Whistleblower protection and internal reporting channels

COMPLIANCE & RIGHT · TREATY

The four practical examples · Send request

A whistleblowing system requires more than one technical reporting channel. Notifications must be received confidentially, checked on time and processed with appropriate follow-up measures. We support companies in the legal design of internal reporting points and in questions arising from specific reporting.

Typical counseling events

Your company will set up an internal reporting unit for the first time or review an existing solution.
A group solution or an external service provider should support several companies.
A notification concerns managers or the person responsible to date; conflicts of interest are imminent.
They must coordinate feedback, investigation measures and the protection of persons involved.
There are uncertainties about anonymous notices, personnel measures or data protection requirements.

Who needs to set up an internal reporting unit?

According to § 12 HinSchG, the obligation generally applies to employers with usually at least 50 employees. It applies to certain regulated companies irrespective of the number of employees. There are special features in public bodies, municipalities and associations. The obligation is to be examined for the employer concerned; a common trade mark or group membership does not yet answer this question.

Not every complaint falls within the scope of application of the HinSchG. In particular, the violations referred to in § 2 are decisive. A company can also open its internal channel to further concerns, but must then distinguish between the legal protection requirements and additional voluntary procedural rules.

Organisation, confidentiality and reporting channels

The persons responsible for the reporting body need the necessary expertise and must be able to carry out their tasks independently. Other tasks are possible insofar as conflicts of interest are avoided. Access rights are limited to competent and supportive persons. The identity of the referring and the data subject must be protected in accordance with the statutory requirements; the confidentiality requirement has legal exceptions.

Messages must be possible orally or in text form. Upon request, a personal meeting shall be possible within a reasonable period of time; with consent, the transmission of images and sound is also possible. Anonymous incoming messages should be processed. On the other hand, § 16 HinSchG does not provide for a general obligation to offer a technically anonymous reporting channel.

Indicators can basically choose between internal and external messages. Internal procedures shall not restrict or impede access to competent external reporting bodies.

Time limits and follow-up

Confirmation of receipt: no later than seven days after receipt of the notification.
Test: Jurisdiction, scope and validity shall be examined and additional information shall be sought where necessary.
Follow-up: For example, an internal investigation, the submission to a competent body or a reasoned conclusion of the procedure.
Feedback: within three months of receipt; without confirmation no later than three months and seven days after receipt.

The feedback shall include planned or implemented follow-up measures and their reasons. It shall not prejudice ongoing investigations or the rights of affected persons. The reporting period does not mean that each investigation must be completed within three months.

Protection against reprisals

Disadvantages due to a protected notification are prohibited. § 36 HinSchG provides for a reversal of the burden of proof under its conditions. Therefore, personnel decisions must be substantiated and carefully documented. The protection depends on the legal requirements, in particular § 33 HinSchG; knowingly false assertions must be distinguished from this. At the same time, the rights of accused persons and an open-ended explanation must be respected.

Our services

Examination of the obligation to set up and the appropriate form of organisation.
Design of rules of procedure, responsibilities, representation and means of escalation.
Legal review of service provider contracts, permissions and data protection information.
Development of templates for receipt confirmations, feedback and documentation.
Advice on follow-up measures, investigations and labour law interfaces.
Training of reporting agents and information for employees.

Common questions

Can an external third party take over the reporting unit?

Yes, § 14 HinSchG allows the appointment of third parties. The undertaking's obligation to take appropriate measures to remedy an infringement remains in place. Tasks, powers, data protection and conflicts must be regulated by contract.

Is it possible for several undertakings to operate a joint reporting unit?

For several private employers with 50 to 249 employees on a regular basis, Section 14(2) provides for a joint position. The obligations for termination of the infringement and feedback remain with the individual employer. Other group models require a separate test.

Is our general contact form already a notification point?

Not just by being able to get messages about it. Among other things, appropriate access rights, responsibilities, confidentiality and a legally compliant processing process are required. The contact form of this firm serves the mandate request and is not a general notification point for violations of any company.

Which documents are helpful for the examination?

Numbers of employees and company structure, the previous rules of procedure, contracts with system providers as well as the described reporting and processing methods. Personal case data should only be made available via a coordinated route of transmission.

Edit a message intelligibly

Upon receipt, it is first clarified whether the person responsible is unbiased and whether urgent measures are required. The initial notification, subsequent additions and own assessments should remain distinct. A single handling note may record receipt, responsibility, contact, follow-up and feedback. Only the authorized persons receive access.

In the case of telephone notifications, special rules apply to records and protocols. In accordance with § 11 HinSchG, a permanently accessible audio recording or a word protocol requires the consent of the person providing the information. Without this consent, a content protocol must be prepared. The possibilities provided for by law for the examination and confirmation of the protocol must be taken into account.

In principle, the documentation is deleted three years after completion of the procedure. Longer storage is possible, as far as it is necessary and proportionate to meet legal requirements. The erasure plan should therefore cover the closing date, legal storage grounds and different data sets. Unlimited archiving of all messages is not a standard solution.

If allegations are not confirmed, this must also be factually documented. Feedback shall not affect the rights of affected persons or ongoing investigations. For practical preparation, the Checklist for internal inspection and the information on Employment Compliance Ready. The legal basis for the documentation is in particular: Section 11.

Legal basis and further official information

Legal status: 1 November 2026. The classification of concrete facts requires an examination of the applicable regulations and circumstances.

Four practical examples

The following fictitious cases illustrate typical examination questions. The concrete solution depends on the circumstances of the individual case.

01 · Reporting against the management

The responsible person shall be directly accountable to the accused managing director. The case shall be handed over to a predetermined, unbiased processor; Accesses are limited to required persons.

02 · Vacation at the Reporting Office

A report is received during a two-week absence. The representation takes over input processing and monitoring of deadlines without opening the confidential mailbox of the entire HR department.

03 · Anonymous note with supporting documents

A note contains invoices, but no name. The content will be checked for plausibility and, where there is a back channel, specific queries will be asked. An unknown sender does not make a concrete suspicion meaningless.

04 · Transfer after notification

Shortly after a message, the informant should be transferred. Personnel measures, time context and factual reasons are independently examined and documented in order to identify possible reprisals.

Your next step

Do you want to transfer the requirements to your company or have a specific process checked? A brief description and a reference to existing deadlines are sufficient for the first contact. We shall vote on the scope of examination and compensation prior to commissioning.

Send request without mandatory fields →