Whistleblower Protection Act for Law Firms: Professional Rules + Confidentiality

Main article: HinSchG: Setting up an internal reporting office — setting up the internal reporting office in eight steps, with procedural deadlines, GDPR obligations and a 30-point checklist.

1. Threshold from 50 employees

The obligation to operate an internal reporting office applies from, as a rule, 50 employees (§ 12(1) sentence 1 in conjunction with (2) HinSchG); qualified lawyers and non-lawyer staff count equally, which is why medium-sized and large firms are almost always covered.

How the count works: Headcount is decisive, not full-time equivalents: full-time, part-time and fixed-term employees, trainees, marginally employed persons, interns and temporary agency workers from six months onwards count in full; self-employed subcontractors generally do not. The transitional period under § 42 HinSchG for employers with 50 to 249 employees expired on 17 December 2023; § 40(2) no. 2 HinSchG has applied since 1 December 2023.

Sanction, competence and Austria: In Germany, anyone who fails to set up and operate an internal reporting office commits an administrative offence — a fine of up to EUR 20,000 (§ 40(2) no. 2 in conjunction with (6) HinSchG). The tenfold increase for legal persons under § 30(2) sentence 3 of the Act on Administrative Offences (OWiG) is ordered by § 40(6) sentence 2 HinSchG expressly only for § 40(2) no. 1 and 3 and (3) and (4), not for a missing reporting office. Since 15 April 2025, the Federal Office of Justice (BfJ) has been responsible for prosecuting and sanctioning administrative offences under § 40 HinSchG, in so far as implementation of the Act falls to the Federal Ministry of Justice or an authority within its remit (§ 1 HinSchGOWiZustV). The same threshold applies to firms in Austria: undertakings with 50 or more employees must set up an internal whistleblowing system (§ 3(1), § 11(1) HSchG).

2. § 203 Criminal Code (StGB): duty of confidentiality vs. whistleblowing

Client confidentiality remains protected even where there is a suspicion: a whistleblower cannot disclose a client secret by invoking the HinSchG, because the lawyers' duty of confidentiality takes precedence (§ 5(2) no. 3 HinSchG).

Legal basis: That precedence follows from § 5(2) no. 3 HinSchG — a report or disclosure falls outside the scope of the Act where the duty of lawyers to preserve confidentiality stands in its way. § 5(2) no. 5 HinSchG extends this to persons who assist in the professional activity of persons bound by professional secrecy (firm staff). § 8 HinSchG, by contrast, governs only the reporting office's confidentiality requirement and is not the basis for the precedence of confidentiality.

What § 8 HinSchG requires instead: In Germany, reporting offices must preserve the confidentiality of the identity of the whistleblower, of the persons concerned by a report and of the other persons named in the report; the identity may be made known exclusively to the persons responsible for receiving reports and taking follow-up measures and to those supporting them (§ 8(1) HinSchG). Practical recommendation for implementation in a law firm: need-to-know within the reporting office team, encrypted storage of reports and an audit trail of all access. Where an accused person requests information under Art. 15 GDPR, the widely used practical solution is a redacted response with deferral under § 29 of the German Federal Data Protection Act (BDSG).

Sanction and Austria: In Germany, an intentional breach of confidentiality carries a fine of up to EUR 50,000 and a negligent breach up to EUR 10,000 (§ 40(3) and (4) respectively, each in conjunction with (6) sentence 1 HinSchG); against legal persons, § 30(2) sentence 3 OWiG allows a tenfold increase to up to EUR 500,000. In Austria, § 7(1) and (2) HSchG protect the identity of the whistleblower including all information from which it can be derived directly or indirectly; if the content of a report becomes known to persons other than the responsible staff, those persons are prohibited from disclosing it.

3. Outsourced internal reporting office recommended

Particularly relevant for law firms: entrusting a third party under § 14(1) HinSchG (ombudsperson or independent law firm) with the tasks of the internal reporting office reduces the insider risk.

Keeping the terminology clean: An appointed ombudsperson or firm legally remains the internal reporting office in outsourced form. 'External reporting offices' within the meaning of the HinSchG are exclusively the state bodies under §§ 19 to 23 HinSchG — the federal external reporting office at the Federal Office of Justice (§ 19), the external reporting offices of the Länder (§ 20), BaFin (§ 21), the Federal Cartel Office (Bundeskartellamt) (§ 22) and further bodies (§ 23).

What outsourcing does not remove: § 14(1) sentence 1 HinSchG permits the tasks of the internal reporting office to be transferred to a third party; under sentence 2, the employer itself remains obliged to take appropriate measures to remedy a breach. The firm therefore retains responsibility for remedying the breach, even where receipt of reports and case handling take place outside the firm. Where the third party processes personal data on the firm's behalf, a data processing agreement with the minimum content of Art. 28(3) GDPR is required.

The choice does not lie with the firm: In Germany, the whistleblower alone decides whether to report internally or externally (§ 7(1) HinSchG); obstructing reports or the ensuing communication is prohibited (§ 7(2) HinSchG). Where someone turns to the state external reporting office, that office acknowledges receipt no later than seven days after receipt and provides feedback no later than three months; where handling is extensive, the period is six months, and the reasons for the extension must be communicated (§ 28(1) and (4) HinSchG). In Austria, protection likewise covers reports to internal as well as external bodies (§ 6(1) HSchG).

Firm groups with several entities: There is no infringement procedure by the European Commission against Germany concerning group-level outsourcing under § 14 HinSchG. The German procedure relating to Directive (EU) 2019/1937 was INFR(2022)0052 for late transposition; it ended with the CJEU judgment C-149/23 of 6 March 2025 (lump sum of EUR 34 million) and was closed on 4 June 2026. As at 17 August 2026, § 14 HinSchG is unchanged. Practical recommendation for groups: instead of pure group-level outsourcing, a hybrid model combining an own reporting office per entity with a joint body acting as a third party.

4. Why the beA is not a HinSchG reporting channel

Do not use the special electronic lawyer's mailbox (besonderes elektronisches Anwaltspostfach, beA, § 31a BRAO) as a HinSchG reporting channel — it serves a different purpose; the reporting channel under § 16(3) HinSchG belongs in separate reporting-office software.

Why a lawyer's mailbox does not replace the reporting channel (practical reasoning): The internal reporting office must be open to employees (§ 12(1) sentence 1 in conjunction with (2) HinSchG) — in law firms, therefore, also to non-lawyer staff. Added to this are the in-person meeting at the whistleblower's request (§ 16(3) sentence 3 HinSchG) and the access model of § 8(1) HinSchG, under which the identity may be made known exclusively to the responsible persons and to those supporting them. A mailbox with a different purpose does not map these three requirements.

What the separate channel must deliver: In Germany, § 16(3) sentence 1 HinSchG requires internal reporting channels to allow reports to be made orally or in text form — the employer has a choice here, and both forms need not be maintained in parallel. Where the oral channel is chosen, it must be possible by telephone or by another kind of voice transmission (sentence 2). The only mandatory addition is an in-person meeting at the whistleblower's request within a reasonable time (sentence 3); with their consent, video and audio transmission is also permissible (sentence 4). § 16(3) HinSchG contains no statutory deadline in days for that meeting — a common practical recommendation is to offer an appointment within 14 days. Three parallel channels (text form, telephone, in person) are common practice but not a statutory obligation.

Anonymous reports: The internal reporting office should also process reports received anonymously (§ 16(1) sentence 4 HinSchG). Under sentence 5, there is expressly no obligation to design the reporting channels so that they allow anonymous reports to be submitted; the frequently cited cut-off date of 1 January 2025 comes from a draft bill that did not become law, and the transitional provision § 42 HinSchG does not contain it. Practical recommendation for law firms: a web form without login plus an anonymous return channel.

5. § 43a BRAO: confidentiality and protection against reprisals

The lawyers' duty of confidentiality under § 43a BRAO continues to apply unchanged alongside the HinSchG — lawyers' professional duties remain untouched, and this is why a lawyer may 'blow the whistle' only to a limited extent. Where that limit runs follows from the precedence derived in section 2: § 5(2) no. 3 HinSchG excludes a report from the scope of the Act where the duty to preserve lawyers' confidentiality stands in its way; § 5(2) no. 5 HinSchG extends this to supporting firm staff.

Two questions for the assignment (practical recommendation, not a statutory assignment rule): First: does the report concern mandate-related information covered by lawyers' confidentiality? Then it falls outside the scope of the Act under § 5(2) no. 3 HinSchG — for supporting staff, under no. 5 — and the protective rights of the Act do not apply to that report. Second: does it concern an internal breach within the firm without any link to a mandate, for instance within the employment relationship? Then the protective rights apply, in so far as the report falls within the material scope of § 2 HinSchG; the following paragraph sets out what that covers in detail. Section 6, step 3, states when this assignment must be documented in the process.

What the HinSchG provides independently of this: In so far as a report falls within the scope of the Act (§ 2 HinSchG), the protective rights apply within the firm as well. § 36(1) HinSchG prohibits reprisals against whistleblowers, including threats and attempts. Where a whistleblower suffers a detriment in connection with their professional activity and asserts that they suffered it as a result of the report, it is presumed that the detriment constitutes a reprisal; the party causing the detriment must then prove that it was based on sufficiently justified grounds or that it was not based on the report (§ 36(2) HinSchG). Anyone in breach owes compensation for the resulting damage (§ 37(1) HinSchG); the breach does not give rise to a claim to the establishment of an employment relationship or to professional advancement (§ 37(2) HinSchG). Agreements that restrict the rights existing under the Act are void (§ 39 HinSchG).

Documentation and Austria: For Germany, the Regional Labour Court of Lower Saxony (Landesarbeitsgericht Niedersachsen) confirmed the two-stage test in its judgment of 11 November 2024 (7 SLa 306/24). Practical recommendation: for every personnel measure following a report — warning, transfer, dismissal — document the ground that is independent of the report. In Austria, measures taken in retaliation for a justified report are legally ineffective (§ 20(1) HSchG); the whistleblower need only establish the retaliation as prima facie evidence, and retaliation is not to be assumed where there is a higher probability of another motive, which the acting person must in turn establish as prima facie evidence (§ 23 HSchG). The responsible person owes restoration of the lawful situation, compensation for financial loss and compensation for the personal impairment suffered (§ 20(1) final sentence and (2) HSchG).

6. Practical implementation

1) Outsourced internal reporting office (third party under § 14(1) HinSchG) with a specialised law firm — details in section 3. 2) Training for lawyers + staff. 3) Investigation workflow compliant with the BRAO. 4) Consultation with the Bar Association (Rechtsanwaltskammer) where a breach of professional law is suspected.

On step 2 — expertise and information: § 15(2) HinSchG requires the persons entrusted with the tasks of the internal reporting office to have the necessary expertise; the provision does not prescribe legal training. Usual scope of training in practice: five to eight teaching units on procedure, confidentiality, the GDPR interface, protection against reprisals and fact-finding. Staff must be informed about the reporting routes under § 13 HinSchG — in law firms, typically via the intranet and a notice.

On step 3 — assignment first, then the two deadlines: In practice, compliance with the BRAO means first recording the assignment test from section 5 in the case file before any investigative steps begin, and keeping the report file separate from the mandate file so that the access limit of § 8(1) HinSchG is observed. Only then do the deadlines of the procedural rules start to run: in Germany, the internal reporting office acknowledges receipt of the report to the whistleblower no later than seven days (§ 17(1) no. 1 HinSchG). Within three months of the acknowledgement of receipt, feedback follows on the planned and already taken follow-up measures and the reasons for them; where receipt was not acknowledged, the period runs for three months and seven days from receipt (§ 17(2) HinSchG). The documentation must be deleted three years after the procedure has been concluded (§ 11(5) HinSchG); longer retention is permissible only in so far as it is legally required. In Austria, retention is five years (§ 8(11) HSchG). Practical recommendation: document an annual self-assessment of effectiveness — compliance with deadlines, confidentiality, training status. There is no statutory audit obligation for this in Germany.

On step 4 — when to involve the Bar Association (practical recommendation): The trigger is a reported set of facts concerning the professional duties of an admitted lawyer, not a purely employment-law or general compliance breach. The contact point is the competent Bar Association. The HinSchG procedure continues independently of this: the deadlines of § 17 HinSchG — seven days for acknowledgement of receipt, three months for feedback — must still be met, and § 8(1) HinSchG applies unchanged: the identity may be made known exclusively to the persons responsible for receiving reports and taking follow-up measures and to those supporting them.

Knowingly incorrect reports: § 38 HinSchG obliges the whistleblower to compensate the damage arising from an intentional or grossly negligent report or disclosure of incorrect information; in such cases, the protection of their identity also ceases to apply (§ 9(1) HinSchG).

Data protection accompaniments: The processing activity 'reporting office' belongs in the record of processing activities; added to this are data protection notices for whistleblowers and for accused persons as well as a separate concept of technical and organisational measures. In Germany, a data protection impact assessment under Art. 35 GDPR must be carried out for the reporting office; in Austria it is dispensable under § 8(13) HSchG in conjunction with Art. 35(10) GDPR.

7. Austria: HSchG instead of HinSchG

This article describes the German legal position (HinSchG, BRAO, § 203 StGB, beA). For law firms in Austria, the Austrian Whistleblower Protection Act (HinweisgeberInnenschutzgesetz, HSchG) applies instead. The only things without a counterpart are the German institutions as such (BRAO, beA, Federal Office of Justice): professional law for lawyers with bar discipline very much exists in Austria — the Lawyers' Code (Rechtsanwaltsordnung, RAO) and the Disciplinary Statute for Lawyers and Trainee Lawyers (Disziplinarstatut für Rechtsanwälte und Rechtsanwaltsanwärter), which the HSchG expressly names in § 4(1) no. 6 and no. 12 as prevailing sectoral legislation (the HSchG applies there only in so far as the matter is not already regulated in those acts). And the substantive core of this article — the precedence of lawyers' confidentiality — also has an Austrian counterpart.

8. Deadlines and sanctions: Germany and Austria in direct comparison

The core obligations run largely in parallel — the threshold of 50, the 7-day acknowledgement of receipt, the 3-month feedback and the protection of identity apply in both legal systems; what differs is the material scope, the state external body, the retention period, the evidentiary rule for reprisals and the range of sanctions. Every entry in the following table is a statutory requirement with the source cited in each case; practical recommendations are not part of the table and are expressly marked as such elsewhere in the article.