Whistleblower Protection
The German Whistleblower Protection Act (HinSchG) has applied since 2 July 2023 (transitional provision § 42: 1 December 2023 and 17 December 2023); anonymous reports are a 'should' requirement under § 16(1) HinSchG — there is expressly no obligation to open reporting channels for anonymous reports; HinSchGOWiZustV in force since 15 April 2025: set up an internal reporting office, confidentiality concept § 8, prohibition of reprisals § 36, group hybrid model § 14. Note: § 22 = Bundeskartellamt reporting office (competition law), NO audit obligation. In Austria, the Austrian Whistleblower Protection Act (HSchG) applies instead of the HinSchG.
The key HinSchG topics in detail
Step-by-step guides with templates, regulatory references and audit checklists.
Whistleblower Protection (HinSchG) Guide 2026
Duties, Effectiveness Review (Best Practice), Fines
HinSchG: setting up an internal reporting office
8-step guide + 30-point audit checklist
HinSchG updates 2024–2026
Anonymous reports ('should'), fine ranges, no EU proceedings on § 14
HinSchG confidentiality (§ 8)
Audit-ready concept + 18-point checklist
HinSchG group reporting office
§ 14 without an EU objection: hybrid model
HinSchG for associations and NPOs
Church-affiliated bodies (Art. 140 GG) + funding compliance
Listicles & top lists
Compact overviews — ideal for board meetings, newsletters or as an A4 print template.
Practice clusters & glossary
Special topics for sectors, use cases and mandatory terms.
Audit-ready in 2-4 hours
Instead of months of research: ready-to-use templates, personalised with your company name, a one-off investment instead of consultancy fees.
View the HinSchG Kit →Whistleblower protection in Austria: HSchG instead of HinSchG
The articles in this hub describe the German legal situation. In Austria, the Austrian Whistleblower Protection Act (HSchG, BGBl. I Nr. 6/2023) applies — the obligations are similar, but the provisions, authorities and sanctions differ.
- Internal office from 50 employees: companies and legal entities in the public sector with 50 or more employees must enable internal reporting and set up an internal whistleblowing system (§ 3(1), § 11(1) HSchG) — corresponds to § 12 HinSchG.
- Acknowledgement of receipt: without undue delay, at the latest after seven calendar days and in writing (§ 9(1) HSchG) — corresponds to § 17(1) no. 1 HinSchG.
- Feedback on follow-up measures: at the latest three months after receipt of the report (§ 13(9) HSchG) — corresponds to § 17(2) HinSchG.
- External office: centrally the Federal Bureau of Anti-Corruption (BAK) for reports concerning private and public legal entities (§ 15(1) HSchG) — not the Federal Office of Justice (BfJ), the Bundeskartellamt or BaFin. Special offices (e.g. FMA, Federal Competition Authority) take precedence (§ 15(2) HSchG).
- Narrower material scope: the HSchG covers the EU areas (including, among others, public procurement, financial services, product and food safety, environmental protection and data protection) plus the corruption offences under §§ 302 to 309 StGB (§ 3(3) HSchG) — not every breach subject to criminal penalties, as under § 2(1) no. 1 HinSchG.
- Sanctions: administrative fine imposed by the district administrative authority of up to EUR 20,000, and up to EUR 40,000 in the event of repetition (§ 24 HSchG) — instead of the fines of up to EUR 50,000 under § 40 HinSchG.
- Standard of proof: instead of the reversal of the burden of proof under § 36(2) HinSchG, the lower standard of prima facie evidence applies: the reporting person must show prima facie that the measure was retaliation; the person who took the measure must in turn show prima facie a different, more probable motive (§ 23 HSchG).
Sources
- German Whistleblower Protection Act (HinSchG) — gesetze-im-internet.de (BGBl. 2023 I Nr. 140, in force since 2 July 2023)
- HinSchGOWiZustV — Regulation on jurisdiction for the prosecution of administrative offences (of 9 April 2025, BGBl. 2025 I Nr. 111, promulgated on 14 April 2025, in force since 15 April 2025)
- Directive (EU) 2019/1937 (Whistleblower Directive) — EUR-Lex DE (As at: 23 October 2019)
- Austria: Austrian Whistleblower Protection Act (HSchG) — RIS, the Federal Legal Information System (BGBl. I Nr. 6/2023, as amended; §§ 3, 9, 11, 13, 15, 23, 24)
- Bundeskartellamt — whistleblower reporting office (§ 22 HinSchG)
- BaFin — whistleblower protection (financial sector)
- BMJ — Whistleblower Protection Act information page
All articles on HinSchG (17)
- Set Up Internal Whistleblower Reporting Office 2026 (HinSchG)
Step-by-step guide to setting up internal whistleblower reporting office under German HinSchG: 8-step guide, 3 channels, anonymous reports, audit.
- HinSchG Updates 2024–2026: What Has Actually Changed?
Verified Whistleblower Protection Act (HinSchG) updates 2024–2026: no mandatory anonymous channel (Section 16(1) HinSchG), HinSchGOWiZustV (BfJ fining authority).
- HinSchG for Associations + NPOs 2026: What Applies and What Does Not
HinSchG for German associations, foundations and NPOs in 2026: 50-employee threshold, religious organizations, public funding compliance, group solutions.
- HinSchG Confidentiality Concept (Section 8): How to Make It Audit-Ready
HinSchG confidentiality concept under Section 8: technical and organizational measures, role separation, audit trail, 18-point audit checklist.
- DPIA for HinSchG Reporting Channel: 7-Step Template
Data Protection Impact Assessment (DPIA) for HinSchG reporting channel under Art. 35 GDPR + Section 8 HinSchG: 7 steps, confidentiality risks, software.
- HinSchG Communication to Employees: 5 Mandatory Components
HinSchG employee communication: 5 mandatory components, sample texts for posters, onboarding, manager training, refreshers and quarterly newsletters.
- HinSchG External Reporting Channel: Provider Comparison 2026
HinSchG external reporting channel: comparison of 6 DACH providers (law firms, EQS, BfJ, Whistlelink, NAVEX, EthicsCheck) with prices, pros and cons.
- HinSchG for Banks + Financial Services: BaFin Specifics
HinSchG for banks, savings banks, insurers and fintechs: additional BaFin obligations, MaRisk, BCBS 239, whistleblower hotline mandatory from 1 employee.
- HinSchG Group Practice: Hybrid Model Implementation
Implementing the HinSchG hybrid group reporting model: central software + local investigators, EU-compliant despite 03/2024 Commission objection.
- HinSchG Group Reporting Channel: What is Permissible (2026)
HinSchG group reporting channel under Section 14: legal status, EU Commission objection, three models compared, hybrid recommendation, DACH considerations.
- HinSchG: Handling Intentionally False Reports
Handling false HinSchG reports: Section 38 damages, evidence burden, communication with the accused, reputation protection.
- HinSchG for Hospitals + Care: Section 203 StGB Conflicts
HinSchG for hospitals and care institutions: Section 203 StGB conflicts, CIRS interplay, pharmaceutical compliance, external reporting recommendation.
- HinSchG vs. International Whistleblower Laws: 2026 Comparison
HinSchG vs. EU vs. US vs. UK whistleblower laws: obligations, protection, fines compared. Implications for multinational SMEs.
- HinSchG for IT Providers + MSSPs: Specifics
HinSchG for IT service providers and MSSPs: client confidentiality, insider threats, NIS2 dual obligation, SOC staff protection.
- Whistleblower Protection Act for Law Firms: Professional Rules + Confidentiality
HinSchG for German law firms: Section 203 Criminal Code confidentiality, BRAO conflicts, whistleblower protection for staff, beA integration.
- HinSchG Effectiveness Self-Review 2026: 12 Audit Points for Compliance Officers
HinSchG (Whistleblower Protection Act) effectiveness self-review 2026 in 12 points — best practice for management reporting, NOT a statutory obligation.
- HinSchG: Top 8 SME Questions in 2026
Top 8 HinSchG questions from German SMEs: thresholds, channels, retention, retaliation, identity disclosure, false reports, Section 22 audit.