HinSchG External Reporting Channel: Provider Comparison 2026

Main article: HinSchG: Setting up an internal reporting office — setting up the internal reporting office in eight steps, with procedural deadlines, GDPR obligations and a 30-point checklist.

Short answer: The tasks of the internal reporting office may be transferred to a third party (§ 14(1) sentence 1 HinSchG) — the obligation to set up and operate an internal reporting office remains with the employer (§ 12(1) sentence 1 in conjunction with (2) HinSchG), and it must itself take appropriate measures to remedy a breach (§ 14(1) sentence 2 HinSchG). The selection question is therefore: which option fits which starting position — and which obligations stay in-house in any event?

Provider and market information: as at the first edition (2 May 2026), not re-researched for this version; the comparison does not state prices — what counts is the offer for your own scope.

The six options side by side

Applies to each of the six options: setting up and operating the internal reporting office (§ 12(1) sentence 1 in conjunction with (2) HinSchG), remedying identified breaches (§ 14(1) sentence 2 HinSchG), the expertise of the persons entrusted with the tasks (§ 15(2) HinSchG), the in-person meeting upon request (§ 16(3) sentence 3 HinSchG), the data processing agreement where a Data Processor is engaged (Art. 28 GDPR) and separate retention periods per jurisdiction (§ 11(5) HinSchG / § 8(11) HSchG).

The table states, for each option, the type, the cost model and the stated advantage and disadvantage.

Which option fits which starting position?

The starting position decides, not the product: anyone with German sites only can manage with software plus an expert person in-house; anyone reporting in Germany and Austria needs separate deletion and category systems; anyone unable to provide an expert person transfers the tasks to a third party. The table assigns the six options to the typical starting positions; the assignment is a practitioner recommendation, the statutory anchors are mandatory.

1. Law firm (the classic)

The law firm as ombudsperson is the classic outsourcing to a third party under § 14(1) sentence 1 HinSchG.

Four points belong in the engagement or services contract. First, the deadlines under § 17 HinSchG: who acknowledges receipt within seven days, who provides feedback within three months? Second, the interface for follow-up measures — the obligation to remedy a breach remains with the employer under § 14(1) sentence 2 HinSchG, the law firm cannot assume it. Third, confidentiality: § 8(1) HinSchG binds the reporting office even where its tasks have been transferred to a law firm under § 14(1) sentence 1 HinSchG. The identity of the whistleblower, of the persons concerned and of other persons named in the report may be disclosed exclusively to the persons responsible for receipt and follow-up measures and to those supporting them. In Austria, § 7(1) and (2) HSchG expressly protects the identity also at commissioned bodies, including all information from which it can be derived. Clauses that restrict the rights of whistleblowers are void under § 39 HinSchG — including in provider contracts. Fourth, the distinction between ombudsperson and a pure law firm engagement: who is named as the contact person, and how is availability for the in-person meeting upon request under § 16(3) sentence 3 HinSchG regulated? Practitioner recommendation (no statutory form requirement): record both in writing in the engagement or services contract.

2. EQS Integrity Group

EQS Integrity Group is reporting office software; the in-person meeting upon request under § 16(3) sentence 3 HinSchG and the expertise of the persons entrusted with the tasks under § 15(2) HinSchG remain in-house in any event.

In Germany the comparison runs via § 16(3) HinSchG: sentence 1 requires internal reporting channels to allow reports orally or in text form — to that extent the employer has a right of choice. If the oral channel is chosen, it must be possible by telephone or by another form of voice transmission (sentence 2). The only mandatory addition is the in-person meeting at the whistleblower's request within a reasonable time (sentence 3); it must be backed by named staff — with their consent also by video and audio transmission (sentence 4). For anonymous reports the following applies: the internal reporting office should process them (§ 16(1) sentence 4 HinSchG); an obligation to design the reporting channels for the submission of anonymous reports expressly does not exist under sentence 5. And the existing note "no dedicated investigator" has a concrete consequence: the persons entrusted with the tasks need the necessary expertise under § 15(2) HinSchG — with a pure software solution those are your own employees. The existing advantage "documented training" covers the proof of expertise under § 15(2) HinSchG only if content and date are documented (step 3). Practitioner recommendation (no statutory obligation): offer three parallel channels, which removes the discussion about the choice of channel from the procedure.

3. Federal External Reporting Office (Federal Office of Justice, BfJ)

The Federal External Reporting Office is not an outsourcing partner but a state reporting route which the whistleblower may freely choose under § 7(1) HinSchG.

The state Federal External Reporting Office is established at the Federal Office of Justice (BfJ) under § 19(1) HinSchG — not at the Federal Ministry of Justice (BMJ); these are different institutions.

DACH note (DE/AT): The state bodies compared here concern Germany. In Austria the state external body under § 15 HSchG is the Federal Bureau of Anti-Corruption (BAK) — not the BfJ. The obligation to have an internal reporting office from 50 employees applies in both countries: in Germany under § 12 HinSchG, in Austria under § 3 and § 11 HSchG.

The office at the BfJ is organisationally separate from the rest of the agency's remit and is always competent unless a special external reporting office applies (§ 19(1) and (4) HinSchG). Special offices include BaFin for financial services providers (§ 21 HinSchG) and the Federal Cartel Office (Bundeskartellamt) for competition law including the Digital Markets Act (§ 22 HinSchG). § 22 HinSchG determines solely this competence of the Federal Cartel Office as a special external reporting office; it does not create any audit or review obligations on the part of companies — the widespread assumption of an "audit obligation from 2026" has no basis in the Act. Separate deadlines apply to the external procedure: acknowledgement of receipt no later than seven days after receipt (§ 28(1) HinSchG), feedback no later than three months, or six months in the case of extensive processing, stating the reasons for the extension (§ 28(4) HinSchG). In Austria the BAK is competent for all reports of legal infringements at private and public sector entities unless a special body takes precedence — these include the Financial Market Authority, the Federal Competition Authority and the Auditor Oversight Authority (§ 15(1) and (2) HSchG); the external body acknowledges within seven calendar days and provides feedback no later than after three months, or six months in sufficiently justified cases (§ 9(1), § 17(6) HSchG).

4. Whistlelink (Sweden, EU hosting)

Whistlelink is a software-only solution from Sweden with EU hosting; the test question is whether the deadline mechanics and the deletion system of the respective jurisdiction can be mapped in the product (§ 17, § 11(5) HinSchG versus § 8(11) HSchG).

The German deadline mechanics are two-tier: acknowledgement of receipt no later than after seven days (§ 17(1) no. 1 HinSchG), feedback within three months of the acknowledgement of receipt — where receipt was not acknowledged, no later than three months and seven days after receipt (§ 17(2) HinSchG). Content of the feedback: planned and already taken follow-up measures and the reasons for them. Retention and the data protection impact assessment differ by jurisdiction (§ 11(5) HinSchG versus § 8(11) and § 8(13) HSchG) — the values are in the table "Deadlines and competent authorities". The existing note "limited DACH adaptation" thus becomes verifiable: separate deletion periods per jurisdiction, a deadline counter starting from the acknowledgement of receipt, German-language templates for the acknowledgement of receipt and the feedback.

5. NAVEX EthicsPoint (US provider)

NAVEX EthicsPoint is an enterprise solution from a US provider and acts as a Data Processor; the role of controller remains with you — selection of the Data Processor and notification of security incidents (Art. 28(1), Art. 33(1) GDPR).

Art. 28(1) GDPR permits only processors that provide sufficient guarantees of appropriate technical and organisational measures. The contract under Art. 28(3) GDPR must set out the subject matter and duration of the processing, the nature and purpose, the type of personal data, the categories of data subjects and the obligations and rights of the controller — that is the minimum content a provider's data processing agreement must cover. Irrespective of this, the confidentiality requirement of § 8(1) HinSchG remains unchanged; it binds the reporting office even where its tasks have been transferred to a third party under § 14(1) sentence 1 HinSchG (details in section 1). And in the event of an incident, your own deadline counts: in the case of a personal data breach, the controller — that is, the company, not the provider — notifies the competent supervisory authority without undue delay and where feasible within 72 hours of becoming aware of it (Art. 33(1) GDPR) — unless a risk to the rights and freedoms of natural persons is unlikely; where the notification is made later, reasons for the delay must be given. Practitioner recommendation (no statutory obligation): name the reporting route, the contact point and the provider's response time for security incidents in the contract, otherwise this deadline is barely achievable in-house. The existing disadvantage "Third Country risk" becomes tangible in discussions at three points (practitioner recommendation, no statutory obligation): have the server locations and the complete list of sub-processors named in writing, record in the data processing agreement who accesses report data and from where — including support and administration access — and require the evidence of "sufficient guarantees" under Art. 28(1) GDPR to be documented rather than merely assured. This comparison does not cover the requirements for transfers to Third Countries under Chapter V GDPR; they belong in the individual data protection assessment of the provider.

6. EthicsCheck

EthicsCheck is German specialist software; what matters is which substantive scope the category catalogue maps: in Germany § 2(1) HinSchG, in Austria the narrower § 3(3) HSchG.

In Germany, § 2(1) nos. 1 to 3 HinSchG covers breaches subject to criminal penalties, breaches subject to administrative fines where the provision infringed serves to protect life, limb or health or to protect the rights of employees or their representative bodies, as well as other breaches of numerous listed federal, Land and EU provisions. Austria is narrower: § 3(3) HSchG covers the EU areas — including public procurement, financial services and the prevention of money laundering, product safety, environmental protection, food safety, consumer protection and data protection — plus the corruption offences under §§ 302 to 309 of the Austrian Criminal Code (StGB), but not all criminal offences. A category catalogue that maps only the German position leads to misclassifications in Austrian entities. Specifically, this concerns two groups of cases: criminal offences outside the EU areas and outside the corruption offences under §§ 302 to 309 StGB are covered in Germany under § 2(1) no. 1 HinSchG, but not in Austria under § 3(3) HSchG; breaches subject to administrative fines protecting life, limb or health or the rights of employees and their representative bodies are expressly named by § 2(1) no. 2 HinSchG — in Austria they are covered only in so far as they can be assigned to one of the areas named in § 3(3) HSchG (including product safety, food safety, public health). The existing disadvantage "smaller market base" thus becomes verifiable (practitioner recommendation, no statutory obligation): ask for reference customers and promised response times in the provider discussion.

What outsourcing to a provider does not take away

In Germany, four obligations remain with the company irrespective of the provider chosen. First, setting up and operating the internal reporting office from generally 50 employees (§ 12(1) sentence 1 in conjunction with (2) HinSchG); for the employers named in § 12(3) HinSchG — including investment services firms, exchange operators, institutions under the KWG and the German Securities Institutions Act (Wertpapierinstitutsgesetz), capital management companies, insurance undertakings and crypto and payment service institutions — it applies irrespective of the number of employees. Second, remedying identified breaches (§ 14(1) sentence 2 HinSchG). Third, the prohibition of obstruction under § 7(2) HinSchG. Fourth, protection against reprisals: § 36(1) HinSchG prohibits reprisals including their threat and attempt; if the whistleblower suffers a work-related disadvantage and asserts that they suffered it as a result of the report, a reprisal is presumed and the party causing the disadvantage bears the burden of proof (§ 36(2) HinSchG). The party responsible owes compensation for the resulting damage; no claim to employment or professional advancement arises from this (§ 37 HinSchG). The Regional Labour Court of Lower Saxony (LAG Niedersachsen) confirmed the two-tier test on 11 November 2024 (7 SLa 306/24). Practitioner recommendation (no statutory obligation): document proof of independence for every HR measure following a report. In Austria the standard is weaker: under § 23 HSchG the whistleblower need only show the retaliation to be credible; retaliation is not to be assumed if another motive is more probable, which the acting person must in turn show to be credible.

There is also a limit to identity protection that no provider shifts: it does not apply to intentionally or grossly negligently incorrect reports (§ 9(1) HinSchG); in addition, the whistleblower is obliged under § 38 HinSchG to compensate the damage arising from an intentional or grossly negligent report of incorrect information.

Deadlines and competent authorities: Germany and Austria

The core obligations largely run in parallel, the references and individual details differ. This table contains statutory requirements only; practitioner recommendations are marked as such elsewhere.

Seven steps to a provider

The selection runs in seven steps, each with a responsibility in-house and a statutory anchor; the order is a practitioner recommendation, not a statutory requirement.

1. Define the scope per jurisdiction (management with compliance): which breach categories must the system map — § 2(1) HinSchG for German entities, § 3(3) HSchG for Austrian ones?
2. Take the channel decision (compliance): orally or in text form (§ 16(3) sentence 1 HinSchG) — and back the in-person meeting upon request (sentence 3) with named staff; with the whistleblower's consent also by video and audio transmission (sentence 4).
3. Name and train an expert person (management): the persons entrusted with the tasks need the necessary expertise (§ 15(2) HinSchG) — even where the provider supplies only the technology. The Act does not prescribe a format; practitioner recommendation (no statutory obligation): training of 5 to 8 teaching units on procedure, confidentiality, the GDPR interface, protection against reprisals and fact-finding; concluding with a certificate; as evidence in the compliance documentation, proof of expertise no more than three years old.
4. Obtain offers and apply the assessment grid (compliance with procurement): have the 11 assessment points answered in writing by each provider, file the selection rationale in the compliance documentation — practitioner recommendation, not a statutory requirement.
5. Negotiate the data processing agreement and the deletion system (data protection officer with procurement): minimum content under Art. 28(3) GDPR, separate periods for Germany (§ 11(5) HinSchG) and Austria (§ 8(11) HSchG).
6. Carry out the data protection impact assessment (data protection officer): in Germany under Art. 35 GDPR; in Austria it is dispensable under § 8(13) HSchG in conjunction with Art. 35(10) GDPR.
7. Inform the workforce (HR): after conclusion of the contract and before go-live, comprehensible information about the reporting routes under § 13 HinSchG.

Assessment grid for the provider discussion

Eleven points decide whether a provider is suitable — each is linked to a provision named in the middle column. Whether and how a point is given contractual form is a matter of drafting and therefore a practitioner recommendation, not a statutory form requirement.