HinSchG: Top 8 SME Questions in 2026

· Category: Whistleblower Protection· As of: 2026-05-02· Reading time: ~6 min
Practitioner note: This is not legal advice. For specific situations, consult a qualified attorney or compliance officer.

TL;DR

  • 50+ employees trigger the Whistleblower Protection Act (HinSchG) internal-channel requirement
  • Three channels mandatory; anonymous reports must be processable since 01.01.2025
  • 3-year retention after case closure, then mandatory deletion
  • Damages exposure (Section 37) can include all lost income through retirement
  • Section 22 annual audit from 01.01.2026 — non-negotiable

1. Do We Need an Internal Reporting Channel?

Mandatory from 50 employees under Section 12 HinSchG. Below 50: not required, but recommended. For groups: special rules under Section 14 (hybrid models). Public sector entities have lower thresholds.

2. Which Reporting Channels Are Required?

At least three: written (email, web form), oral (phone, voicemail), and a personal meeting on request. Anonymous input is mandatory since 01.01.2025.

3. Is an External Reporting Channel Sufficient?

From 50 employees, you may freely choose internal or external (specialist law firm, BfJ Federal Office). External channels are often cheaper and more confidential.

4. How Long May Reports Be Retained?

Three years after case closure (Section 11 HinSchG). Longer retention only when legally required (e.g. ongoing litigation).

5. What Happens with Retaliation?

Section 36 HinSchG prohibits retaliation. Section 37 enables damages, which can include all lost income through retirement. Burden of proof reverses after 6 months: the employer must prove the absence of retaliation.

6. Can We Find Out the Whistleblower's Identity?

Only investigation officers with explicit consent. Any other disclosure breaches Section 8 HinSchG and triggers fines up to 50,000 EUR plus damages.

7. Can We Defend Against False Reports?

Section 38 HinSchG allows damages for intentionally false reports, but the evidence threshold for "intentional" is high. Most "false" reports turn out to be honestly held but unsubstantiated suspicions and remain protected.

8. What Is the Section 22 Audit from 01.01.2026?

Annual effectiveness audit of the reporting channel. Documentation is mandatory and must be available on request from the supervisory authority (BfJ).

Summary

These eight questions cover 80% of the SME inquiries we see in HinSchG implementation. The biggest mistakes are missing the anonymous-channel obligation since 01.01.2025 and underestimating Section 37 damages exposure, which can reach six figures over a career.

View Whistleblower Kit →

Frequently Asked Questions

HinSchG fine risk?
Section 40 of the German Whistleblower Protection Act (HinSchG): up to EUR 50,000 per natural person for obstruction (Section 7(2)), reprisals (Section 36) or intentional breach of confidentiality (Section 8(1)); EUR 20,000 for failure to establish a reporting office (Section 12); EUR 10,000 for negligent breach of confidentiality. For legal entities, a tenfold increase is possible (Section 30(2) sentence 3 OWiG (German Administrative Offences Act)) — up to EUR 500,000. Plus damages under Section 37 HinSchG for lost wages in cases of reprisals.
External reporting office: pros/cons?
Pros: higher confidentiality, lower insider risk, often more affordable. Cons: less contextual knowledge of corporate culture.

Sources

Related Reading