DPIA for HinSchG Reporting Channel: 7-Step Template

Main article: HinSchG confidentiality concept under § 8 — which three groups of persons § 8(1) HinSchG protects and how the role concept, technical measures and audit trail safeguard confidentiality.

The 7 steps at a glance

Short answer: the template works through the DPIA in seven steps — from the description of the processing to the reassessment. The numbering is the practice structure of this article and not a statutory scheme; the third column names the provisions that the respective step evaluates — where no provision is given, it is a practice recommendation. The fourth column names what is produced in the DPIA document.

1. Description: channels, fields, recipients, legal basis

Short answer: step 1 describes the processing so specifically that a reviewing body can follow it without further questions. Reporting-channel software, provider, intake channels, data flow.

Record for each channel which fields are collected. In Germany, § 16(3) sentence 1 HinSchG requires reports to be possible orally or in text form; where the oral channel is offered, it must be possible by telephone or by another form of voice transmission (sentence 2), and at the request of the reporting person a meeting in person must be made possible within a reasonable time (sentence 3). Each channel creates its own data traces — form record, voice message, minutes of the conversation — which have to be described individually.

The circle of recipients is drawn narrowly: the identity may be made known only to the persons responsible for receiving reports and taking follow-up measures and to the persons supporting them (§ 8(1) HinSchG). In Austria, § 7(1) HSchG protects the identity including all information from which it can be derived directly or indirectly.

The legal basis is part of the description: for each processing step, name which of the six grounds for lawfulness in Art. 6(1) GDPR you rely on. Practice recommendation: do not base the ongoing operation of the reporting channel on consent — under Art. 7(3) GDPR it can be withdrawn at any time, and withdrawal must be as easy as giving consent.

The deadlines of the procedure belong in the same description. All rows of the following table are statutory deadlines, not practice values:

2. Necessity + proportionality: why software and why exactly these fields

Short answer: step 2 does not justify whether a reporting channel is operated — in Germany that is mandatory from as a rule 50 employees (§ 12(1) sentence 1 in conjunction with (2) HinSchG), in Austria from 50 employees or public servants (§ 3(1) in conjunction with § 11(1) HSchG) — but why it is operated in exactly this configuration. What has to be justified is why a software solution is necessary and why no leaner alternative suffices — and, for each form field, why it is collected: mandatory fields only where the matter cannot be handled without that information.

The range of matters processed follows the material scope, and that differs nationally. In Germany, § 2(1) no. 1 to 3 HinSchG covers infringements subject to criminal penalties, infringements subject to administrative fines in so far as the provision infringed serves to protect life, limb or health or to protect the rights of employees or their representative bodies, as well as numerous listed federal, Land and EU provisions. In Austria the scope is narrower: § 3(3) HSchG essentially names the EU areas plus the corruption offences under §§ 302 to 309 StGB. An Austrian reporting channel can therefore justify a narrower body of data than a German one.

The channel architecture is a proportionality argument as well. Under § 16(3) sentence 1 HinSchG there is, in Germany, a choice between oral form and text form; the only mandatory addition is the meeting in person upon request (sentence 3). Three parallel channels are a widespread practice standard, not a statutory obligation. The internal reporting channel should process anonymous reports (§ 16(1) sentence 4 HinSchG); under sentence 5 there is no obligation to design the reporting channels in such a way that they allow anonymous reports to be submitted. Anyone who nevertheless offers anonymous intake collects less identifying data — which can be documented in step 2 as a minimisation argument.

3. Risk identification: breach of identity, reprisal, Art. 9 data, Third Country

Short answer: step 3 names the harm that threatens the data subjects: breach of identity (§ 8 HinSchG), consequences of reprisals, Special Categories of Personal Data (Art. 9), Third Country risk.

In Germany, a breach of identity hits three groups at once: the reporting person, the persons concerned by a report and the other persons named in the report (§ 8(1) HinSchG). In Austria, § 7(1) HSchG expressly extends the protection to all information from which the identity can be derived directly or indirectly — a benchmark against which field structure, free-text fields, file attachments and export functions must be measured.

The typical consequence of a breach is reprisal — the Whistleblower Directive gives suspension, dismissal, demotion, withholding of promotion, change of place of work and reduction in wages as examples (Art. 19 Directive (EU) 2019/1937). In Germany, reprisals against reporting persons, including the threat and the attempt of such measures, are prohibited (§ 36(1) HinSchG); in Austria, measures taken in retaliation for a justified report are legally ineffective (§ 20(1) HSchG). Each risk is therefore assessed in two dimensions (practice recommendation): by its likelihood of occurrence and by its severity for the data subject. A three-level scale is sufficient for both axes (practice recommendation, not a statutory requirement). Likelihood of occurrence: low — conceivable only where there is additional misconduct or an attack; medium — possible through a known weakness in ongoing operations; high — inherent in normal operation, for instance because a channel is evaluated without access restrictions. Severity: low — correctable without consequences for the data subject; medium — correctable with effort; high — irreversible or existentially relevant. In this template, a high residual risk within the meaning of step 5 is any combination in which one axis reaches 'high' and the other is at least 'medium'. For a breach of identity the severity on this scale is high, because the reprisal just mentioned affects job and income and cannot be reversed. This assessment determines whether a high residual risk remains after the measures in step 4 — and hence whether step 5 is triggered.

Reports may contain special categories of personal data, for example health data, trade union membership or religious and philosophical beliefs; processing such data is in principle prohibited under Art. 9(1) GDPR and permitted only through the narrow exceptions in paragraph 2. In practice: free-text fields and attachments are therefore the most critical part of the processing, because there it cannot be controlled in advance which categories of data are submitted. For the Third Country risk, document the hosting location, support access and the provider's sub-processors. If that exercise reveals access from a Third Country — typically remote maintenance or support — this is no longer merely a documentation point but a separate risk item in step 3 and requires a named measure in step 4 (practice recommendation: contractual access restriction, EU-only support option, encryption without the provider having key access).

4. Protective measures: one named measure per risk

Short answer: step 4 assigns a named measure to each risk from step 3: role concept with access restrictions, encryption, audit log, data processing agreement, training, confidentiality undertakings.

The role concept reflects the statutory circle of recipients: the responsible and the supporting persons (§ 8(1) HinSchG). In Austria, § 7(2) HSchG flanks this additionally — where the content of a report becomes known to persons other than the responsible staff, those persons are prohibited from disclosing the content or the identity. In practice: separation of the reporting channel and the HR department, encrypted storage of reports and an audit trail of all access. In practice: this separation is a question of permissions, not of the organisational chart — HR roles receive no read access to the content of reports and are involved only once a follow-up measure has produced a result. The same allocation table should contain EU hosting and the other measures addressing the Third Country risk named in step 3 (practice recommendation). Also a practice recommendation: place the supporting persons under a written confidentiality undertaking pursuant to § 8(1) HinSchG (Austria: § 7(2) HSchG) and attach these confidentiality undertakings to the DPIA as evidence.

Encryption works in two ways here. It reduces the risk and can, in a serious case, make notification of the data subjects unnecessary: under Art. 34(3) GDPR it is not required where appropriate technical and organisational protection measures — in particular encryption — have been applied. This must be distinguished from notification to the supervisory authority: Art. 33(1) GDPR requires it without undue delay and, where feasible, within 72 hours, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons.

Anyone buying in software or operations may work only with Data Processors providing sufficient guarantees of appropriate technical and organisational measures (Art. 28(1) GDPR), and needs a contract with the minimum content set out in Art. 28(3) GDPR: subject matter and duration, nature and purpose, types of data, categories of data subjects as well as the obligations and rights of the controller. For training, § 15(2) HinSchG requires in Germany that the persons entrusted have the necessary expertise — legal training is not required for this; a scope of five to eight teaching units with a record is the practice standard.

5. Consultation: only where a high risk remains

Short answer: step 5 is triggered only where a high residual risk remains after the measures in step 4 — in that case the competent data protection supervisory authority must be consulted under Art. 36 GDPR.

The German division of competence is set out in two provisions: § 40(1) BDSG assigns supervision of non-public bodies to the authorities competent under Land law, and § 9(1) BDSG assigns supervision of federal public bodies and of certain providers of telecommunications services to the Federal Commissioner for Data Protection and Freedom of Information. In Austria, the Austrian Data Protection Authority (Datenschutzbehörde) is established under § 18(1) DSG as the national supervisory authority within the meaning of Art. 51 GDPR; for reporting-channel processing within § 8(1) to (12) HSchG, the question of consultation arises only to a limited extent from the outset, because there the DPIA is already dispensed with (§ 8(13) HSchG).

Practice recommendation: assess the residual risk with the three-level scale from step 3 (likelihood of occurrence and severity, each low/medium/high) and trigger the consultation along the threshold named there. Record a decision against consulting with the date, the reasoning and the responsible person. Without that note it cannot later be shown that step 5 was carried out at all.

6. Retention: three years (DE) and five years (AT)

Short answer: in Germany the documentation must be erased three years after the procedure has been concluded (§ 11(5) HinSchG); in Austria personal data must be retained for five years from the last processing operation (§ 8(11) HSchG). Longer retention in Germany only in so far as it is necessary and proportionate. Keep audit logs separately for longer where needed. Austria: documentation under § 9 HSchG; log data for three years beyond the end of the retention obligation (§ 8(12) HSchG) — not § 11 HinSchG.

Practice recommendation for Germany: do not set the erasure concept shorter than three years. The limitation period for prosecuting administrative offences depends on the maximum fine threatened — it is three years for the offences under § 40 HinSchG that carry more than EUR 15,000 (§ 31(2) no. 1 OWiG) and two years for a negligent breach of confidentiality with a maximum fine of EUR 10,000 (§ 31(2) no. 2 OWiG). The three-year erasure period in § 11(5) HinSchG fits this timeframe — it runs from the conclusion of the procedure and is therefore linked to a different event than the limitation period.

The DPIA should also record who erases data and how erasure is evidenced. The case file, the audit log, backups and export copies have different life cycles in practice; each of these storage locations needs its own line in the erasure concept, otherwise the report outlives its statutory deadline in the backup.

7. Annual re-evaluation

Short answer: the annual rhythm in this heading is a practice recommendation; in substance the reassessment is triggered by events. Update where the software changes, an incident occurs or the law changes.

Occasions on which the DPIA should be brought up to date (practice recommendation): a change of provider or hosting region, new or discontinued reporting channels, a change in the group of persons authorised to access data, outsourcing the tasks of the reporting channel to a third party and any security incident relating to report data. Where the incident is at the same time a personal data breach, it may trigger the notification obligation under Art. 33(1) GDPR (for the qualification see step 4) — updating the DPIA then belongs in the same follow-up.

For the trigger 'change in the law', the actual legal position is what counts: there is no 'HinSchG amendment 2026' with an audit obligation; § 22 HinSchG governs the external reporting channel at the Federal Cartel Office for competition and DMA infringements. An annual self-assessment of the effectiveness of the internal reporting channel is best practice, but not a statutory obligation — it lends itself to being a fixed appointment at which the DPIA is reviewed at the same time (practice recommendation). Record the result even where nothing has changed: a dated note reading 'reviewed, unchanged' is the simplest evidence that step 7 is being lived up to.