Whistleblower law in Germany #

Germany implemented Directive (EU) 2019/1937 through the Hinweisgeberschutzgesetz (HinSchG), in force since 2 July 2023. It requires employers with, as a rule, at least 50 employees to set up an internal reporting office, and it protects people who report breaches from retaliation.

The HinSchG at a glance #

Applicable law #

• Hinweisgeberschutzgesetz (HinSchG)

Who must establish an internal channel #

Private employers with 50 or more employees must establish and operate at least one internal reporting office (§ 12(1) and (2)). The act also allows private employers with 50 to 249 employees to establish and operate a joint internal reporting office.

Only the financial entities listed in § 12(3) HinSchG are in scope regardless of headcount: securities firms, credit, payment and crypto-asset institutions, insurers, investment management companies, stock exchange operators and data reporting services. Unlike some other member states, Germany does not extend this to the transport or environmental sectors.

The federal government, the Länder and municipalities have their own rules. For municipalities, the duty follows the law of the relevant Land (§ 12(1) sentence 4).

What can be reported #

§ 2 HinSchG sets the material scope. It covers information about:

• all criminal offences;
• administrative offences where the rule protects life, physical safety or health, or the rights of employees or their representative bodies, for example occupational health and safety;
• breaches in specific fields of law, among them anti-money laundering, product safety, transport safety, environmental protection, food safety, consumer protection and data protection, plus shareholder rights, audits of public-interest entities and the financial reporting of listed companies;
• breaches of public procurement law, of tax law for corporations and commercial partnerships, and of competition law;
• breaches of the Digital Markets Act and of the AI Act (Regulation (EU) 2024/1689);
• statements by civil servants that breach their duty of loyalty to the constitution.

A breach under the act must be unlawful (§ 3(2)). A breach of an internal policy alone, with no breach of law, is not covered. A company may still open its channel to such reports.

§ 5 excludes, among other things, national security information, classified information (with narrow exceptions), the secrecy of judicial deliberations, and the confidentiality duties of lawyers, notaries, doctors and other professionals bound by secrecy.

Who is protected #

The act protects natural persons who obtained information about breaches in connection with their work, or before starting work (§ 1(1)). That covers not only employees but also, for example, job applicants, agency workers, self-employed people and people working for suppliers. It also protects people who are the subject of a report or affected by it (§ 1(2)).

Protection applies when the person reported internally or externally and, at the time, had reasonable grounds to believe that the information was true and within the scope of the act (§ 33). The reporter may choose freely between the internal office and an external one (§ 7(1)).

Requirements for the internal reporting office #

• Who can run it: an employee, a unit of several employees, or a third party, for example an ombudsperson or a law firm (§ 14(1)). The duty to stop a breach always stays with the employer.
• Independence and expertise: the people in charge are independent in this role. They may have other tasks as long as these cause no conflict of interest. The employer ensures they have the necessary expertise (§ 15) and gives the office the powers it needs (§ 12(4)).
• Channels: reports must be possible orally or in text form. According to the explanatory memorandum (BT-Drs. 20/3442, p. 81), one of the two is enough; for external offices, the act requires both. Oral reports must be possible by telephone or another form of voice transmission. On request, an in-person meeting must be offered within a reasonable time, or by video with the reporter’s consent (§ 16(3)).
• Access: only the people responsible for reports and those who support them may access incoming reports (§ 16(2)).
• Who can report: at least employees and agency workers. The channel may also be opened to other people in professional contact with the company, for example people working for suppliers (§ 16(1)).
• Anonymous reports: the office should also handle anonymous reports. There is no duty to design the channels so that anonymous reports are possible (§ 16(1)). See also anonymous and confidential reporting.
• Information for employees: clear and easily accessible information on the internal procedure (§ 7(3)) and on external reporting offices (§ 13(2)).

Deadlines and what happens after a report #

The act says seven days, not working days. Between receipt and feedback, the office checks whether the breach falls within scope and whether the report is well founded. It stays in contact with the reporter and asks for more information where needed (§ 17(1)).

Follow-up actions under § 18 include internal investigations, referring the reporter to another competent body, closing the case for lack of evidence, or handing it to an internal investigation unit or an authority. Feedback must not affect internal investigations or the rights of the people concerned (§ 17(2)).

Confidentiality and records #

Confidentiality (§ 8). The office protects the identity of the reporter, of the people who are the subject of the report, and of everyone else named in it. Only the people responsible and those who support them may know these identities. This applies even when the office is not competent for the report.

Exceptions (§ 9). The reporter’s identity may be disclosed, for example, in criminal proceedings at the request of the prosecuting authorities, or on a court decision. For follow-up actions, disclosure requires the reporter’s consent in text form, separately for each disclosure. The identity of a person who reports false information intentionally or through gross negligence is not protected.

Records (§ 11).

• All incoming reports are recorded in a durable, retrievable form.
• For telephone reports, an audio recording or a word-for-word transcript requires consent. Otherwise a summary of the content is recorded.
• The reporter may check, correct and confirm the record.
• Records are deleted three years after the case is closed. They may be kept longer only while this is necessary and proportionate under the HinSchG or other laws.

Joint offices and groups of companies #

Joint office. Several private employers with, as a rule, 50 to 249 employees may set up a joint office. The duty to stop the breach and to give feedback to the reporter stays with each employer (§ 14(2)).

Groups of companies. The act itself does not regulate groups. According to the explanatory memorandum (BT-Drs. 20/3442, p. 79), another group company, such as the parent, can act as a “third party” under § 14(1) and run the reporting office for several group companies. Three conditions apply:

• The responsibility to stop a breach stays with each subsidiary.
• Reports must be possible in the working language of the subsidiary.
• The central office must not create extra barriers for reporters.

Works council and data protection #

If a company introduces a software-based reporting office, the works council may have a right of co-determination, in particular under § 87(1) no. 1 and no. 6 of the Works Constitution Act (BetrVG). Reports contain personal data, so also check whether a data protection impact assessment under Art. 35 GDPR is needed. See GDPR and whistleblower reporting.

Penalties and enforcement #

Germany fines a missing internal reporting office, but at a lower ceiling than is often reported. The fines are administrative offences (Ordnungswidrigkeiten) under § 40 HinSchG, in three tiers set by § 40(6):

For legal persons, § 40(6) applies § 30(2) sentence 3 OWiG to obstruction, retaliation and breaches of confidentiality, intentional or negligent, which multiplies the ceiling tenfold: up to €500,000 for the €50,000 offences. The uplift does not reach the no-office fine or the false-disclosure fine. The no-office fine has applied since 1 December 2023 (§ 42(2)); the other fines since the Act entered into force on 2 July 2023.

An honest assessment of enforcement. The fine for having no internal reporting office is widely reported as €50,000. The Act sets €20,000, and the tenfold uplift is reserved for obstruction, retaliation and confidentiality breaches. The larger statutory exposure therefore lies in how reports are handled once a channel exists, not in failing to set one up.

External reporting authority #

The federal external channel is the external reporting office of the Federal Office of Justice. BaFin and the Federal Cartel Office are external reporting offices for their own fields, and each Land may set up its own external office for its administration. Employers should encourage employees to report internally first, but must not restrict or hinder external reporting (§ 7(3)).

Data protection authority #

For private-sector GDPR complaints, the competent authority is usually the state-level data protection authority of the relevant Bundesland. The federal BfDI complaints guidance explains this split.

Setting up in six steps #

1. Check the duty: as a rule, at least 50 employees; listed financial entities at any size.
2. Staff the office: internally, as a joint office (50 to 249 employees), at a group company, or with a third party. Ensure independence, expertise and powers.
3. Set up channels: oral or written, an in-person meeting on request, access only for the people responsible. Decide whether to accept anonymous reports.
4. Involve the works council and data protection: settle co-determination; check whether a data protection impact assessment is needed.
5. Inform employees: about the internal procedure and the external reporting offices.
6. Set the procedure: acknowledgement within 7 days, feedback within 3 months, records, and deletion after three years.

Official sources #

• HinSchG — official text
• Government bill with explanatory memorandum, BT-Drs. 20/3442
• Federal Office of Justice — external reporting office
• BfDI — complaints about data protection authorities

Frequently asked questions #

What does HinSchG stand for? #

HinSchG is short for Hinweisgeberschutzgesetz, the “Act for Better Protection of Whistleblowers”. It transposes Directive (EU) 2019/1937 into German law. It protects people who report breaches and requires employers with 50 or more employees to have an internal reporting office.

When did the HinSchG enter into force? #

On 2 July 2023. For private employers with 50 to 249 employees, the duty to have an internal reporting office applies from 17 December 2023. The fine for a missing office applies from 1 December 2023.

What does § 2 HinSchG cover? #

§ 2 sets which breaches the act covers: all criminal offences, certain administrative offences that protect life, health and employee rights, and breaches in fields such as money laundering, product safety, environmental protection, consumer protection, data protection, procurement, tax and competition law, and the AI Act.

Must companies accept anonymous reports? #

No. The internal office should handle anonymous reports it receives, but there is no duty to design the channels so that anonymous reports are possible (§ 16(1)).

What deadlines apply after a report? #

The office acknowledges receipt within 7 days. Within 3 months of the acknowledgement, it gives feedback on planned and completed follow-up actions (§ 17).

How long may a report be kept? #

Records are deleted three years after the case is closed. They may be kept longer only where this is necessary and proportionate under the HinSchG or other laws (§ 11(5)).

What is the fine for having no internal reporting office? #

Up to €20,000 (§ 40(2) no. 2, § 40(6)). Higher fines of up to €50,000, or €500,000 for companies, apply to obstructing reports, retaliation, and intentional or reckless breaches of confidentiality.

May an external provider run the reporting office? #

Yes. A third party, such as an ombudsperson, a law firm or another group company, may run the internal reporting office. The duty to stop a breach stays with the employer (§ 14(1)).

Deploy your whistleblowing channel →