HinSchG Group Practice: Hybrid Model Implementation

Main article: HinSchG group reporting office — the overview of which group models § 14 HinSchG permits and where the points of dispute lie.

Legal framework of the hybrid model: § 14 HinSchG and the question of conformity with the Directive

The hybrid model rests on two provisions: § 14(1) sentence 1 HinSchG allows the tasks of the internal reporting office to be assigned to a third party — including an office within the same group — while § 12(1) sentence 1 in conjunction with (2) HinSchG leaves the duty to establish such an office with every employer that as a rule has at least 50 employees. Entrusting a third party expressly does not release the employer from taking appropriate measures itself to stop a breach (§ 14(1) sentence 2 HinSchG).

This is where the question of conformity with the Directive arises: Art. 8(1) and (3) of the EU Whistleblowing Directive 2019/1937 require internal reporting channels and procedures at every legal entity in the private sector with 50 or more workers, whereas the German group outsourcing solution — parent or sister company acting as the internal reporting office for subsidiaries — is based on § 14 HinSchG. No infringement proceedings by the European Commission against Germany concerning § 14 HinSchG are pending: proceedings INFR(2022)0052 concerning the late transposition of the Directive ended with the judgment of the Court of Justice of the European Union in Case C-149/23 of 6 March 2025 (lump sum EUR 34 million) and were closed on 4 June 2026; no conformity proceedings were opened. As at 17 August 2026, § 14 HinSchG applies unchanged.

The practitioner recommendation derived from this for group compliance officers is: use hybrid models — a subsidiary's own reporting office plus the group office as a third party — instead of pure group outsourcing. The hybrid model is therefore itself a practitioner recommendation; the statutory duty follows from § 12 HinSchG, the admissibility of the assignment from § 14(1) HinSchG. The following six building blocks describe how this architecture is actually built.

Order of implementation (practitioner recommendation):

1. Group policy delimiting responsibilities between headquarters and subsidiaries.
2. Set up a channel and a tenant for each subsidiary (section 1).
3. Appoint local officers and train them in the required expertise (section 2).
4. For each subsidiary, determine whether an agreement under Art. 26 GDPR or a data processing agreement under Art. 28 GDPR is the correct document, and conclude it (section 4).
5. Roll out the workforce information under § 13 HinSchG.
6. Set up the plan B files (section 5).

What belongs in the group policy (step 1) — the individual points appear throughout this article; the policy bundles them:

• Responsibility matrix for triage (section 3).
• Deputy rule in cases of conflict of interest (section 2).
• Allocation of the GDPR role for each subsidiary — Art. 26 or Art. 28 GDPR (section 4).
• Decision-making body for switching to plan B (section 5).
• Annual status report parent ↔ subsidiary (deadline table in section 3).

Workforce information under § 13 HinSchG (step 5). This article names the subject matter and the form: a clear explanation of the reporting routes, rolled out by notice or intranet page. It makes no statement on the individual group of addressees or on an Austrian counterpart.

The first edition estimates 5 to 10 person-days for this initial set-up (table in section 6).

1. Central software as the intake channel

A group-wide intake channel must meet the formal requirements of § 16(3) HinSchG; the unambiguous allocation of every report to a subsidiary is an additional practitioner requirement.

What the law requires: § 16(3) sentence 1 HinSchG requires internal reporting channels to allow reports 'orally or in text form' — the employer has a choice here, and it is not mandatory to maintain both forms in parallel. If the oral channel is chosen, it must be possible by telephone or by another form of voice transmission (sentence 2). The only additional mandatory element is a physical meeting at the whistleblower's request within a reasonable time (sentence 3); with their consent, video and audio transmission is also permitted (sentence 4). Three parallel channels — text form, telephone, personal meeting — are widespread best practice and reduce the risk of dispute, but they are not a statutory duty.

On anonymity: The internal reporting office should also handle anonymously submitted reports (§ 16(1) sentence 4 HinSchG); under sentence 5 there is expressly no obligation to design the reporting channels so as to allow anonymous reports. There is no statutory cut-off date for an 'anonymity obligation' — the transitional provision in § 42 HinSchG concerns solely the deadline for setting up an office for employers with 50 to 249 employees (17 December 2023) and the applicability of § 40(2) no. 2 HinSchG (1 December 2023). A web form without a login plus an anonymous reply channel is best practice, not a statutory duty.

Practitioner recommendation for the group: In the set-up described here, intake runs through group-wide software (e.g. EQS Enterprise) with a single intake URL where the whistleblower selects the subsidiary concerned at the point of submission; the channel can be used anonymously — that is a design decision, not an obligation (see the paragraph on anonymity above). Design the subsidiary selection so that every report is attributed to a legal entity from the first second — only then can it later be shown for which employer the deadlines in section 3 were running.

If the allocation is missing or wrong: For reports without a subsidiary selection, a fallback responsibility of headquarters is advisable; it completes the allocation during triage and records it with a date in the responsibility note (decision matrix in section 3). In the event of a misallocation, you should, as a precaution, calculate the seven-day deadline under § 17(1) no. 1 HinSchG from receipt in the group channel, not only from the correction. If a report concerns several subsidiaries, opening a parallel case file for each legal entity is advisable — that way every acknowledgement of receipt and every feedback after three months can be shown to be allocated to the correct office. All three points are practitioner recommendations, not statutory requirements.

2. Decentralised investigation officers

Staffing the local investigation role is an organisational matter; the expertise required for it is a statutory duty.

What § 15(2) HinSchG requires: 'the necessary expertise' — the provision does not prescribe legal training. In practice, 5 to 8 teaching units with a certificate are customary; typical content covers procedure, confidentiality, the GDPR interface, protection against reprisals and fact-finding. These figures on scope and content are practitioner values, not statutory minimum requirements.

Staffing and documents for each subsidiary (practitioner recommendation): One or two investigation officers per subsidiary who speak the local language and know the site context have proven effective; they are trained in accordance with § 15 HinSchG. The following documents belong with this:

• Letter of appointment for the named person — the appointment may also be held in personal union, for example by the compliance officer or in-house counsel role.
• Declaration of independence, so that the separation between investigation and line management remains traceable.
• Proof of expertise, in audit practice not older than three years — a best-practice cycle, not a statutory deadline.
• Group mapping: which subsidiary is looked after by which person, and which deputy steps in where there is a conflict of interest or an absence? As a column list with one row per subsidiary: legal entity · legal area (HinSchG/HSchG) · headcount and § 12(3) status · investigation officer · named deputy · GDPR document (Art. 26 or Art. 28) · tenant created in the system (yes/no, plan B relevance).

For Austrian subsidiaries the HinSchG does not apply; the HSchG does. There, the assignment of tasks to a joint office or to third parties is governed by § 13(4) HSchG (see section 4).

3. Workflow between headquarters and local level

The workflow has three stages: intake and triage at headquarters, investigation locally or centrally according to the matrix below, read access for aggregated reporting. Triage decides solely on responsibility — the statutory deadlines continue to run regardless.

Every report first goes through intake triage at headquarters. Where there is a local connection, the case is delegated to the subsidiary while maintaining confidentiality protection; where there is a group connection, headquarters investigates itself.

Confidentiality on delegation: Under § 8(1) HinSchG, reporting offices maintain the confidentiality of the identity of the whistleblower, of the persons concerned by the report and of the other persons named in the report; the identity may only be disclosed to the persons responsible for receipt and follow-up measures and to those supporting them. For the group this means: passing a case to a subsidiary is not automatic but a decision on responsibility, and it must not extend the circle of those in the know beyond the persons responsible. Practitioner recommendation for the system configuration: on delegation, the subsidiary is given access to the case ID, the description of the facts and the responsibility note; identifying information about the whistleblower remains restricted to headquarters without their consent. Behind this lies a three-tier role model — intake and triage at headquarters, investigation locally and case-related, read access for aggregated reporting — flanked by the established technical measures: the need-to-know principle within the reporting office team, encrypted storage of the reports and an audit trail of all access, kept separately for each subsidiary (see the FAQ on data distribution).

Decision matrix for triage. The matrix below records how 'local connection' and 'group connection' differ in the individual case. It is a practitioner recommendation, not a statutory rule on responsibility — in every case the subsidiary remains responsible as the employer (§ 14(1) sentence 2 HinSchG).

Handover artefacts (practitioner recommendation). Every delegation produces three artefacts: a case ID under which the matter is handled in both entities; a responsibility note with the date and the reasons for the allocation; and a documented access authorisation in the audit trail showing who had access from when. The target day for the delegation itself is given in the row 'Delegation from headquarters to the subsidiary' in the following table.

Deadlines in the reporting procedure. The table separates statutory deadlines from practitioner recommendations: the column 'Type' states for each row which of the two categories applies; the column 'Legal area' names the legal area to which the row applies.

4. Ensuring EU conformity

In day-to-day operation, three documented strands above all contribute to EU conformity: data protection, confidentiality (§ 8 HinSchG, section 3) and protection against reprisals. Whether group outsourcing as such conforms to the Directive has not been conclusively settled; no infringement proceedings by the European Commission against Germany on this point are pending (sections on the legal framework and 5). The second strand, confidentiality under § 8 HinSchG, is dealt with in section 3 — the other two follow here. For all three the same applies: the organisational form chosen for the internal reporting office under § 14 HinSchG should be documented so that, in the event of an inspection, it can be shown who performs which task for which legal entity.

Data protection building blocks for each subsidiary. The processing activity 'reporting office' belongs in the record of processing activities. In Germany a data protection impact assessment under Art. 35 GDPR must also be carried out — the provision requires it in advance where a type of processing is likely to result in a high risk to the rights and freedoms of natural persons; in Austria it is dispensable under § 8(13) HSchG in conjunction with Art. 35(10) GDPR. Where the software is operated by a service provider, a data processing agreement under Art. 28 GDPR is required: it must set out the subject matter and duration of the processing, its nature and purpose, the type of personal data, the categories of data subjects and the obligations and rights of the controller (Art. 28(3) GDPR). Added to this are a set of technical and organisational measures specific to the reporting office — need-to-know within the reporting office team, encrypted storage, a separate audit trail for each subsidiary and tenant separation (section 3 and the FAQ on data distribution) — and privacy notices for whistleblowers and accused persons; as to timing, receipt in the channel is advisable for whistleblowers and inclusion in the case file for accused persons (practitioner recommendation). The deletion periods are set out in the table in section 3.

Subsidiary ↔ headquarters: Art. 26 or Art. 28 GDPR? Whether Art. 26 GDPR (joint controllers) or Art. 28 GDPR (data processing agreement) applies between subsidiary and headquarters is determined by the allocation of roles in case handling — and with it which contractual document arises for each subsidiary. If headquarters processes the report data exclusively on behalf of and on the instructions of the subsidiary, processing on behalf within the meaning of Art. 28(1) GDPR is the likely classification; each subsidiary then needs a data processing agreement with the minimum content of Art. 28(3) GDPR set out above. If headquarters participates in decisions on case handling — for example through its own triage and investigation decisions under the matrix in section 3 — it is not acting merely on instructions; joint controllership under Art. 26 GDPR then comes into consideration, and the document for each subsidiary is an agreement under Art. 26 GDPR rather than a data processing agreement.

You should determine which of the two constellations applies for each subsidiary, agree it with your data protection function and document it; the FAQ answer on data distribution at the end of this article assumes the Art. 26 constellation.

Hosting and third-country components. EU hosting is preferable in the hybrid model; where the group uses a platform with third-country components — typically a US host — those components should be clearly documented. Practitioner recommendation for anchoring this in the documentation: record the hosting location and the sub-processors used for each subsidiary in the record of processing activities under the entry 'reporting office' and in the data processing agreement documentation, and separately identify access from third countries (support, administration, maintenance) there. Clarify with your data protection function before roll-out which legal basis a transfer to a third country relies on — this article makes no statement on that.

Protection against reprisals in the group line. § 36(1) HinSchG prohibits reprisals against whistleblowers, including threats and attempts. Where a whistleblower suffers a work-related detriment and claims to have suffered it as a result of the report, it is presumed to be a reprisal — the burden of proof then lies with the person causing the detriment (§ 36(2) HinSchG). Under § 37 HinSchG the person responsible must compensate the resulting damage; this does not create a claim to the establishment of an employment relationship or to professional advancement. Because HR decisions in a group can also be taken at levels that know nothing of the report, a documented record of independence is advisable for every HR measure taken after a report. As a practitioner recommendation, that record sets out: the occasion for and timing of the measure, the deciding person, their documented level of knowledge about the report, the objective reasons and — where available — comparable cases with no connection to a report. It is signed under the four-eyes principle by HR management and the reporting office; it is kept alongside the case documentation (deletion period § 11(5) HinSchG, table in section 3). The Regional Labour Court of Lower Saxony (LAG Niedersachsen) confirmed this two-stage test — presumption under § 36(2) HinSchG, then counter-evidence from the person causing the detriment — in its judgment of 11 November 2024 (7 SLa 306/24).

Austria: HSchG instead of HinSchG

For Austrian group companies the Austrian Whistleblower Protection Act (HSchG) applies; the comparison below names the differences with precise references.

Three differences have a direct effect on the group workflow. First, the filter applies earlier: the material scope of § 3(3) HSchG covers only the EU areas plus the corruption offences under §§ 302 to 309 of the Austrian Criminal Code (StGB) — a set of facts that falls under § 2 HinSchG in Germany is therefore not necessarily a report within the meaning of the HSchG in Austria. Second, the protection of identity under § 7 HSchG expressly also applies to mandated offices, that is, to the group office acting for an Austrian subsidiary. Third, the standard of proof for retaliation is weaker than in Germany: under § 23 HSchG prima facie evidence suffices, and retaliation is not to be assumed where there is a higher probability of another motive, which the acting person must in turn establish prima facie. In return, in Austria the person responsible owes, in addition to the restoration of the lawful situation and compensation for financial loss, also compensation for the personal detriment suffered (§ 20(1) last sentence and (2) HSchG).

All rows of the following table state the law in force in the respective legal area; it contains no practitioner recommendations.

5. Plan B if the CJEU rules against § 14

Plan B means preparing the architecture so that every subsidiary can operate its own internal reporting office without the channel, the software or the running of deadlines changing.

Technically this means: the decentralised reporting offices for each subsidiary are set up so that they can additionally be activated, and the central office is switched to 'optional' if the situation arises. This article assumes a changeover window of 6 to 12 months following a CJEU judgment against § 14 HinSchG (assessment of the first edition, as at 2 May 2026) — that is the measure of how far the following building blocks must be prepared.

What should be prepared for this (practitioner recommendation, not a statutory requirement):

• A tenant for each subsidiary already created in the central system — with sub-permissions and a separate audit log, as described in the FAQ on data distribution.
• Letter of appointment and declaration of independence for each subsidiary, ready for signature in the drawer (see section 2).
• Rules of procedure in a subsidiary version that reflect the deadlines of § 17 HinSchG (table in section 3) and describe the escalation route to the external reporting office.
• Workforce information under § 13 HinSchG prepared — a notice or intranet page with a clear explanation of the reporting routes, where only the sender still has to change.

Monitoring and sequence (practitioner recommendation): Group compliance reviews the state of conformity of § 14 HinSchG with the Directive — legislative changes as well as any proceedings by the European Commission — on a quarterly basis and records it in the annual status report parent ↔ subsidiary (table in section 3); the decision on the switch is taken by the body named in the group policy. Within the changeover window the four building blocks take effect in this order: letters of appointment and rules of procedure first, because they carry the deadlines from day 1 of the switch; tenant activation in parallel; the workforce information under § 13 HinSchG last and only after activation — otherwise the new reporting routes lead nowhere.

Why keeping this ready pays off: In Germany, anyone who fails to establish and operate an internal reporting office commits a regulatory offence — a fine of up to EUR 20,000 (§ 40(2) no. 2 in conjunction with (6) HinSchG); details on the tenfold multiplication and on the limitation period are in the FAQ 'What are the consequences if a subsidiary has no internal reporting office?'. You should keep evidence of the reporting office organisation (letters of appointment, declarations of independence, proof of expertise, versions of the group policy, tenant permissions) for at least three years — a practitioner recommendation derived from the three-year limitation period for prosecution (§ 31(2) no. 1 OWiG), not from a retention duty under the HinSchG; the deletion period in § 11(5) HinSchG and the five-year retention under § 8(11) HSchG concern the case documentation instead. A trigger for the switch would be an amendment to § 14 HinSchG or proceedings by the European Commission on conformity with the Directive (status: see the section 'Legal framework of the hybrid model').

6. Costs and effort

Based on the practitioner assessment of the first edition (as at 2 May 2026), a group hybrid is worthwhile from around five subsidiaries; the effort splits into a central platform and coordination component and a small but permanent staffing share for each subsidiary. The costs follow from the items in the table below.

The licence costs of the central software depend on the number of tenants (subsidiaries) and should be clarified through provider quotes. For the local investigation officers, half a person-day per month should be budgeted for each subsidiary, and one person-day per month for central coordination. These effort values come from the first edition of this article (as at 2 May 2026) and are experience values, not a commitment. Which cost items arise for a single internal reporting office — in-house build, SaaS solution or external ombudsperson — is described in our guide to setting one up.

The cost items at a glance:

All effort values in the table: experience values of the first edition, as at 2 May 2026 — not a commitment.

According to the first edition, the advantage of the hybrid over a fully decentralised solution lies above all in the organisational effect — one software procurement, one training run, one deadline monitoring instead of five; it bases the recommendation from five subsidiaries on this. That is a practitioner assessment, not a substantiated calculation.

Budgeted separately are the expertise training courses for the local investigation officers (section 2) and the annual self-assessment of the reporting office's effectiveness — the latter is best practice for management reporting, but not a statutory duty and therefore also not tied to any statutory cycle. As a practitioner recommendation, the self-assessment covers: compliance with deadlines in each case (table in section 3), completeness of the responsibility notes, currency of the proof of expertise (section 2) and a review of the tenant permissions. No reliable effort figures are available for it.