Germany’s federal external reporting office #

The externe Meldestelle des Bundes at the Bundesamt für Justiz is Germany’s federal point of contact for external reports under the Hinweisgeberschutzgesetz. It receives reports, checks whether they are substantiated, and takes follow-up measures.

This page is a reference on the office itself: what it is, what it is and is not competent for, how a report reaches it, which deadlines apply, and what happens next. For the duty to operate an internal reporting office, the thresholds and the fines, see whistleblower law in Germany .

What the office is #

One structural point matters more than any other here: Germany did not create a standalone independent authority. It created an organisationally separated unit inside an existing federal office. The independence comes from how its tasks are performed and from the limits on supervision, not from separate legal personality — a materially different design from, for example, Spain’s AIPI , which the law constitutes as an independent authority with its own legal personality.

Functions #

§ 24 HinSchG gives the external reporting offices three sets of duties:

1. Establish and operate reporting channels under § 27, check whether a report is substantiated, and conduct the § 28 procedure (para. 1).
2. Provide comprehensive and independent information and advice on available remedies and on procedures for protection against retaliation — expressly including information about the option of reporting internally (para. 2).
3. Publish specified information in a separate, easily identifiable and easily accessible section of their website (para. 3): the conditions for protection, an explanation of the reporting procedure and the possible follow-up measures, the confidentiality regime and personal-data processing, available remedies and the availability of confidential advice, a plain explanation of when a reporting person cannot be held liable for breaching confidentiality obligations, and its contact details.

Competence, and its limits #

The federal office is not competent for everything. The HinSchG divides it:

Because establishing a Land office under § 20 is optional, reports about the administration of a Land that has not set one up fall back to the federal office under § 19(4).

Where the office is not competent, or cannot pursue the reported breach within a reasonable time, it forwards the report without delay to the body responsible for investigating it, preserving the confidentiality of the reporting person’s identity, and informs the reporting person of the transfer without delay (§ 31(2)).

What the office is not #

The external reporting office is not a prosecuting or supervisory authority. Its follow-up measures are set out exhaustively in § 29(2): contact the employer concerned, refer the reporting person to other competent bodies, close the procedure for lack of evidence or on other grounds, or hand the case to a competent authority for further investigation.

It may request information at its dutiful discretion where this is necessary to check whether a report is substantiated (§ 29(1)). The rights to refuse testimony under §§ 53 and 53a StPO and to refuse information under § 55 StPO apply accordingly, and compensation under the JVEG is granted on application for answering such a request.

How to report #

External reporting channels must allow reports orally and in text form (§ 27(3)). Oral reporting must be possible by telephone or another form of voice transmission. At the reporting person’s request, a personal meeting must be made possible within a reasonable time; with their consent it may be held by video and audio transmission.

Federal reports go through the reporting form of the federal external reporting office .

Anonymity — the most frequently misstated point #

§ 27(1) HinSchG says the external reporting office should also process anonymously submitted reports. But, subject to specific statutory rules, there is no obligation to design the channels so that anonymous reports can be submitted.

§ 16(1) uses the same formulation for internal reporting offices. Germany therefore requires an anonymous route neither internally nor externally: processing anonymous reports that do arrive is a “should” provision, and enabling anonymous submission is not a duty at all.

Deadlines #

The external and internal deadlines are not the same.

The extension to six months is available only to the external office; the internal deadline has no extension. This is the mirror image of Spain, where the internal deadline extends and the external one is hard.

An acknowledgment is not sent where the reporting person has expressly waived it, or where there is sufficient reason to assume it would impair the protection of their identity (§ 28(1)). Reports about breaches of particular gravity may be handled as a priority, which does not affect the deadlines (§ 28(5)).

What happens after a report #

1. Acknowledgment within seven days. In cases suitable for an internal reporting procedure, the office points out the option of reporting internally together with the acknowledgment (§ 28(1)).
2. Scope check: does the reported breach fall within § 2, and does no exception under § 5 apply? If it does fall within scope, the office checks whether the report is substantiated and takes appropriate follow-up measures under § 29 (§ 28(2)).
3. Follow-up measures under § 29(2), as above.
4. Closure under § 31(1), once the office has checked whether the report is substantiated and conducted the § 28 procedure.

Access to the file is governed by § 29 VwVfG; existing confidentiality and secrecy obligations must be observed, and the rights of the people who are the subject of a report must not be impaired (§ 28(3)).

How internal and external reporting interact #

§ 7(1) gives reporting people a choice: they may turn to an internal reporting office (§ 12) or directly to an external one (§§ 19 to 24). The Act expresses a preference — where the breach can be dealt with effectively internally and no retaliation is to be feared, the person should prefer the internal route — but does not make it a precondition. Where an internally reported breach was not remedied, the route to the external office remains expressly open.

Employers obliged to establish internal reporting offices under § 12 should create incentives for reporting internally first (§ 7(3)). Obstructing a report, or the communication that follows one, is prohibited (§ 7(2)) and carries a fine.

Public disclosure is protected (§ 32(1)) where the person first reported externally and either no appropriate follow-up measures were taken within the § 28(4) feedback deadlines or they received no feedback about such measures; or where they had sufficient reason to believe the breach posed an immediate or manifest danger to the public interest, that retaliation was to be feared, or that evidence might be suppressed or destroyed, that the external office might be colluding with the perpetrator, or that for other reasons the prospects of effective follow-up were slim.

Protection against retaliation #

The protections in §§ 35 to 37 apply where the person reported internally under § 17 or externally under § 28, or disclosed under § 32; had sufficient reason at the time to believe the information was true; and the information concerns breaches within the Act’s scope, or they had sufficient reason to believe it did (§ 33(1)).

Retaliation is prohibited, as is threatening or attempting it (§ 36(1)). The operative provision is the reversal of the burden of proof in § 36(2): where a reporting person suffers a detriment in connection with their professional activity and asserts that it followed a report, the detriment is presumed to be retaliation, and the person who caused it must prove that it rested on sufficiently justified grounds or was not based on the report.

Fines #

§ 40(6) HinSchG sets three tiers:

The ceiling for having no internal reporting office is widely reported as €50,000. The Act sets €20,000; the €50,000 tier covers obstruction, retaliation and confidentiality breaches. Application of § 30(2) sentence 3 OWiG — which multiplies the ceiling for legal persons — is expressly confined to § 40(2) nos. 1 and 3 and paras. 3 and 4, and so does not reach the missing-internal-office offence.

Official sources #

• Hinweisgeberschutzgesetz (HinSchG) — official text
• Federal external reporting office — reporting form
• Directive (EU) 2019/1937 — EUR-Lex

Last updated: September 20, 2026