliged to take appropriate measures to remedy a breach (§ 14(1) sentence 2 HinSchG). No EU infringement proceedings against Germany are pending in respect of the group solution under § 14 HinSchG; proceedings INFR(2022)0052 concerning Directive (EU) 2019/1937 ended with the CJEU judgment C-149/23 of 6 March 2025 and were closed on 4 June 2026 (as at 17 August 2026).

4. Separation of roles between the reporting office and HR

Core principle: the reporting office is NEVER directly linked to HR disciplinary measures. The separation protects two legal interests at once — confidentiality under § 8(1) HinSchG and the employer's evidentiary position in a dispute over reprisals.

Germany — why this matters beyond confidentiality: § 36(1) HinSchG prohibits reprisals against reporting persons, including threats and attempts. § 36(2) HinSchG reverses the burden of proof: if the reporting person suffers a detriment in connection with their professional activity and asserts that they suffered it as a result of the report, it is presumed that the detriment constitutes a reprisal — the party causing the detriment must then prove that the measure was based on sufficiently justified grounds or was not based on the report. The Lower Saxony Regional Labour Court (LAG Niedersachsen) confirmed the two-stage test in its judgment of 11 November 2024 (7 SLa 306/24). Practice recommendation: document an independence record for every HR measure taken after a report — the occasion, the basis for the decision and the timing, kept separate from the reporting process.

Austria — a different benchmark: retaliatory measures are legally ineffective; what is owed is restoration of the lawful state of affairs, compensation for pecuniary damage and compensation for the personal impairment suffered (§ 20(1) and (2) HSchG). The reporting person only has to establish prima facie evidence of the retaliation; retaliation is not to be assumed where there is a higher probability of another motive, which the acting person must in turn establish prima facie (§ 23 HSchG). This is not the German reversal of the burden of proof — documenting the HR decision remains the decisive evidence in both jurisdictions, but the legal basis must be cited separately.

Link to the prohibition of obstruction: the prohibition on obstructing reports or the subsequent communication (§ 7(2) HinSchG, section 1) must be taken into account in internal escalation rules.

5. Audit trail requirements

The audit trail must log every action in such a way that it can be reconstructed who accessed which case and when — this is precisely the evidence that the circle of persons under § 8(1) sentence 2 HinSchG was observed. Log every action in the reporting office software:

• Timestamp (UTC) — makes access comparable across time zones and systems
• User ID — assigns the access to a person from the authorisation matrix
• Action (access, change, export) — the export is the critical operation, because it takes data out of the protected system
• Record concerned (hash, not plain text) — keeps the log itself free of identity data, in line with Data Minimisation under Art. 5 GDPR
• IP address — evidences the environment from which access took place

Why 3 years is the lower limit (Germany): the documentation must be deleted 3 years after the procedure is concluded (§ 11(5) HinSchG); in parallel, the 3-year limitation period for prosecution runs for offences punishable by more than EUR 15,000 (§ 31(2) no. 1 OWiG). A shorter retention concept deprives you of the opportunity to exculpate yourself during the ongoing limitation period; longer retention is permissible only to the extent that it is legally required. For Austria, the 5-year period under § 8(11) HSchG applies.

What immutability means in practice: the log must be write-protected even for administrators of the reporting office software — otherwise it proves nothing in a dispute. This becomes verifiable through separate rights for system administration and log analysis, and through a documented reconciliation of the log extract against the authorisation matrix. Practice recommendation: every six months, and additionally after every staff change in the reporting office team.

6. 18-point audit checklist

The following 18 points are the checklist with which a confidentiality concept can be signed off: the question, the evidence and — where one exists — the legal reference. Points without a reference are marked as practice recommendations.

1. Encrypted intake channel URL? Evidence: certificate and protocol configuration of the reporting portal. TLS 1.3 is a practice standard; see section 2 for the classification. Art. 32 GDPR
2. Anonymous reporting with a reply channel possible? Evidence: documented test report. Practice recommendation; rationale in section 2. § 16(1) sentences 4 and 5 HinSchG
3. Storage with AES-256? Evidence: provider record of encryption at rest. Practice standard; see section 2 for the classification. Art. 32 GDPR Art. 34(3) GDPR
4. Authorisation concept documented? Evidence: authorisation matrix naming individuals, including supporting persons. § 8(1) sentence 2 HinSchG
5. RBAC with need-to-know active? Evidence: role export from the system, reconciled with the matrix from point 4. § 8(1) sentence 2 HinSchG
6. Audit log gapless? Evidence: log extract with the five fields from section 5, without time gaps. Evidence that the circle was limited. § 8(1) sentence 2 HinSchG
7. Audit log immutable? Evidence: write-protection configuration. A practice requirement for evidentiary value; rationale in section 5.
8. Separation of reporting office / HR / IT? Evidence: role description plus hosting architecture; this additionally supports the evidentiary position in a dispute over reprisals (§ 36 HinSchG · AT § 20 HSchG). § 8(1) sentence 2 HinSchG · AT § 7(1) HSchG
9. Confidentiality declarations signed? Evidence: signed declarations from all persons in the authorisation matrix. § 8(1) sentence 2 HinSchG · AT § 7(2) HSchG
10. Training up to date <12 months? Evidence: attendance records. The rhythm is a practice recommendation; see section 3 for the classification. § 15(2) HinSchG
11. Provider DPA with confidentiality clauses? Evidence: data processing agreement containing the minimum content of Art. 28(3) GDPR. Art. 28(1) and (3) GDPR
12. Provider SOC 2 report <12 months? Evidence: current audit report. Practice recommendation — as evidence of the processor's "sufficient guarantees". Art. 28(1) GDPR
13. Emergency procedure for a breach of confidentiality? Evidence: process plan with notification chain and running deadlines. Art. 33(1) GDPR Art. 34(1) GDPR
14. Handover processes when staff change? Evidence: handover record and documented withdrawal of rights as at the leaving date. § 8(1) sentence 2 HinSchG
15. 3-year retention plus mandatory deletion? Evidence: deletion concept with the trigger "conclusion of the procedure"; for Austria, 5 years, kept separate. § 11(5) HinSchG · AT § 8(11) HSchG
16. Data protection documentation complete? Evidence: an entry "reporting office" in the record of processing activities, one data protection notice each for reporting persons and for accused persons, and the DPIA for the processing activity — to be carried out in Germany, not required in Austria; in addition, the Privacy notice is extended to cover the reporting channel. Art. 35 GDPR · AT § 8(13) HSchG
17. External reporting office as a backup? Evidence: documented interface. The distinction between outsourcing and the state reporting office is set out in the FAQ. § 14(1) HinSchG § 19(1) HinSchG · AT § 15(1) HSchG
18. Audit report available internally? Evidence: documented self-assessment of effectiveness covering compliance with deadlines, confidentiality, anonymous processing and training status. Best practice for management reporting, not a statutory obligation.

7. The GDPR interface of the confidentiality concept

The confidentiality concept feeds into data protection documentation at six points: the entry in the record of processing activities, the data protection impact assessment, data protection notices for both sides, the data processing agreement in the case of IT outsourcing, a dedicated TOM concept for the reporting office, and the deletion rule. Anyone who does not manage these points as a package ends up with two concepts in an audit that may contradict each other. Four of them are dealt with by one piece of evidence each:

The data protection impact assessment and the processing arrangement take more effort. The same case file is additionally affected by an access request from the accused person.

Access request by the accused person: where a person concerned by a report requests access under Art. 15 GDPR, this right stands against the confidentiality obligation under § 8(1) HinSchG. Practice works with a redacted response; deferral is governed by § 29 of the German Federal Data Protection Act (BDSG). The timeframe follows Art. 12(3) GDPR: a response without undue delay, at the latest within one month of receipt, extendable by two months with notification within one month stating the reasons. Practice recommendation: define the decision path and the redaction rules in the concept in advance.

DPIA and processing arrangement: in Germany, the DPIA for the processing activity "reporting office" must be carried out under Art. 35 GDPR, whereas in Austria it is not required under § 8(13) HSchG — groups with sites in both countries must therefore document the DPIA obligation separately for each jurisdiction. Where the software is obtained as a service, the controller may only work with processors providing sufficient guarantees of appropriate technical and organisational measures (Art. 28(1) GDPR); the contract must reflect the minimum content of Art. 28(3) GDPR.

Sensitive data: where a report contains information revealing characteristics within the meaning of Art. 9(1) GDPR, the prohibition on processing applies to that information, subject to the narrow exceptions in Art. 9(2) GDPR. Practice recommendation: keep such information in the case file separate from the remaining factual data so that the circle of access does not grow.

8. Breach of confidentiality: notification routes and sanctions

In the event of a breach of confidentiality, two strands must be assessed in parallel: the data protection notification chain under Arts. 33 and 34 GDPR, and the sanctions side under § 40 HinSchG or § 24 HSchG respectively. The first strand runs in hours, the second in years — both rely on the same incident file.

The internal chain that precedes both strands — assigning the steps to specific roles is a practice recommendation: 1. Determination by the reporting office, with a timestamp in the audit log (section 5). 2. Risk assessment by the reporting office and the data protection officer jointly, with the result in writing — this determines whether the notification duty under strand 1 applies at all. 3. Decision on notification within the 72-hour deadline from strand 1. 4. Filing of the determination, assessment, decision and encryption evidence (section 2) in the incident file.

Strand 1 — data protection: a personal data breach must be notified to the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons; where notification is made later, reasons for the delay must be given (Art. 33(1) GDPR). Where a high risk is likely, the data subject must additionally be notified without undue delay (Art. 34(1) GDPR), unless an exception under Art. 34(3) GDPR applies. In Germany, the competent authorities for non-public bodies are the supervisory authorities designated under Land law (§ 40(1) BDSG); in Austria, it is the Austrian Data Protection Authority (Datenschutzbehörde) (§ 18(1) of the Austrian Data Protection Act (DSG)).

Strand 2 — sanctions: the overview sets out maximum amounts, limitation periods and claims for compensation; which offence applies depends on the type of breach. The rows are separated by jurisdiction and are not transferable.

Who imposes sanctions: § 1 HinSchGOWiZustV transfers the prosecution and sanctioning of administrative offences under § 40 HinSchG to the Federal Office of Justice (BfJ) — but only in so far as the execution of the Act is the responsibility of the Federal Ministry of Justice or of an authority within its portfolio; outside that area, the general rules on competence apply (§ 36 OWiG, and Land authorities where applicable). In Austria, the district administrative authority (Bezirksverwaltungsbehörde) imposes the administrative penalty under § 24 HSchG; the administrative offence under § 62(1) DSG is decided by the Austrian Data Protection Authority (Datenschutzbehörde), and it applies only in so far as the act does not already constitute an offence under Art. 83 GDPR or is not subject to a stricter penalty under other administrative penalty provisions.

The parallel data protection framework: infringements of the obligations listed in Art. 83(4) GDPR — including Arts. 25 to 39 GDPR and therefore Art. 32 GDPR — are subject to fines of up to EUR 10,000,000 or 2 % of total worldwide annual turnover, whichever is higher; infringements of Arts. 5, 6, 7, 9 GDPR or of the rights of data subjects (Arts. 12 to 22 GDPR) are subject to fines of up to EUR 20,000,000 or 4 % (Art. 83(5) GDPR).