HinSchG: Top 8 SME Questions in 2026

1. Do we have to have an internal reporting office?

Mandatory from 50 employees as a rule (§ 12(1) sentence 1 in conjunction with (2) HinSchG). Below 50: no obligation in principle, but recommended — exception: for the employers (Beschäftigungsgeber) listed in § 12(3) HinSchG the obligation applies irrespective of the number of employees; these include, among others, investment services firms, stock exchange operators, institutions under the German Banking Act (KWG) and the German Investment Firm Act, capital management companies, insurance undertakings as well as crypto and payment services institutions. Many of them are SMEs themselves. In a group of companies: separate rules apply (§ 14, hybrid models).

The wording of the Act requires that "at least one internal reporting office is set up and operated" — merely setting one up is therefore not enough, ongoing operation is part of the obligation. What is counted is heads, not full-time equivalents. This is how practice counts towards the threshold in § 12(2) HinSchG:

The transitional provision in § 42 HinSchG concerns exclusively two dates that have already passed: the set-up deadline for employers with 50 to 249 employees (17 December 2023) and the applicability of § 40(2) no. 2 HinSchG (1 December 2023). For Austrian sites the obligation applies independently under § 3(1) in conjunction with § 11(1) HSchG from 50 employees.

2. Which reporting channels do we have to offer?

What is mandatory is exactly one reporting format — oral or text form — plus the physical meeting at the whistleblower's request (§ 16(3) sentences 1 and 3 HinSchG); the wording of sentence 1 requires reports "in oral or text form", so keeping both formats available in parallel is not compulsory. If the oral channel is chosen, it must be possible by telephone or by another means of voice transmission (sentence 2). The physical meeting must be made possible within a reasonable time (sentence 3; with the whistleblower's consent also by video and audio transmission, sentence 4). Three parallel channels (text form + telephone + in person) are widespread best practice and reduce the risk of dispute, but they are not a statutory obligation. Whether anonymous channels are mandatory — and what lies behind the widely circulated cut-off date of 1 January 2025 — is answered in the FAQ "Do we have to make anonymous reports possible?".

The following table separates the two: column 2 states what the law requires — and, for anonymous reports, what it expressly does not require — while column 3 names practical solutions without statutory force.

3. Is an external reporting office sufficient?

No — companies have no right to choose. From 50 employees as a rule the employer must set up and operate an internal reporting office (§ 12(1) sentence 1 in conjunction with (2) HinSchG); failing to do so is a regulatory offence — a fine of up to EUR 20,000 (§ 40(2) no. 2 in conjunction with (6) HinSchG). What is permitted is outsourcing to a third party (§ 14(1) sentence 1 HinSchG); responsibility for remedial measures (sentence 2) and the risk of a fine remain with the employer — selection criteria are in the FAQ. The state-run external reporting office of the Federation at the Federal Office of Justice (§ 19(1) HinSchG — not a "BMJ federal office") does not replace the internal reporting office: the choice between an internal and an external report lies with the whistleblower alone (§ 7(1) HinSchG).

Three points that are regularly underestimated in SME projects. First: the external reporting office of the Federation has residual jurisdiction — it applies in so far as no special external reporting office is competent (§ 19(4) HinSchG); which office is responsible for which type of breach is set out in section 8. Second: the whistleblower should give preference to an internal report where the breach can be effectively remedied internally and no reprisals are to be feared (§ 7(1) HinSchG); this cannot be enforced, because obstructing a report or the subsequent communication is prohibited (§ 7(2) HinSchG) and subject to a fine. Third: group outsourcing under § 14 HinSchG still has to be measured against Art. 8 of Directive (EU) 2019/1937, which ties the obligation to provide internal reporting channels to every legal entity with 50 or more employees; infringement proceedings by the European Commission against Germany on this point are not pending — proceedings INFR(2022)0052 for late transposition ended with the CJEU judgment C-149/23 of 6 March 2025 and were closed on 4 June 2026; what this means in practice for group structures is set out in the FAQ.

4. How long may we retain reports?

Three years after the procedure has been closed (§ 11(5) HinSchG); longer only in so far as another legal basis requires retention. Practical recommendation: record the closing date for each case — a closing note with the date, the deciding person and the follow-up measure taken; without this note the start of the period cannot be evidenced later.

For Austrian sites the retention period is 5 years (§ 8(11) HSchG), so a single group-wide period does not reflect both legal regimes. Practical recommendation: keep the deletion rule, the deletion log and the report statistics in one document, so that the three-year and five-year limits remain traceable for each case; the deletion rule is at the same time one of the data protection building blocks of the reporting office (section "Which GDPR obligations the reporting office triggers"). Why three years is also the practical minimum is shown by the limitation period for prosecution in the section "Fines".

5. What happens in the event of reprisals against whistleblowers?

A reprisal triggers three consequences: damages payable by the person who caused it (§ 37(1) HinSchG), a reversal of the burden of proof to the detriment of the party causing the disadvantage (§ 36(2) HinSchG) and a fine of up to EUR 50,000, and up to EUR 500,000 against legal persons (§ 40(2) no. 3 HinSchG in conjunction with § 30(2) sentence 3 OWiG — the individual offences are in the section "Fines"). § 36(1) HinSchG prohibits reprisals directed against whistleblowers, including threats and attempts. Under § 37(1) HinSchG the person who caused the reprisal is obliged to compensate the damage arising from it — scope and evidence follow the general law of damages; the Act does not contain a statutory lump sum amounting to "all lost remuneration up to retirement". § 37(2) HinSchG also clarifies that a breach of the prohibition of reprisals gives rise to no claim to the establishment of an employment, vocational training or other contractual relationship and no claim to professional advancement. Reversal of the burden of proof (§ 36(2) HinSchG): if a whistleblower suffers a work-related disadvantage and claims to have suffered it as a consequence of the report, it is presumed that this constitutes a reprisal — the party causing the disadvantage then bears the burden of proof. There is no six-month period as a trigger.

Rebutting this presumption succeeds only if you can show that the measure was based on sufficiently justified grounds or was not based on the report (§ 36(2) HinSchG). The Regional Labour Court of Lower Saxony (LAG Niedersachsen) confirmed the two-stage test in its judgment of 11 November 2024 (7 SLa 306/24). Practical recommendation: for every personnel measure following an incoming report — warning, transfer, change in pay, dismissal — document the evidence of independence in writing (occasion, time at which the decision was prepared, persons involved, state of knowledge about the report). The protection cannot be contracted away: agreements restricting the rights of whistleblowers or other protected persons are invalid (§ 39 HinSchG).

6. Can we find out the whistleblower's identity?

No — beyond the circle of persons responsible for receiving reports and taking follow-up measures and those supporting them, the identity is not disclosed (§ 8(1) HinSchG). Any disclosure beyond that requires, as a rule, the whistleblower's express consent (Art. 16(1) of Directive (EU) 2019/1937); the exceptions to the confidentiality requirement are governed by § 9 HinSchG, for example in the case of intentionally or grossly negligently incorrect reports (section 7). Intentional or reckless breaches cost up to EUR 50,000 (§ 40(3) HinSchG), negligent ones up to EUR 10,000 (§ 40(4) in conjunction with (6) sentence 1 HinSchG).

Under § 8(1) HinSchG it is not only the whistleblower who is protected: the reporting offices must also preserve the confidentiality of the identity of persons who are the subject of a report and of other persons named in the report — the protection therefore expressly also covers the accused person. The EU rules additionally extend the protection to all information from which the identity can be inferred (Art. 16(1) of Directive (EU) 2019/1937). Practical recommendation for the technical implementation: a need-to-know principle within the reporting office team, encrypted storage of reports, an audit trail of all access. In Austria, § 7(1) and (2) HSchG protects the identity accordingly and prohibits persons who learn the content without authorisation from passing it on.

7. Can we defend ourselves against false reports?

Yes, but only in the case of intentionally or grossly negligently incorrect reports: the whistleblower then owes damages (§ 38 HinSchG) and loses the protection of their identity (§ 9(1) HinSchG). For the disclosure of incorrect information, § 40(1) HinSchG additionally provides for a fine of up to EUR 20,000. § 38 HinSchG covers more than intent: "The whistleblower is obliged to compensate the damage arising from an intentional or grossly negligent report or disclosure of incorrect information." In practice, however, the evidentiary threshold for intent or gross negligence remains high.

The reason for this high threshold is set out in § 35 HinSchG: a whistleblower cannot be held legally responsible for obtaining or accessing the reported information, provided that obtaining it does not in itself constitute a separate criminal offence; nor do they breach any disclosure restrictions, provided they had sufficient grounds to assume that passing the information on was necessary to uncover a breach. A report that is not subsequently confirmed therefore does not in itself meet the conditions of § 38 HinSchG — that provision requires intent or gross negligence in relation to the incorrect information. Practical recommendation: initiate countermeasures only after the facts have been fully established and document the indications of intent or gross negligence separately — otherwise employment law steps against the reporting person trigger the presumption of reprisal under § 36(2) HinSchG as soon as the reporting person claims that the disadvantage is a consequence of their report.

8. What does § 22 HinSchG do / when do you report to the Bundeskartellamt?

§ 22 HinSchG governs the external reporting office at the Bundeskartellamt for breaches of competition law (in particular antitrust law, market abuse, DMA/Digital Markets Act). A report under § 22 HinSchG comes from the whistleblower (choice between an internal and an external report: section 3). The allocation: antitrust law, market abuse and the DMA → Bundeskartellamt (§ 22 HinSchG); breaches at financial services providers → BaFin (§ 21 HinSchG); everything else → the external reporting office of the Federation at the Federal Office of Justice as residual jurisdiction (§ 19(1) and (4) HinSchG). There is NO audit obligation for companies arising from § 22 — that was an incorrect assumption in earlier sources. An annual self-assessment of the effectiveness of the internal reporting office is best practice (NOT a statutory obligation), but useful for management reporting (modelled on ISO 37301).

Nor does a "HinSchG amendment 2026" with an audit obligation from 1 January 2026 exist; the wording of § 22 HinSchG does not support such an obligation. What has changed instead is responsibility for fines: since 15 April 2025 it lies with the Federal Office of Justice under the HinSchGOWiZustV, although only to a limited extent — details in the FAQ "Who imposes HinSchG fines?". Practice rhythm for the voluntary self-assessment: once a year, documented along the lines of compliance with deadlines, confidentiality, the handling of anonymous reports and the training status of the reporting office officer.

Procedural deadlines in Germany and Austria at a glance

The internal reporting office must acknowledge receipt within 7 days (in Austria for written reports) and provide substantive feedback within 3 months — in Germany from the acknowledgement of receipt, in Austria from the receipt of the report. The lengths of the deadlines for the four procedural steps are the same; the retention period differs (3 years in Germany, 5 years in Austria). Every line of this table is a statutory deadline, not a practical recommendation.

Fines under § 40 HinSchG: amounts, tenfold increase, limitation

The maximum amounts in § 40 HinSchG depend on the offence. The following table reflects the German legal position only; for Austria, § 24 HSchG applies with its own amounts (see the Austria section). All amounts are statutory maximums.

What determines the limitation period is the statutory threat of a fine attached to the offence, not the amount imposed in the individual case (§ 31(2) OWiG) — which is why the negligent breach of confidentiality becomes time-barred earlier than all other offences. The most expensive individual case for an SME is not the missing reporting office, but obstructing a report, a reprisal or a breach of confidentiality — for these offences § 40(6) sentence 2 HinSchG orders the tenfold increase under § 30(2) sentence 3 OWiG, but not for the missing reporting office.

Which GDPR obligations the reporting office triggers

An internal reporting office is a processing activity in its own right and needs six data protection building blocks: an entry in the record of processing activities, a data protection impact assessment, data protection information for whistleblowers and accused persons, a data processing agreement where IT is outsourced, a set of technical and organisational measures specific to the reporting office, and a deletion rule. The data protection impact assessment follows Art. 35 GDPR, which requires one where processing is likely to result in a high risk to the rights and freedoms of natural persons; in Austria it is dispensable for the whistleblowing system under § 8(13) HSchG in conjunction with Art. 35(10) GDPR. If you use a reporting platform or external IT, you may work only with processors that provide sufficient guarantees, and you need a contract with the minimum content of Art. 28(3) GDPR.

The practically most difficult point is the collision between the right of access and the duty of confidentiality: if the accused person requests access under Art. 15 GDPR, the request must be decided without undue delay and no later than within one month, extendable by two months where the request is complex (Art. 12(3) GDPR) — while § 8(1) HinSchG prohibits revealing the identity. Practice works here with a redacted response; the legal anchor is § 29(1) sentence 2 of the German Federal Data Protection Act (BDSG), under which the right of access does not exist in so far as the access would disclose information that must be kept secret under a legal provision or by its nature. Practical recommendation: do not take this decision ad hoc, but set out the balancing exercise in advance in the confidentiality concept and log it for each access request.

Austria in brief: the HSchG instead of the HinSchG

Austrian SMEs do not fall under the German HinSchG but under the HinweisgeberInnenschutzgesetz (HSchG). The key parameters compared:

• Internal office mandatory from 50 employees (§ 3(1) in conjunction with § 11(1) HSchG) — the same threshold as in Germany, but a separate legal basis.
• Same deadline lengths, different starting point: in Austria the feedback period runs from receipt (§ 13(9) HSchG), in Germany from the acknowledgement of receipt (§ 17(2) HinSchG) — the lengths for each procedural step are in the deadlines table.
• Narrower material scope: only the EU areas plus corruption offences (§§ 302–309 of the Austrian Criminal Code (StGB)) — not, as in Germany, all criminal offences (§ 3(3) HSchG).
• External office: Federal Bureau of Anti-Corruption (BAK), § 15(1) HSchG — instead of the Federal Office of Justice (BfJ). Sectoral special competences take precedence, among others the Financial Market Authority (FMA), the Federal Competition Authority and the Auditor Oversight Authority (§ 15(2) HSchG).
• No full reversal of the burden of proof: the whistleblower only has to establish a prima facie case of retaliation (§ 23 HSchG); retaliation is not to be assumed where another motive is more likely, which the acting person must in turn substantiate on a prima facie basis — a weaker standard than the reversal of the burden of proof under § 36(2) HinSchG.
• Liability for retaliation: restoration of the lawful state of affairs, compensation for financial loss and compensation for the personal impairment suffered (§ 20(1) last sentence and (2) HSchG) — unlike § 37 HinSchG, Austria therefore provides an express claim to compensation for non-material damage. Acts of retaliation are themselves legally ineffective (§ 20(1) HSchG).
• Penalty range: an administrative offence carrying up to EUR 20,000, and up to EUR 40,000 in repeat cases (§ 24 HSchG), imposed by the district administrative authority. It also covers knowingly false reports and breaches of confidentiality under §§ 7 or 17(1) HSchG.
• Confidentiality and exemption from liability: the identity must be protected, including all information from which it can be inferred (§ 7(1) and (2) HSchG). Whistleblowers worthy of protection are not liable for the consequences of a justified report and do not breach confidentiality obligations, in so far as they had sufficient grounds to assume that the report was necessary (§ 22(1) and (2) HSchG).
• Data protection: the data protection impact assessment is dispensable under § 8(13) HSchG in conjunction with Art. 35(10) GDPR; the retention period is in the deadlines table.
• Without an Austrian counterpart: the HinSchGOWiZustV and the open question of whether § 14 HinSchG conforms with the Directive relate exclusively to German law.