Whistleblower System from 50 Employees: SME Requirements

Main article: Whistleblower Protection (HinSchG) Guide 2026 — all obligations under the Whistleblower Protection Act at a glance. This page goes deeper into whether your company is in scope and which model suits you. All articles on the topic are in the HinSchG topic hub.

1. The 50-employee threshold (§ 12(1) sentence 1, (2) HinSchG)

Under § 12(1) sentence 1 of the Whistleblower Protection Act (HinSchG), employers must ensure that at least one internal reporting office is set up with them and operated. Subsection 2 limits this obligation to employers with as a rule at least 50 employees each. For private employers with 50 to 249 employees, the obligation has applied since 17 December 2023 (§ 42(1) HinSchG); a transitional period applied until then. That period has expired; the obligation now applies to everyone from 50. For the employers under § 12(3), the transitional period never applied.

"As a rule": what is meant is not the headcount on a cut-off date but the staffing level typical for the business. Short-term peaks, for example in seasonal business, do not on this interpretation make a business with permanently fewer than 50 employees subject to the obligation; a business that is permanently above that level is. The Act sets no calculation period.

For banks and insurers, the details are in the article HinSchG for banks and financial services. How the reporting office is then built step by step is shown in Set up the internal reporting office.

2. Who counts as an "employee"?

§ 3(8) HinSchG lists exhaustively who is an employee: employees, persons employed for their vocational training, civil servants, judges (excluding lay judges), soldiers, persons similar to employees including homeworkers, and persons with disabilities employed in workshops. The HinSchG contains no rule on pro-rata counting of part-time staff. The Protection against Dismissal Act takes a different approach: there, part-time staff working up to 20 hours a week are counted at 0.5 and those working up to 30 hours a week at 0.75 (§ 23(1) sentence 4 KSchG). For the HinSchG, counting is therefore per head.

Practical recommendation: anyone close to the threshold, for example between 45 and 55 heads, should document the development of staffing over the last 12 months and record the classification with a date. Further counting questions are answered in the article HinSchG: Top 8 SME questions.

3. External vs. internal reporting office

The HinSchG provides two reporting routes side by side. Whistleblowers may choose whether to turn to an internal or an external reporting office (§ 7(1) sentence 1 HinSchG). Reports may cover, among other things, criminal offences, certain infringements subject to a fine and infringements of numerous listed provisions; since 29 July 2026, § 2(1) no. 10 HinSchG also covers infringements of the AI Act (Regulation (EU) 2024/1689).

3.1 Internal reporting office (§§ 12 to 18 HinSchG)

The internal reporting office sits with the employer or is operated for it by a third party. Under § 7(1) sentence 2 HinSchG, whistleblowers should prefer the internal report where effective action against the infringement can be taken internally and they do not fear reprisals. This is not an obligation to report internally first. Obstructing reports or the subsequent communication is prohibited (§ 7(2)). Employers subject to the obligation should create incentives for reports to be made internally first (§ 7(3) sentence 1). They must provide clear and easily accessible information on the use of the internal reporting procedure (sentence 2); this must not restrict or impede external reporting (sentence 3).

3.2 External reporting office (§§ 19 to 31 HinSchG)

• Federal External Reporting Office at the Federal Office of Justice: competent insofar as no other external reporting office is competent (§ 19(1) and (4))
• Federal Financial Supervisory Authority (BaFin): for the reports from the financial sector listed in § 21
• Federal Cartel Office: for infringements under § 2(1) nos. 8 and 9 (§ 22)
• Länder: each Land may set up its own external reporting office for reports concerning the Land and municipal administration (§ 20)

4. Four setup options for SMEs

The legal framework is set by § 14(1) HinSchG: an employee, a working unit of several employees or a third party may be entrusted with the tasks of the internal reporting office. An employer that entrusts a third party remains itself obliged to take suitable measures to remedy an infringement (§ 14(1) sentence 2). The persons entrusted work independently, may have other tasks as long as no conflicts of interest arise (§ 15(1)), and must have the necessary expertise (§ 15(2)).

4.1 Option 1: External ombudsperson (e.g. a lawyer)

Pros:

• Clear organisational separation from management
• Conflicts of interest within the meaning of § 15(1) sentence 3 HinSchG are easier to rule out
• Legal initial assessment of whether the reported infringement falls within the scope under § 2 (§ 17(1) no. 2)

Cons:

• Ongoing costs, usually as a flat fee plus billing per case, amount on quotation
• Availability often limited to office hours
• The in-person meeting on request (§ 16(3) sentence 3) is more demanding logistically; with the consent of the whistleblower it is also possible by video and audio transmission (sentence 4)
• Remedy remains the company's task (§ 14(1) sentence 2)

Suitable for: companies without their own compliance function that want a visibly independent office.

4.2 Option 2: Software platform (online whistleblowing system)

A selection of providers with an assessment grid for the provider discussion is in the provider comparison for external reporting channels.

Pros:

• Reports in text form around the clock, multilingual (scope depends on the provider)
• Anonymous mailbox for contact with the whistleblower even after an anonymous report
• Deadline reminders for the acknowledgement of receipt after 7 days at the latest and the feedback within 3 months of the acknowledgement (§ 17(1) no. 1, (2))
• Role and permissions concept with which the access protection under § 16(2) can be mapped

Cons:

• The platform supplies the channel, not the handling: the reporting office must still be staffed and have the necessary expertise
• The in-person meeting on request (§ 16(3) sentence 3) must be organised outside the platform; anyone who additionally offers oral reports needs a telephone or another form of voice transmission for them (sentence 2)
• A documented procedure remains the practical evidence for the statutory deadlines (7 days under § 17(1) no. 1; feedback within 3 months of the acknowledgement, without an acknowledgement at the latest 3 months and 7 days after receipt, § 17(2)). There is no express formal requirement for such a document. An outline is shown in the procedure template.
• Licence costs depending on the scope of functions and use, amount on quotation; where the provider processes data on the company's behalf, a data processing agreement under Art. 28 GDPR is required

4.3 Option 3: In-house staffing

A designated employee or a small working unit takes on the reporting office, often in combination with an existing compliance or data protection function.

Pros:

• Full control over data and process
• Knowledge of the company helps when checking whether a report is substantiated (§ 17(1) no. 4)
• Low additional effort where a compliance function already exists

Cons:

• Conflicts of interest must be ruled out under § 15(1) sentence 3 HinSchG; a dual role with HR is hardly free of conflict for reports with a personnel connection
• Sick leave and holidays require a fixed deputy, otherwise the 7-day deadline for the acknowledgement of receipt is at risk
• § 15(2) requires the "necessary expertise". The Act prescribes no cycle; regular refresher training is a practical recommendation (see the glossary entry Proof of expertise)

Suitable for: companies with an existing compliance function and a culture of trust that supports internal reports.

For building the expertise there is the Whistleblower Protection E-Learning: path B "Reporting office & management" with 8 chapters (around 90 minutes) and a test with 20 questions from a pool of 65, as an HTML file or SCORM 1.2/2004 for your own LMS, with a certificate of participation and verification code, individually from EUR 490 net. The HinSchG contains no statutory training obligation.

4.4 Option 4: Group solution

Under the German interpretation, another group company can also be entrusted as a "third party" within the meaning of § 14(1) HinSchG. The obligation to remedy infringements remains with the subsidiary (§ 14(1) sentence 2). In addition, § 14(2) allows several private employers with as a rule 50 to 249 employees to operate a joint office; remedy and feedback remain with the individual employer. There are no infringement proceedings concerning § 14 HinSchG. The German proceedings concerning Directive (EU) 2019/1937, INFR(2022)0052, concerned late transposition; they ended with the CJEU judgment C-149/23 of 6 March 2025 and were closed on 4 June 2026. As at 17 August 2026, § 14 applies unchanged. For transfers to third countries, Chapter V GDPR applies. Further reading: HinSchG group reporting office and Hybrid model in practice, and in the glossary under Corporate group reporting office (hybrid).

5. Cost models compared

There is no statutory requirement and no official benchmark for the costs. What can be compared are the cost models and the drivers that determine the price.

Practical recommendation for companies just above the threshold: a channel in text form (platform or protected mailbox), an oral route by telephone or voice message with restricted access, the in-person meeting on request and a documented procedure. In particularly sensitive areas, an external ombudsperson can additionally make sense.

The documentation is covered by the Whistleblower Protection Kit: 53 documents (42 Word, 10 Excel, 1 PowerPoint) in 14 folders, including policy, rules of procedure with the deadlines of § 17, reporting-channel concept, templates for acknowledgement of receipt and feedback, confidentiality and erasure concept. Basic EUR 990 (documentation, 49 documents), Plus EUR 1,390 (with training pack), Complete EUR 1,690 (with e-learning as HTML and SCORM 1.2/2004), each net and one-off, as a version for Germany or Austria, with 12 months of legal-status updates. For businesses only.

6. Mandatory channels under § 16 HinSchG

Internal reporting channels must enable reports orally or in text form (§ 16(3) sentence 1 HinSchG). Anyone offering oral reports must make them possible by telephone or another form of voice transmission (sentence 2). At the request of the whistleblower, an in-person meeting must be made possible within a reasonable time (sentence 3), with their consent also by video and audio transmission (sentence 4). An email inbox alone is therefore insufficient only if the meeting on request is not organised; three routes are practice standard, but not an obligation. Details: Setting up reporting channels.

Frequent mistake: the normal switchboard serves as the reporting number. The reporting channels must, however, be designed so that only the competent persons and those supporting them have access to incoming reports (§ 16(2) HinSchG); in addition, the confidentiality requirement under § 8(1) applies. Solution: a separate number or voicemail box with restricted access, or an external office. How this can be implemented technically and organisationally is described in the HinSchG confidentiality concept (§ 8).

7. Anonymous reports: a target requirement, not an obligation

Under § 16(1) sentence 4 HinSchG, the internal reporting office should also process reports received anonymously, a clear expectation of the Act. Sentence 5, however, makes clear: there is no obligation to design the reporting channels so that they enable anonymous reports. There is no "HinSchG amendment" of 1 July 2024 that would have turned this into an obligation. Anyone who permits anonymous reports should offer an anonymous return channel (best practice), because the deadline for the acknowledgement of receipt (after 7 days at the latest) and the feedback within 3 months of the acknowledgement, without an acknowledgement at the latest 3 months and 7 days after receipt, still apply (§ 17 HinSchG). More in the glossary entry Anonymous report and under HinSchG updates 2024–2026.

8. Sanctions for breach (§ 40 HinSchG)

Against companies, the range increases tenfold for obstruction, reprisals and breaches of confidentiality, because § 40(6) sentence 2 HinSchG refers to § 30(2) sentence 3 of the Administrative Offences Act (OWiG): up to EUR 500,000, for a negligent breach of confidentiality up to EUR 100,000. This does not apply to the missing reporting office, where the maximum remains EUR 20,000. An attempt can be punished in the case of obstruction and reprisal (§ 40(5)). Since 15 April 2025, the Federal Office of Justice has been competent for prosecution and punishment, insofar as the implementation of the Act is incumbent on the Federal Ministry of Justice or an authority within its remit (§ 1 HinSchGOWiZustV). The range of fines is explained in detail in HinSchG: Top 8 SME questions.

Under civil law, the reversal of the burden of proof under § 36(2) HinSchG applies: if the whistleblower claims to have suffered a disadvantage as a result of their report, a reprisal is presumed. The person who caused the disadvantage must prove that it was based on sufficiently justified grounds or was not based on the report. In the event of an infringement of the prohibition of reprisals, the damage must be compensated (§ 37); this does not give rise to a claim to the establishment of an employment relationship or to career advancement.

Austria: HSchG instead of HinSchG

Austria (AT): the HinSchG applies only in Germany. In Austria, whistleblower protection is governed by the Austrian Whistleblower Protection Act (HinweisgeberInnenschutzgesetz, HSchG). Companies and legal entities in the public sector with 50 or more employees or public servants must enable internal whistleblowing and set up an internal whistleblowing system. The values are shown in the table.