Purpose
The internal reporting office is a statutory obligation for every company with at least 50 employees. A missing or inadequate reporting office is subject to a fine pursuant to Section 40 (2) No. 2 in conjunction with (6) HinSchG of up to EUR 20,000; Breaches of confidentiality (Section 8) and retaliation (Section 36) as well as obstructing a report (Section 7 (2)) are punishable by up to EUR 50,000 . A poorly set up reporting office also shifts protection to the external reporting office and increases reputational risks.
Status: HinSchG last amended by Article 14 of the Act of 02.12.2025 (Federal Law Gazette 2025 I No. 301). Ordinance on Jurisdiction HinSchGOWiZustV of 09.04.2025 (Federal Law Gazette 2025 I No. 111) — the Federal Office of Justice is the competent prosecuting authority.
Inputs
- Number of employees (for threshold assessment)
- Group structure (joint reporting office possible under Section 14 HinSchG for companies with up to 249 employees)
- Sector-specific features (financial services providers: Section 12 (3) HinSchG with its own rules)
- Existing compliance structures (compliance officer, ombudsperson, audit)
- Languages / locations (multilingual reports, foreign operations)
Procedure
1. Mandatory assessment (Section 12 (1), (2) HinSchG)
- ≥ 250 employees: own internal reporting office mandatory
- 50–249 employees: also mandatory, but joint reporting office within the group or with other companies permitted (Section 14 HinSchG)
- < 50 employees: no HinSchG obligation, voluntary establishment recommended
- Financial undertakings: obligation regardless of size (Section 12 (3) HinSchG)
2. Reporting channels (Section 16 (1) HinSchG)
At least two of the three ways must be offered — oral, written or in person upon request:
- Oral: telephone, voicemail, hotline
- Written: mailbox, email, web form, anonymous tool input
- In person: appointment within a reasonable period (within 14 days recommended)
3. Anonymity (Section 16 (1) Sentence 4 HinSchG)
Anonymous reports must be processed insofar as "this does not jeopardize the priority processing of other reports". Recommendation: tool with anonymity function (e.g., platforms with anonymous communication channels).
4. Duties of the reporting office (Section 13 HinSchG)
- Receipt in the form chosen by the whistleblower
- Confirmation of receipt within 7 days (Section 17 (1) No. 1)
- Maintaining contact with the whistleblower
- Assessment of the substance
- Follow-up measures (internal investigation, referral to the competent authority, discontinuation of proceedings due to lack of substance)
- Feedback to the whistleblower within 3 months (Section 17(2))
5. Confidentiality (Section 8 HinSchG)
The identity of the whistleblower, the affected persons and third parties is treated confidentially. Disclosure only in the exceptions under Section 9 (consent, legal obligation, criminal prosecution in exceptional cases).
6. Prohibition of retaliation (Section 36 HinSchG)
Reversal of the burden of proof: In the event of a professional disadvantage after a report, it is presumed to be retaliation (Section 36(2)). The employer must prove the contrary.
7. Personnel selection for the reporting office
- Functionally independent
- Professionally competent
- Discreet
- No conflict of interest
- Permissible on a full-time basis or as an additional function — however, the function may not be combined with conflicting duties (e.g. personnel decisions)
8. Documentation (Section 11 HinSchG)
Matters must be documented. Retention period: 3 years after conclusion of the proceedings.
Sources
Statute
- HinSchG (Whistleblower Protection Act) — full text
- Sections 8, 11, 12, 13, 14, 16, 17, 18, 36, 40 HinSchG
- Directive (EU) 2019/1937 — EU Whistleblower Directive
Secondary literature
- Reufels, Hinweisgeberschutz, 1st ed. 2024
- Schmidt-Husson, HinSchG-Praxiskommentar, 2nd ed. 2024
- BeckOK HinSchG (online)
Supervisory/authority guidance
- BMJ – FAQ on the HinSchG
- BfJ – External reporting office of the Federal Office of Justice: https://www.bundesjustizamt.de/
Output format
HINWEISGEBER-MELDESTELLE — Einrichtungsplan — <Mandant> — <Datum>
I. Pflichtprüfung (§ 12) [eigene / gemeinsam / nicht pflicht]
II. Meldekanäle (§ 16) [mündlich / schriftlich / persönlich] ≥ 2
III. Anonymität [Tool / Funktionalität / Verfahren]
IV. Bearbeitungsfristen 7-Tage-Bestätigung / 3-Monats-Rückmeldung
V. Vertraulichkeit (§ 8) Maßnahmen: <…>
VI. Repressalienverbot (§ 36) Schulung / Eskalation: <…>
VII. Personalauswahl [Compliance / extern / Ombudsperson]
VIII. Dokumentation (§ 11) Aufbewahrung 3 Jahre, System: <…>
Implementierungs-Roadmap:
- Woche 1–2: <…>
- Woche 3–4: <…>
- Woche 5–8: <…>
Risks / typical errors
- Anonymous reports blocked — violates Section 16(1) sentence 4 HinSchG.
- Reporting channels only by email — falls short of the minimum; at least two of the three channels.
- Compliance officer with personnel responsibility as the reporting office — conflict of interest.
- 7-day acknowledgment deadline missed — not an administrative offence, but an indication of a deficient reporting office.
- Retaliation protection poorly communicated — the reversal of the burden of proof often applies in favour of the whistleblower.
- Documentation only in the personnel file — incorrect retention, breach of confidentiality under Section 8.