HinSchG vs. International Whistleblower Laws: 2026 Comparison

On the scope of this comparison: The focus is Directive (EU) 2019/1937 and its implementations in Germany (HinSchG) and Austria (HSchG) — with references, time limits and operating parameters. The United Kingdom and the United States are placed in context rather than set out in full; Switzerland is not covered by this comparison.

Main article: HinSchG: setting up an internal reporting channel — obligation from 50 employees, reporting channels, procedural time limits, confidentiality, protection against retaliation and GDPR obligations of the reporting channel.

1. EU Directive 2019/1937

Directive (EU) 2019/1937 is a minimum standard that Germany and Austria fill in differently: Germany goes beyond the Directive on the material scope (§ 2(1) HinSchG) and on the law of evidence (§ 36(2) HinSchG) (section 2); Austria is stricter than German law on the retention period (five years, § 8(11) HSchG) and on the express compensation for personal detriment suffered (§ 20(1) last sentence and (2) HSchG) — on the scope and on the standard of proof, by contrast, Austria falls short of German law (section 3). On the core obligations, the two implementations run largely in parallel. Binding requirements are internal reporting channels in legal entities in the private sector from 50 workers (Art. 8(1) and (3)), an acknowledgement of receipt within seven days (Art. 9(1)(b)), feedback within a maximum of three months (Art. 9(1)(f)), protection of the identity of the reporting person (Art. 16(1)) and a prohibition of any form of retaliation, including threats and attempts (Art. 19). How far a Member State goes beyond this is left to it.

Anonymous reporting channels are mandatory neither in Germany nor in Austria: neither the EU Directive nor the German HinSchG requires them. Under § 16(1) sentences 4 and 5 HinSchG (internal reporting channel) and § 27(1) sentences 3 and 4 HinSchG (external reporting channel), the reporting channel 'should' also process reports received anonymously — 'there is, however, no obligation to design the reporting channels in such a way that they allow anonymous reports to be submitted'. A common misconception: the widely cited cut-off date of 1 January 2025 for anonymous reporting channels comes from an earlier draft bill that did not become law — neither the HinSchG nor its transitional provision, § 42 HinSchG, contains it.

Three requirements of the Directive are regularly overlooked in group projects. First, the reporting routes: reporting persons may report externally after first having reported internally, or directly externally (Art. 10); in Germany, § 7(1) HinSchG expressly assigns this choice to the reporting person, while in Austria § 6(1) HSchG protects reports to internal and to external bodies alike. Second, compensation: full compensation must be provided for damage suffered by protected persons in accordance with national law (Art. 21(8)). Third, the non-waivable nature of the rights: the rights under the Directive cannot be waived or limited by any agreement, policy or condition of employment — including a pre-dispute arbitration agreement (Art. 24); in Germany, § 39 HinSchG implements this.

2. Germany: where the HinSchG goes beyond the EU minimum standard

The HinSchG goes beyond the Directive above all on the material scope and on the law of evidence. Under § 2(1) nos. 1 to 3 HinSchG, the Act applies to reports and disclosures concerning criminally sanctioned breaches, concerning breaches subject to administrative fines in so far as the provision infringed serves to protect life, limb or health or to protect the rights of employees or their representative bodies, and concerning other breaches of numerous listed federal, Länder and EU legal provisions. The Directive itself, by contrast, covers only the areas of Union law named in its Annex, as well as breaches affecting the financial interests of the Union and breaches of internal market rules, including competition and State aid law (Art. 2(1)).

On protection against retaliation, § 36(2) HinSchG reverses the burden of proof in full: where a reporting person suffers a detriment in connection with their professional activity and claims to have suffered it as a result of a report or disclosure, the detriment is presumed to be retaliation — the party causing the detriment must then prove that it was based on sufficiently justified grounds or was not based on the report. The Austrian standard, with prima facie evidence under § 23 HSchG, falls short of this.

Not every HinSchG rule goes beyond the Directive — two points are nevertheless regularly misunderstood in implementation projects. First, the reporting channels: § 16(3) sentence 1 HinSchG requires internal reporting channels to allow reports 'orally or in text form' — to that extent the employer has a choice, and it is not mandatory to keep both forms available in parallel. If the oral channel is chosen, it must be possible by telephone or by another form of voice transmission (sentence 2). The only mandatory addition is a physical meeting at the request of the reporting person within a reasonable period (sentence 3; with that person's consent also by video and audio transmission, sentence 4). Three parallel channels are widespread best practice and reduce the risk of dispute, but they are not a statutory obligation.

Second, the protection of the other side: under § 38 HinSchG, the reporting person is liable to compensate the damage arising from an intentional or grossly negligent report or disclosure of incorrect information; in such cases, protection of identity also ceases to apply (§ 9(1) HinSchG). Conversely, the reporting person cannot be held responsible for obtaining the reported information, provided that obtaining it does not in itself constitute a separate criminal offence (§ 35 HinSchG).

3. Austria: Whistleblower Protection Act (HSchG) 2023

The Austrian HSchG implements the same Directive, but differs noticeably from the German HinSchG in four respects among others: a narrower material scope, a different external body, a weaker standard of proof and a lower range of penalties (amounts and competence in section 4). The core obligations, by contrast, run in parallel — the individual references are shown in the comparison table in section 1.

Scope: § 3(3) in conjunction with (4) and (5) HSchG covers reports of infringements in the EU areas — public procurement, financial services and the prevention of money laundering, product safety, transport safety, environmental protection, radiation protection, food and feed safety, public health, consumer protection, data protection — plus the corruption offences under §§ 302 to 309 StGB. It therefore does not cover all criminal offences in the way German law does. The practical consequence for groups: a report that falls under § 2 HinSchG in Germany may lie outside the HSchG in Austria — the case handling playbook therefore needs an allocation check for each legal area (procedure in section 5).

External body and time limits: The Federal Bureau of Anti-Corruption (BAK) is competent for all reports of legal infringements at private or public sector entities (§ 15(1) HSchG); sectoral special competences take precedence, including the Financial Market Authority (FMA), the Federal Competition Authority and the Auditor Oversight Authority (§ 15(2) HSchG). The external body acknowledges receipt within seven calendar days (§ 9(1) HSchG) and communicates the results it has reached at the latest three months, or in duly justified cases at the latest six months, after receipt (§ 17(6) HSchG).

Standard of proof: To establish retaliation, prima facie evidence suffices in Austria — retaliation is not to be assumed where there is a higher probability of another motive, which the person acting must in turn establish on a prima facie basis (§ 23 HSchG). The legal consequences are governed by § 20 HSchG: retaliatory measures are legally ineffective, and those expressly named are suspension, dismissal, demotion, withholding of promotion, transfer of duties, reduction in remuneration, disciplinary measures and withdrawal of a licence (§ 20(1) HSchG). Whoever is responsible for a retaliatory measure owes restoration of the lawful state of affairs, compensation for the pecuniary damage and compensation for the personal detriment suffered (§ 20(1) last sentence and (2) HSchG) — unlike § 37 HinSchG, Austria thus provides an express claim for non-material compensation.

4. Penalties and competence for fines in Germany and Austria

The German range of fines is graduated by offence (up to EUR 500,000) and is pursued — within the scope of the HinSchGOWiZustV, see below — by the Federal Office of Justice; the Austrian range is uniform (up to EUR 40,000) and lies with the district administrative authority. In Germany, the fine ranges, depending on the breach, from EUR 10,000 to EUR 50,000 against natural persons; for legal persons, a tenfold increase is possible via § 30(2) sentence 3 of the German Administrative Offences Act (OWiG) — up to EUR 500,000. An exception is the offence of failing to set up an internal reporting channel: for it, § 40(6) sentence 2 HinSchG does not order the tenfold increase, and the amount remains EUR 20,000.

The table shows three practically relevant offences under § 40 HinSchG in overview; the list is not exhaustive.

Austria: Whoever obstructs or puts pressure on a protected person in making a report, takes a retaliatory measure, breaches confidentiality under § 7 or § 17(1) HSchG or knowingly gives a false report commits an administrative offence and is to be punished by the district administrative authority with a fine of up to EUR 20,000, or up to EUR 40,000 in the event of a repeat offence (§ 24 HSchG). The HSchG does not provide for a separate higher rate for legal persons as Germany does.

Competence in Germany: The Whistleblower Protection Act Administrative Offences Competence Ordinance (HinSchGOWiZustV) of 9 April 2025 was promulgated in BGBl. 2025 I Nr. 111 (issued on 14 April 2025) and has been in force since 15 April 2025. § 1 HinSchGOWiZustV transfers the prosecution and sanctioning of administrative offences under § 40 HinSchG to the Federal Office of Justice — but only in so far as the execution of the Act is incumbent on the Federal Ministry of Justice or on an authority within its portfolio; outside that portfolio, the general rules on competence continue to apply. In Austria, the district administrative authority imposes the penalty (§ 24 HSchG); there is no equivalent there to the HinSchGOWiZustV.

5. Groups with German and Austrian companies: what differs by legal area

Four operating parameters differ in law between Germany and Austria: scope, standard of proof, retention period and data protection impact assessment. A group solution must cover all jurisdictions; a uniform group minimum standard is not sufficient for this. In law, each legal entity is governed by its national law: Austrian entities do not fall under the German HinSchG but under the HSchG. As a group-wide standard, the stricter rule for each individual requirement suggests itself — as a practical recommendation, not a statutory requirement: predominantly the HinSchG, and for the retention period and non-material compensation the HSchG. The obligation to set up a channel attaches to the individual employer — in Germany to employers with, as a rule, at least 50 employees (§ 12(1) sentence 1 in conjunction with (2) HinSchG), in Austria to undertakings with 50 or more workers (§ 3(1) in conjunction with § 11(1) HSchG).

Outsourcing is permitted but does not relieve the employer entirely: § 14(1) sentence 1 HinSchG allows the tasks of the internal reporting channel to be transferred to a third party — for example to a law firm or an ombudsperson. The obligation to take appropriate measures to put a stop to a breach, however, remains with the employer itself (§ 14(1) sentence 2 HinSchG). There is no infringement procedure by the European Commission against Germany concerning this group outsourcing solution; the German procedure on Directive (EU) 2019/1937 was INFR(2022)0052 for late transposition and ended with the judgment of the Court of Justice in C-149/23 of 6 March 2025 (lump sum EUR 34 million). As at 17 August 2026: procedure closed on 4 June 2026, and § 14 HinSchG was not amended. Practical recommendation (not a statutory requirement): a hybrid model with its own reporting channel at each subsidiary plus the group body as a third party, instead of pure group outsourcing.

Size is not the only criterion: In Germany, the obligation applies to the employers named in § 12(3) HinSchG irrespective of the number of employees — these include, among others, investment services firms, stock exchange operators, institutions under the German Banking Act (KWG) and the German Investment Firm Act, capital management companies, insurance undertakings and crypto and payment services institutions. A small financial subsidiary within a group may therefore be obliged to set up an internal reporting channel even though it does not reach the threshold of 50.

How the count is made: In Germany, a headcount applies to the threshold of 50, not full-time equivalents (§ 12(1) sentence 1 in conjunction with (2) HinSchG). Under common counting practice — not an express statutory list — full-time, part-time and fixed-term employees, trainees, employees in marginal employment, interns and temporary agency workers from six months onwards count in full; self-employed subcontractors as a rule do not count. For Austrian entities, the method of counting must be clarified separately — this article does not evaluate any source on that point.

Two operating details differ in law from one another: the retention period for the documentation and the data protection impact assessment for the reporting channel — period, requirement and references are set out in the following table.

Practical recommendation (not a statutory requirement): keep two separate date fields in the case handling tool (receipt/incoming and acknowledgement); attach the three-month clock for Austrian entities to the date of receipt, and for German entities to the date of acknowledgement.

Allocation check by legal area — the four steps by which an incoming report is allocated to a regime in the case handling playbook (practical procedure, not a statutory requirement):

1. Determine the legal entity and the seat of the company concerned — the obligation to set up a channel attaches to the individual employer, not to the group. Responsible: internal reporting channel, on the day of receipt, at the latest before the acknowledgement of receipt.
2. Check the material scope: § 2(1) HinSchG for German entities, § 3(3) in conjunction with (4) and (5) HSchG for Austrian entities. Responsible: internal reporting channel, on the day of receipt, at the latest before the acknowledgement of receipt.
3. If the matter at an Austrian subsidiary does not fall under § 3(3) HSchG, determine how it is to be handled under internal policy. Whether statutory protection applies must be assessed separately: under § 6(1) HSchG, a person is protected who had sufficient grounds to believe that the report was true and that it fell within the scope of the Act. Responsible: internal reporting channel together with the competent specialist function/legal department.
4. Apply the time limit and retention regime of the relevant legal area: feedback under § 17(2) HinSchG or § 13(9) HSchG respectively, retention of three years (§ 11(5) HinSchG) or five years (§ 8(11) HSchG) respectively. As an entry in the deadline calendar with a follow-up date.

6. UK Public Interest Disclosure Act 1998

The United Kingdom has protected whistleblowers since 1998 through the Public Interest Disclosure Act (PIDA) — the oldest of the whistleblower laws compared here. The individual provisions of the PIDA are not evaluated in this article; the official full text is authoritative (sources block).

7. US Sarbanes-Oxley + Dodd-Frank

US law works with a different mechanism from the HinSchG and the HSchG: alongside Sarbanes-Oxley (2002), Dodd-Frank (2010) relies on a financial reward through the SEC Whistleblower Program (Dodd-Frank Section 922) — under it, whistleblowers can receive 10 to 30 % of the penalty. Directive (EU) 2019/1937 instead relies on the prohibition of retaliation (Art. 19) and on full compensation in accordance with national law (Art. 21(8)); see the FAQ. The individual provisions of SOX and Dodd-Frank are not evaluated in this article; the official source is authoritative (sources block).