HinSchG Group Reporting Channel: What is Permissible (2026)

1. § 14 HinSchG: group reporting office

In Germany the group reporting office is permissible as a result of interpretation, not as an expressly regulated case: § 14 HinSchG is headed "Organisational forms of internal reporting offices" ("Organisationsformen interner Meldestellen") — the provision contains no explicit group wording. Under § 14(1) sentence 1, an internal reporting office may be set up by entrusting "a … employed person, a … organisational unit or a third party with the tasks of an internal reporting office". The group solution is derived from this "third party" ("Dritter") variant: another group company (for example the group headquarters) may be entrusted as a "third party". The same variant also supports the classic outsourcing to a law firm or an ombudsperson.

Important: § 14(1) sentence 2 clarifies that entrusting a third party "does not release the entrusting employer from the obligation to take appropriate measures itself in order to remedy any breach". Responsibility therefore remains with the subsidiary. A genuine "joint office" of several employers is regulated separately in § 14(2) — and is limited there to undertakings with, as a rule, 50 to 249 employees. For a subsidiary with 300 employees, § 14(2) is therefore not available; the group solution then relies on the third party variant of subsection 1.

The obligation to set up an office attaches to the individual employer, not to the group: § 12(1) sentence 1 HinSchG obliges employers to ensure that at least one internal reporting office is set up and operated; under § 12(2) this applies to employers with, as a rule, at least 50 employees each. Irrespective of the number of employees, the obligation applies to the employers named in § 12(3) HinSchG — these include, among others, investment services firms, stock exchange operators, institutions under the Banking Act and the Investment Firm Act, capital management companies, insurance undertakings as well as crypto and payment services institutions. A small insurance or payment services subsidiary with 12 employees may therefore be obliged to set up an office even though it does not reach the threshold of 50.

Requirements of the group solution (third party variant of § 14(1)):

• Entrusting another group company as a "third party" under § 14(1) sentence 1 — under § 12(1) sentence 1 in conjunction with (2) HinSchG the obligation to set up an office applies to each employer individually; the entrustment must therefore cover every company concerned.
• Written agreement of the participating undertakings — it evidences that the reporting office is set up and operated within the meaning of § 12(1) sentence 1 HinSchG; § 40(2) no. 2 in conjunction with (6) HinSchG makes the absence of a set-up and operated internal reporting office subject to a fine of up to EUR 20,000.
• Delegation agreement with a defined hand-back point (practice, no statutory form requirement) — for the minimum points to be regulated see the FAQ "How do we implement the group solution in practice?"
• Confidentiality under § 8 HinSchG also applies within the group — no group-wide read access to case files.
• Limit on contractual arrangements: § 39 HinSchG — agreements that restrict the rights of whistleblowers or other protected persons are void.

2. The European Commission objection

An objection by the European Commission to deriving the group reporting office from § 14 HinSchG is not substantiated: there are no infringement proceedings against Germany concerning § 14 HinSchG. The German proceedings concerning Directive (EU) 2019/1937 were INFR(2022)0052 for late transposition; they ended with the judgment of the Court of Justice of the European Union of 6 March 2025 in Case C-149/23 (lump sum of EUR 34 million) and were closed on 4 June 2026. The substantive starting point of the discussion remains the text of the Directive itself, which attaches the obligation to the legal entity with 50 or more workers.

The point of reference in the Directive is Art. 8: under Art. 8(1) of Directive (EU) 2019/1937, legal entities in the private and the public sector must establish internal reporting channels and procedures; under Art. 8(3) this obligation applies to legal entities in the private sector with 50 or more workers. It is precisely this link to the legal entity that the criticism of the German transposition addresses.

As at 17 August 2026, § 14 HinSchG is unchanged and no infringement proceedings by the European Commission against Germany concerning this provision are pending — at national level the group reporting office under § 14 is therefore lawful; whether pure group outsourcing satisfies the link of Art. 8 of Directive (EU) 2019/1937 to the legal entity in every constellation has not been clarified by the courts. Practical recommendation: before taking a set-up decision, check the current status of infringement proceedings with the European Commission and record the result with the date in the compliance documentation.

For planning purposes this means: the point at issue is § 14 HinSchG. The ongoing procedural duties of an internal reporting office are set out in other provisions — deadlines in § 17 HinSchG, confidentiality in § 8(1) HinSchG, reporting channels in § 16(3) HinSchG, expertise in § 15(2) HinSchG — and must be met irrespective of the organisational model. Practical recommendation (not a legal obligation): group compliance officers should use hybrid models — the subsidiary's own reporting office plus the group office as a third party — rather than pure group outsourcing for as long as the question remains open.

3. Three models compared

The hybrid model is recommended: it keeps the formal reporting office at each subsidiary — the link of Art. 8 of Directive (EU) 2019/1937 to the legal entity — and bundles case handling centrally. The centralised model is the construction that sparks the discussion about this link; no infringement proceedings exist in that respect (as at 17 August 2026). The decentralised model does not raise the question, but generates the effort at each company. The procedural duties under §§ 8, 15, 16 and 17 HinSchG must be met in each of these models; what differs is where the formal reporting office sits and who operates it. Specific cost ranges are given in the FAQ "What does a group reporting office cost?".

Centralised: a reporting office at the group headquarters is entrusted by all subsidiaries as a "third party" under § 14(1) sentence 1 HinSchG. The advantage is the bundled expertise under § 15(2) HinSchG. In the centralised model too, the duty to remedy remains with each entrusting subsidiary (§ 14(1) sentence 2 HinSchG).

Decentralised: each company sets up its own internal reporting office under § 12(1) sentence 1 HinSchG and operates it itself. This corresponds to the link of Art. 8(1) and (3) of Directive (EU) 2019/1937 to the legal entity. The effort arises at each company: reporting channels under § 16(3) HinSchG, expertise under § 15(2) HinSchG, deadline monitoring under § 17 HinSchG and an own confidentiality concept under § 8(1) HinSchG.

Hybrid: the effort at each subsidiary is limited to the formal set-up, the local contact point and informing the workforce; case handling, deadline management and documentation run centrally (structure: section 4). The initial set-up effort is higher here than in the centralised model.

Which company is subject to which obligation is determined by the addressee of the respective provision: § 12(1) sentence 1 and (2) HinSchG address the employer, § 14(1) sentence 2 HinSchG the entrusting employer, §§ 8 and 17 HinSchG as well as § 16(1) sentence 4 HinSchG the internal reporting office; the expertise under § 15(2) HinSchG concerns the persons entrusted with the tasks. The choice of model shifts the work, not the addressee.

4. The hybrid model — practical recommendation

The hybrid model is a practical recommendation, not a statutory requirement: it combines the formal reporting office at each subsidiary with operational case handling at the group headquarters. Structure:

1. Group reporting office at headquarters — operationally active, professionally qualified team. Why centrally: § 15(2) HinSchG requires the necessary expertise of the persons entrusted — the act does not require legal training. Training of 5 to 8 teaching units is customary in practice; that is an empirical value, not a statutory requirement.
2. Local contact point at each subsidiary — formally set up, may be a person (head of HR, compliance officer) or an external person of trust. § 14(1) sentence 1 HinSchG names exactly these forms: employed person, organisational unit or third party. The minimum channel standard follows from § 16(3) HinSchG: reports orally or in text form (sentence 1), orally by telephone or other voice transmission (sentence 2), and, mandatorily, a personal meeting on request within a reasonable time (sentence 3). Offering text form, telephone and a personal conversation in parallel is a widespread practice standard, not a statutory obligation. The internal reporting office should process anonymous reports (§ 16(1) sentence 4 HinSchG); under sentence 5 there is expressly no obligation to open the channels for anonymous submission.
3. Delegation agreement between the subsidiary and the group headquarters — operational case handling is delegated to headquarters, formal responsibility remains with the subsidiary. The minimum points to be regulated in the agreement are set out in the FAQ on practical implementation.
4. Joint controller arrangement under Art. 26 GDPR for the exchange of data. In addition, the following belong to this: a data processing agreement with the IT service provider of the reporting platform under Art. 28(1) and (3) GDPR — under Art. 28(1) GDPR the controller may only work with processors that provide sufficient guarantees for appropriate technical and organisational measures; a data protection impact assessment under Art. 35(1) GDPR (for German companies; on the AT deviation see section 5); the response period of one month under Art. 12(3) GDPR (extendable by two months) for data subject requests; and the deletion period of three years after conclusion of the procedure (§ 11(5) HinSchG).
5. Freedom of choice for whistleblowers — they may turn to the local contact point OR the central group reporting office; the right to choose between internal and external reporting (§ 7(1) and (2) HinSchG) belongs in any event to the reporting person alone. The federal external reporting office is the Federal Office of Justice (BfJ) (§ 19(1) HinSchG); in addition, special external reporting offices exist at BaFin (§ 21 HinSchG) and at the Federal Cartel Office (Bundeskartellamt) (§ 22 HinSchG — competition law and the Digital Markets Act).

Practice rhythm (not a statutory deadline): a documented annual self-assessment of effectiveness at each subsidiary — compliance with deadlines, confidentiality, training status — is best practice for management reporting; no statutory audit obligation follows from this. Also practice and not law: keeping the proof of expertise of the entrusted persons no older than three years.

5. Group reporting office in AT/CH

In Austria the outsourced or joint internal office is expressly permissible (§ 13(4) HSchG); in Switzerland there is no dedicated whistleblower protection act — a group reporting office is possible, but without the protection against employment law consequences that DE and AT provide.

Austria: the Austrian Whistleblower Protection Act (HSchG) regulates the joint or outsourced internal office in § 13(4) HSchG: undertakings may "in each case transfer the tasks of the internal office to a joint office"; "third parties may also be commissioned" with these tasks. The rights and obligations of the internal office also apply to the commissioned office. Functionally this corresponds to the German "third party" variant of § 14(1) HinSchG and is not a stricter special rule — the subsidiary's own responsibility remains in place in both legal systems.

Austrian law applies throughout to an Austrian subsidiary (references in the table). What is relevant for the decision is the narrower material scope: § 3(3) HSchG covers the EU areas plus corruption offences under §§ 302 to 309 of the Criminal Code, whereas § 2(1) nos. 1 to 3 HinSchG covers all breaches subject to criminal penalties. Practical consequence: anyone applying the same case acceptance rule group-wide will also accept reports in Austria that fall outside the statutory scope — this decision should be taken deliberately and recorded in the group policy.

The following overview compares the two legal areas; the German and the Austrian references each apply only to their own legal area.

Switzerland: no dedicated whistleblower protection act. Art. 321a of the Code of Obligations (duty of confidentiality) and Art. 336 of the Code of Obligations (wrongful termination) apply. A group reporting office is possible, but there is no protection against employment law consequences as in DE/AT. In data protection terms, the CH subsidiary does not need a transfer instrument for third countries: an adequacy decision of the European Commission exists for Switzerland (Art. 45 GDPR), and transfers to the CH subsidiary require neither standard contractual clauses nor a framework. Practical consequence: include the CH subsidiary in the joint controller arrangement under Art. 26 GDPR, not in the SCC package for third countries. Since the protection against reprisals under §§ 36, 37 HinSchG and §§ 20, 23 HSchG does not apply there, any assurance given to CH whistleblowers must be arranged contractually if it is to apply.

6. Six-step checklist for the group set-up

Building a group solution follows six steps — from mapping the companies to informing the workforce. The order and the implementation proposals are practical recommendations; the section references named indicate the respective statutory basis.

1. Map the group structure: identify all legal entities with ≥50 employees — the obligation trigger under HinSchG. Counting is by heads, not by full-time equivalents (§ 12(2) HinSchG). In addition, mark the companies that are obliged to set up an office under § 12(3) HinSchG irrespective of the number of employees. For Austrian companies the threshold of 50 workers under § 3(1) in conjunction with § 11(1) HSchG applies.
2. Choose a model: hybrid recommended; risk assessment centralised vs. decentralised. The basis for the decision is the number of companies obliged to set up an office, the fact that no infringement proceedings are pending concerning § 14 HinSchG (as at 17 August 2026), and the question of where the expertise under § 15(2) HinSchG can realistically be built up.
3. Draw up a group policy: procedures, responsibilities, escalation, feedback workflows. The policy should operationalise the statutory deadlines of § 17 HinSchG; the limit of § 39 HinSchG and the right to choose under § 7(1) HinSchG must be observed (section 1).
4. Appoint local contact points: at least 1 person per subsidiary, with training under § 15(2). Prove and document expertise; availability via the channels of § 16(3) HinSchG.
5. Joint controller + DPIA arrangement: the GDPR interface. For an Austrian subsidiary the DPIA is not required under § 8(13) HSchG in conjunction with Art. 35(10) GDPR, and retention there is 5 years (§ 8(11) HSchG).
6. Informing the workforce: § 7(3) sentence 2 HinSchG (clear and easily accessible information about the internal reporting procedure) and § 13(2) HinSchG (information about external reporting procedures) — communicate both reporting routes (local + group) in a documented manner. The external procedures include the Federal Office of Justice (BfJ) (§ 19(1) HinSchG) as well as the special offices at BaFin (§ 21) and the Federal Cartel Office (Bundeskartellamt) (§ 22); for Austrian companies the BAK (§ 15(1) HSchG) with the sectoral special competences under § 15(2) HSchG (among others the Financial Market Authority, the Federal Competition Authority, the Auditor Oversight Body).

Counting aid for step 1 — counting by heads under § 12(2) HinSchG, not full-time equivalents: