Whistleblower Protection (HinSchG) Guide 2026: Duties, Fines for 50+ Staff SMBs

This guide gives the overview: who needs an internal reporting office, how it works, which deadlines and sanctions apply and where Austria differs. The step-by-step implementation is in the guide Set up an internal reporting office, and all articles are in the HinSchG topic area.

1. What is the Whistleblower Protection Act?

The German Whistleblower Protection Act (HinSchG) transposes Directive (EU) 2019/1937. It protects natural persons who, in connection with their professional activity or in the run-up to a professional activity, have obtained information about infringements and report it to a reporting office or disclose it (§ 1(1)). Persons who are the subject of a report or are affected by it are also protected (§ 1(2)).

The Act of 31 May 2023 (BGBl. 2023 I No. 140) has applied since 2 July 2023. There is no separate "HinSchG amendment 2026"; the Act has been amended through other acts, most recently by Art. 2 of the AI Implementation Act of 22 July 2026. The article HinSchG updates 2024–2026 shows the state of amendments.

Which infringements can be reported is governed by § 2(1) HinSchG, in particular:

• infringements subject to criminal penalties (no. 1)
• infringements subject to a fine, insofar as the provision breached serves to protect life, limb or health or the rights of employees or their representative bodies (no. 2)
• infringements of listed provisions, for example on money laundering, product safety, environmental protection, food safety, consumer protection, data protection and IT security (no. 3), as well as of public procurement law (no. 4), provisions covered by § 4d FinDAG (no. 5), tax law (nos. 6 and 7), competition law (no. 8) and the Digital Markets Act (no. 9)
• infringements of the AI Act (Regulation (EU) 2024/1689) (no. 10, since 29 July 2026); the former no. 10 is now no. 11

Whether a report falls within this scope is examined by the internal reporting office as a procedural step of its own (§ 17(1) no. 2). Protection depends on it: §§ 35 to 37 apply where the information falls within the scope or the reporting person had sufficient reason to believe so (§ 33(1) no. 3).

2. Who is bound — the 50-staff threshold

2.1 The regular threshold

Employers with as a rule at least 50 employees each must ensure that at least one internal reporting office is set up and operated (§ 12(1) sentence 1, (2) HinSchG). For private employers with 50 to 249 employees this applied from 17 December 2023 (§ 42(1)); the fine for a missing reporting office has been applicable since 1 December 2023 (§ 42(2)). What counts is the regular number of employees, not a single reference date.

Whether you are bound and which model to choose is covered in depth in the article Whistleblower system from 50 employees, and the headcount in the implementation guide under Obligation from 50 employees.

2.2 Obligation irrespective of size

§ 12(3) nos. 1 to 9 HinSchG lists exhaustively for whom the threshold does not apply: securities services undertakings, data reporting services providers, stock exchange operators, institutions under the German Banking Act (KWG) and the Securities Institutions Act (WpIG), counterparties under Art. 3 no. 2 of Regulation (EU) 2015/2365, capital management companies, insurance undertakings under § 1(1) VAG with the exception provided for there, as well as crypto and payment institutions. Law firms, notaries' offices and audit firms are not on the list; the threshold of 50 applies to them.

2.3 Joint office and corporate group

Private employers with 50 to 249 employees may operate a joint office; remedial action and feedback remain with the individual employer (§ 14(2)). Where a group company is entrusted as a third party, the entrusting employer must still remedy infringements itself (§ 14(1) sentence 2). No proceedings concerning § 14 are pending (as at 17 August 2026): infringement proceedings INFR(2022)0052 concerned the late transposition, ended with the judgment of the Court of Justice of the European Union in Case C-149/23 of 6 March 2025 (lump sum of EUR 34 million) and were closed on 4 June 2026. More under Group reporting office under § 14 and Hybrid model in the corporate group.

3. The internal reporting office (§§ 12 to 15)

The internal reporting office operates the reporting channels, conducts the procedure and takes follow-up action (§ 13(1) HinSchG); it also provides information about external reporting procedures (§ 13(2)). The employer grants it the necessary powers (§ 12(4)).

• Independence (§ 15(1)): the persons entrusted are independent in their activity (§ 15(1) sentence 1) and may perform other tasks, for example in HR or compliance, provided no conflicts of interest arise.
• Expertise (§ 15(2)): the employer ensures the necessary expertise. The Act does not prescribe any particular training or a written proof of expertise.
• Confidentiality (§ 8): the identity of those involved may become known only to the competent persons and those supporting them; implementation in the confidentiality concept.
• Documentation (§ 11): reports are documented in a permanently retrievable form and erased three years after the procedure has been concluded (§ 11(5)).

§ 15 does not require written rules of procedure. They are nevertheless the central instrument for practice and for evidence; an outline is shown in the procedure template, the set-up in the guide in eight steps. For expertise there is the Whistleblower Protection E-Learning with a separate path for the reporting office and management.

4. Reporting channels (§ 16)

The reporting channels must be open to employees and to agency workers assigned to the employer, and may be opened to other persons in professional contact (§ 16(1) sentences 1 and 3 HinSchG).

• Form: reports must be possible orally or in text form; orally by telephone or another form of voice transmission (§ 16(3) sentences 1 and 2).
• Meeting: on request, an in-person meeting must be made possible within a reasonable time, with consent also by video and audio transmission (sentences 3 and 4). The German Act does not set a fixed number of days.
• Access: only for the competent persons and those supporting them (§ 16(2)).
• Anonymous: the reporting office should process anonymous reports; there is no obligation to design the channels for them (§ 16(1) sentences 4 and 5). See Anonymous report (target requirement in § 16(1)).

An email address alone is therefore not sufficient: the meeting on request must be possible and access must be restricted to the competent persons. Combinations are shown in the implementation guide under Reporting channels.

5. Deadlines and confidentiality

The feedback must not prejudice internal enquiries or investigations or the rights of the persons concerned (§ 17(2) sentence 3). The confidentiality requirement also applies where the reporting office is not competent (§ 8(2)). Exceptions are governed by § 9, for example for intentionally or grossly negligently incorrect reports (subsection 1) or at the request of the criminal prosecution authorities (subsection 2 no. 1).

6. Outsourcing the internal reporting office (§ 14) and external reporting offices

An office run by a law firm or a service provider is often called an "external reporting office", but in law it is an internal one: § 14(1) HinSchG allows an employee, an organisational unit or a third party to be entrusted. A software platform is a tool for the channel, not an organisational model of its own.

External reporting offices within the meaning of the Act are state bodies: the Federal Office of Justice (§ 19), BaFin (§ 21) and the Federal Cartel Office (§ 22). Reporting persons are free to choose between internal and external reporting (§ 7(1)); employers should create incentives for internal reporting without making external reporting more difficult (§ 7(3)).

Costs depend on the provider and the scope; options and an assessment grid are set out in the provider comparison.

7. Fines, prohibition of retaliation and damages

The maximum amounts are set out in § 40(6) sentence 1. For obstruction, retaliation and breaches of confidentiality, sentence 2 orders the application of § 30(2) sentence 3 OWiG: against legal persons the maximum rises tenfold, so for the EUR 50,000 offences to EUR 500,000. For the missing reporting office it remains at EUR 20,000. The Federal Office of Justice is competent insofar as the implementation of the Act lies with the Federal Ministry of Justice or an authority within its remit (§ 1 HinSchGOWiZustV of 9 April 2025, BGBl. 2025 I No. 111, in force since 15 April 2025) — a rule on competence, not a cut-off date. The fine calculator provides an estimate.

Prohibition of retaliation: retaliation against reporting persons is prohibited, as are threats and attempts (§ 36(1)). Retaliation means acts or omissions in a professional context in response to a report that cause or may cause an unjustified disadvantage (§ 3(6)). Supporting persons and connected third parties are also protected (§ 34). See Prohibition of retaliation (§ 36 HinSchG).

Reversal of the burden of proof: where the reporting person asserts that they suffered a professional disadvantage as a result of their report, retaliation is presumed; the person who caused the disadvantage must prove that the measure was based on sufficiently justified grounds or was not based on the report (§ 36(2)). The Act sets no time limit. The rule applies directly and must be distinguished from the rule on indications in the AGG (§ 22 AGG reversal of the burden of proof).

Damages: whoever causes the retaliation compensates the resulting damage (§ 37(1)). The HinSchG does not expressly provide for compensation for non-material damage, nor for a claim to be hired or promoted (§ 37(2)). Conversely, the reporting person is liable for intentionally or grossly negligently false reports (§ 38; see Handling false reports). Agreements restricting these rights are invalid (§ 39).

Recognising retaliation in practice

As a practical aid, not as a statutory list, four case groups have proved useful:

• direct: dismissal, written warning, worse position, cut in pay or bonus
• indirect: exclusion, withdrawal of tasks or projects, worse appraisal
• post-employment: adverse information or references after the contract ends
• against the environment of the reporting person: disadvantages for supporting persons and connected third parties (§ 34)

Recommendation: before any personnel measure affecting persons connected with a report, document the objective reasons separately, without a time limit. More under Protection against retaliation.

8. Effectiveness review of the reporting office — best practice, not a legal obligation

There is no audit obligation for internal reporting offices, nor a cut-off date of 1 January 2026. § 22 HinSchG governs the Federal Cartel Office as the external reporting office for infringements under § 2(1) nos. 8 and 9 (see Audit obligation under § 22: clarification). A self-review is nonetheless useful, voluntary and without a fine:

• Rhythm (practice): annually from 250 employees, every two years at 50 to 249
• Review items: channels (§ 16), deadlines (§ 17), documentation and erasure (§ 11), confidentiality (§ 8), independence and expertise (§ 15), personnel measures after reports (§ 36)

The twelve review points are described in the effectiveness self-review; the HinSchG effectiveness check in 8 questions offers a quick start.

9. Practical process: the first 90 days after a report

Fixed by law are the 7 days (§ 17(1) no. 1), the 3 months (§ 17(2)) and erasure three years after the procedure has been concluded (§ 11(5)); the week figures in between are practice rhythms.

1. Day 0 — document: permanently retrievable and confidential (§ 11(1)); for telephone reports, an audio recording or verbatim transcript only with consent, otherwise a summary record of the content (§ 11(2)).
2. By day 7 — acknowledge (§ 17(1) no. 1), for anonymous reports via an existing return channel.
3. Weeks 1 to 2 — classify: examine scope and validity, ask follow-up questions where needed (§ 17(1) nos. 2, 4 and 5).
4. Weeks 2 to 8 — follow-up action: internal investigation, referral, transfer to an investigating unit or an authority, or closure for lack of evidence (§ 18; see Investigation).
5. Ongoing — maintain contact (§ 17(1) no. 3).
6. After 3 months at the latest — feedback on follow-up action and reasons (§ 17(2)).
7. After conclusion — erase three years after the end of the procedure (§ 11(5)).

10. Data protection in the reporting office

The reporting office may process personal data insofar as this is necessary for its tasks, by way of derogation from Art. 9(1) GDPR also special categories such as health data, in that case with specific safeguards (§ 10 HinSchG). The general obligations apply alongside: an entry in the record of processing activities (Art. 30 GDPR), for a third party a contract under Art. 28 GDPR to be checked, erasure under § 11(5) HinSchG. Whether a data protection impact assessment is required must be examined case by case in Germany. Austria: five years of retention apply (§ 8(11) HSchG), and the impact assessment is not required (§ 8(13) HSchG in conjunction with Art. 35(10) GDPR). In depth: DPIA for the HinSchG reporting office.

11. KPIs for reporting to management

The HinSchG does not lay down a duty for the internal reporting office to report to management. A regular, anonymised report is nevertheless useful: the employer grants the office its powers (§ 12(4)) and remains responsible for remedial action (§ 14(1) sentence 2); names do not belong in it because of § 8(1). Proven indicators are the number of reports by channel and topic (categories of § 2), the share of acknowledgements and feedback given on time, completed investigations and measures, and documented reviews before personnel measures. Embedding in overall reporting: Compliance reporting to management and the board.

12. Sector practice

Law firms and professionals are bound from 50 employees; particular issues arise from professional secrecy and from conflicts of interest in ombudsperson mandates (HinSchG for law firms).

Banks and insurers need the reporting office irrespective of size (§ 12(3) nos. 4 and 7). Specific provisions such as § 25a(1) sentence 6 no. 3 KWG take precedence (§ 4(1) no. 2), and BaFin is the external reporting office for certain infringements (§ 21) (HinSchG for financial service providers).

Corporate groups can entrust a central office as a third party; the duty to remedy remains with each company (§ 14(1) sentence 2; see Corporate group reporting office (hybrid)).

Hospitals and care services frequently process health data in reports, relying on § 10 HinSchG with specific safeguards (HinSchG for hospitals and care).

Industry and mechanical engineering often concern occupational safety (§ 2(1) no. 2), environmental protection and product safety (no. 3). From as a rule 1,000 employees in Germany, the complaints procedure under § 8 LkSG is added (§ 1(1) LkSG); both procedures can be combined organisationally but follow their own rules.

Further sectors: IT service providers and MSSPs, associations and NPOs.

13. Three common misconceptions

"§ 22 prescribes an audit." False. § 22 governs the Federal Cartel Office as an external reporting office; the Federal Office of Justice is in § 19, BaFin in § 21. None of these provisions obliges companies to carry out a review.

"Anonymous reports have been mandatory since 2024." False. The reporting office should process them (§ 16(1) sentence 4), but does not have to design the channels for them (sentence 5). There is no cut-off date and no fine offence (Anonymous reports: a recommendation).

"Outsourcing settles the matter." False. Whoever entrusts a third party must still remedy infringements itself (§ 14(1) sentence 2); with a joint office, remedial action and feedback remain with the individual employer (§ 14(2) sentence 2).

14. Austria: HSchG instead of HinSchG

Austria (AT): the HinSchG applies only in Germany. In Austria, the Whistleblower Protection Act (HinweisgeberInnenschutzgesetz, HSchG, BGBl. I No. 6/2023) applies, with similar obligations but different sections, authorities and sanctions. Its material scope is narrower: essentially the EU areas plus the corruption offences under §§ 302 to 309 of the Austrian Criminal Code (StGB) (§ 3(3) HSchG).

Recommendation: corporate groups with companies in both countries keep their rules of procedure and deadline plan in a separate version for each country, because deadlines, channels and authorities differ. This guide covers Germany and Austria. Further reading: Group reporting office with companies in Austria and HinSchG in international comparison.

15. Templates and training for implementation

The Whistleblower Protection Kit contains 53 editable Word, Excel and PowerPoint templates in 14 folders, including the policy and rules of procedure, the reporting channel concept, templates for acknowledgement of receipt and feedback, confidentiality and erasure concepts, protection against retaliation and the GDPR bridge, in an edition for Germany or for Austria. Packages: Basic EUR 990, Plus with training pack EUR 1,390, Complete with e-learning as HTML and SCORM 1.2/2004 EUR 1,690; net and one-off, 12 months of legal-status updates, for businesses only.

The Whistleblower Protection E-Learning has two paths: three chapters in around 20 minutes for all employees, eight chapters in around 90 minutes for the reporting office and management, with an exam and proof of participation (Teilnahmenachweis) with a verification code. Individually from EUR 490 net for up to 25 users. Standardised templates, no legal advice on individual cases.