Whistleblower Procedure Template: §§ 15–17 HinSchG Reporting Process

Main article: Whistleblower Protection (HinSchG) Guide — obligations, deadlines, channels and fines at a glance. Setting up the reporting office step by step is described in Set up an internal reporting office; all articles are in the HinSchG hub.

This page deals with the document that describes how the reporting office is run: the written procedure, called rules of procedure in the kit. It shows what belongs in it, how it is structured and where other departments are affected.

1. What the HinSchG requires (§§ 12 to 15)

The basic obligation is set out in § 12(1) sentence 1 HinSchG: employers ensure that at least one internal reporting office is set up and operated. § 13(1) names its tasks, § 15 the requirements for the persons entrusted with it.

None of these provisions contains an obligation to set down the procedure in writing, and the Act provides for no supervision with routine inspections of internal reporting offices. The federal external reporting office is established at the Federal Office of Justice (§ 19(1)); since 15 April 2025 the Federal Office of Justice has also prosecuted administrative offences under § 40 insofar as the implementation of the Act is incumbent on the Federal Ministry of Justice or an authority within its remit (§ 1 HinSchGOWiZustV). In such fine proceedings, the procedure shows that the office is not merely designated but actually working.

2. Mandatory content: what belongs in the procedure

The procedure does not explain the law; for every requirement it sets out who does what by when. The legal details are in the article on setting up the office: reporting channels, procedure, confidentiality, protection against reprisals and GDPR.

3. Structure of the procedure in 10 points

This order has proved its worth. It follows the path of a report from receipt to erasure.

3.1 Scope

Companies, sites and groups of employees covered, and the reportable infringements under § 2 HinSchG. Since 29 July 2026 the AI Act has been included (§ 2(1) no. 10, inserted by Art. 2 of the Act of 22 July 2026, BGBl. 2026 I No. 223); the former no. 10 is now no. 11. Purely private disputes are not covered, because infringements are only acts or omissions in the context of a professional, entrepreneurial or official activity (§ 3(2)).

3.2 Roles and responsibilities

Person entrusted, deputy, escalation addresses (management, supervisory board) and powers under § 12(4). Where the office is outsourced, the remedy remains with the employer (§ 14(1) sentence 2). The HinSchG does not expressly regulate a central group reporting office; solutions are described in the article Group reporting office.

3.3 Reporting channels and information for the workforce

Telephone, email, postal address, portal, the route to an in-person meeting, availability, languages. Plus the text used to inform the workforce about the internal procedure and the external reporting offices (§ 7(3) sentence 2, § 13(2)). The employer should create incentives for the internal route (§ 7(3) sentence 1), but external reporting must not be restricted or impeded as a result (sentence 3). Building blocks are in the article Communication to employees.

3.4 Procedural steps

Receipt → acknowledgement after 7 days at the latest (§ 17(1) no. 1) → check of the scope (no. 2) → maintaining contact (no. 3) → check of whether the report is substantiated (no. 4) → follow-up questions (no. 5) → follow-up measure (no. 6) → feedback → conclusion. Feedback is given within 3 months of the acknowledgement, without an acknowledgement at the latest 3 months and 7 days after receipt, and names planned and completed follow-up measures together with the reasons for them (§ 17(2)), insofar as internal enquiries and the rights of the persons concerned are not affected (§ 17(2) sentence 3). Follow-up measures under § 18 range from an internal investigation to referring the procedure to a competent authority for further investigation (no. 4(b)).

3.5 Protection of confidentiality

Access rights, separation from HR systems, encryption, logging. Framework: confidentiality under § 8, exceptions under § 9. Reports that are intentionally or grossly negligently incorrect enjoy no protection of identity (§ 9(1); see Handling false reports). In depth: Confidentiality concept.

3.6 Data protection

Authority to process data under § 10 HinSchG, including special categories with specific safeguards. Handling of access requests under Art. 15 GDPR, a data processing agreement under Art. 28 GDPR where the platform is run externally, and the check of whether a data protection impact assessment under Art. 35 GDPR is required (DPIA for the reporting office).

3.7 Protection against reprisals

Protection statement on the prohibition of reprisals (§ 36(1)) and on the prohibition of obstructing reports (§ 7(2)), a contact person in case of disadvantage and the reference to the right to choose between internal and external reporting (§ 7(1)). External offices are the federal external reporting office at the Federal Office of Justice (§ 19) as well as BaFin (§ 21) and the Federal Cartel Office (§ 22) for their areas. Term: prohibition of reprisals.

3.8 Documentation and archive

All reports are documented in a permanently retrievable form (§ 11(1)). For telephone reports, an audio recording or a verbatim record is permitted only with consent; otherwise a summary record is made (subsection 2). The person can review, correct and confirm the record (subsection 4). Erasure follows 3 years after the procedure has been concluded, later only insofar as necessary and proportionate (subsection 5): an obligation to erase, not merely a retention period.

3.9 Quality assurance

Annual effectiveness self-review as a voluntary practice recommendation, with a report to management.

3.10 Annexes

Template acknowledgement of receipt, initial intake form, investigation record, template feedback, documentation template with record confirmation, model consent to the disclosure of identity (separately and in text form for each disclosure, § 9(3) sentence 2) and protection statement on the prohibition of reprisals.

4. Interfaces with other departments

4.1 HR

Employment-law follow-up measures run through HR; the reporting office passes on only the information needed for them. Outside § 9(2), the identity of the whistleblower is passed on only if this is necessary for follow-up measures and the person has consented in text form (§ 9(3)). Measures against the whistleblower require documented reasons, because § 36(2) presumes a reprisal as soon as the person claims to have suffered a professional disadvantage as a consequence of their report.

4.2 Compliance / legal department

Criminal complaint, referral to an authority, external advice in complex cases; the reporting office escalates, compliance or legal decides on external communication. If a law enforcement authority requests the identity in criminal proceedings, disclosure is permitted, as it is on the basis of an order in subsequent administrative or fine proceedings and on the basis of a court decision (§ 9(2) sentence 1 nos. 2 and 3), in each case with the person informed in advance (§ 9(2)), unless the authority or the court states that the information would jeopardise the investigations, enquiries or court proceedings (§ 9(2) sentence 3).

4.3 Management / board

If management itself is affected, a different escalation body is needed, such as the supervisory board or group compliance. Management regularly receives an anonymised report on case numbers and adherence to deadlines.

4.4 Data protection officer

Involvement in the data protection impact assessment, advice in sensitive cases, aligning access requests with confidentiality under § 8.

4.5 Works council

Involvement in the introduction and in the procedure, for example through a works agreement; the nature and scope of co-determination must be examined case by case. The works council has no access to individual reports, because only the competent and supporting persons may access incoming reports (§ 16(2)), and only they may come to know the identity (§ 8(1) sentence 2).

5. Reporting channels in practice

One form of reporting is mandatory: oral or in text form (§ 16(3) sentence 1); the legal position for each channel is shown in the channel overview in the setup article. Offering both is practice standard, not an obligation. For providers and prices, see the provider comparison; flat amounts cannot be stated reliably.

The reporting office “should” process anonymous reports (§ 16(1) sentence 4), but it does not have to open a channel for them (sentence 5). There is no amendment that would have made anonymous reports mandatory as of 1 July 2024; the actual changes are shown in HinSchG Updates 2024–2026.

6. Effectiveness review: best practice, not an obligation

There is no statutory audit obligation for internal reporting offices; § 22 HinSchG governs the external reporting office at the Federal Cartel Office. An annual self-review of availability, deadlines, confidentiality, protection against reprisals and documentation nevertheless provides evidence to management and in fine proceedings. The method in 12 points: Effectiveness self-review; the 30-point checklist serves as a checklist for setting up the office.

7. Common mistakes in practice

1. No written procedure. Not subject to a fine as such. A fine of up to EUR 20,000 applies where no internal reporting office has been set up and operated (§ 40(2) no. 2, (6)); without a procedure, however, operation is hard to prove.
2. Only an email address. Text form satisfies § 16(3) sentence 1. What is missing, however, is the in-person meeting on request (sentence 3), and a shared inbox breaches the access restriction of § 16(2).
3. Anonymous reports rejected across the board. Not a breach of duty, but contrary to the “should” requirement of § 16(1) sentence 4.
4. Reporting office is also head of HR. Dual roles must not lead to conflicts of interest (§ 15(1) sentence 3); with reports that have an HR connection, this can hardly be ruled out.
5. Deadlines missed. The 7-day acknowledgement or the feedback after 3 months does not happen. This breaches § 17; there is no separate fine for it.
6. Intake logs on a shared mail server. A breach of § 16(2) and a risk to confidentiality under § 8, whose breach is subject to a fine under § 40(3) and (4).
7. No training for the persons entrusted with the reporting office. § 15(2) requires the necessary expertise, not a specific training; dated training is the customary evidence.

Austria: HSchG instead of HinSchG

Austria (AT): The HinSchG applies only in Germany. In Austria, companies and legal entities in the public sector with 50 or more employees or public servants must set up an internal whistleblowing system under the Austrian Whistleblower Protection Act (HinweisgeberInnenschutzgesetz, HSchG) (§ 3(1), § 11(1) HSchG). Reports must be possible in writing, orally or in both forms; on request, a meeting must be made possible within 14 calendar days at the latest (§ 13(5)). Written reports must be acknowledged within 7 calendar days (§ 9(1)), and the follow-up measures communicated no later than 3 months after receipt (§ 13(9)). Personal data must be retained for 5 years from the last processing or transmission and, beyond that, for as long as is necessary for administrative, court or investigation proceedings already initiated; thereafter they must be erased (§ 8(11)). The external office is the Federal Bureau for the Prevention of and Fight against Corruption (Bundesamt zur Korruptionsprävention und Korruptionsbekämpfung) (§ 15(1)); retaliation or breaches of confidentiality are punished by the district administrative authority with up to EUR 20,000, in the event of repetition up to EUR 40,000 (§ 24). The 10-point structure also works in Austria; deadlines and references must be swapped.

The template in the Whistleblower Protection Kit

In the Whistleblower Protection Kit, the procedure is included as “Rules of procedure of the internal reporting office” (Verfahrensordnung der internen Meldestelle, document A05), with templates for acknowledgement of receipt and feedback, an initial intake form, a case-handling playbook, a confidentiality and erasure concept and a policy on the prohibition of reprisals, in the version for Germany (HinSchG) or Austria (HSchG). Basic EUR 990 (49 documents), Plus EUR 1,390 with training pack (53 documents), Complete EUR 1,690 additionally with e-learning as HTML and SCORM 1.2/2004; each net and one-off, 12 months of legal-status updates, company licence, for businesses only. The Whistleblower Protection E-Learning has its own path for the internal reporting office and is available individually from EUR 490 net.