> Austria's HinweisgeberInnenschutzgesetz (HSchG): the 50-worker trigger, Austria's designated external reporting offices, and the official BAK and DSB sources.

Source: https://ethicsportal.eu/whistleblower-laws/austria/
Updated: 2026-04-24

---

# Whistleblower law in Austria

Austria implemented Directive (EU) 2019/1937 through the **HinweisgeberInnenschutzgesetz (HSchG)**, promulgated on **24 February 2023** and in force since **25 February 2023**. The Austrian regime is more statute-bound than some broader national systems because the act ties protection and reporting channels to the material scope defined in the HSchG.

## Applicable law

- [HinweisgeberInnenschutzgesetz (HSchG) — official RIS text](https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=Bundesnormen&Gesetzesnummer=20012541)
- [BAK overview of Austrian reporting offices](https://www.bak.gv.at/701/start.aspx)

## Who must establish an internal channel

Many private legal entities with **at least 50 employees** must establish an internal reporting channel. Public legal entities and certain specially regulated bodies are also covered under the act's own rules.

## External reporting authority

Austria uses **several designated external reporting offices** rather than one universal national authority. The [Federal Bureau of Anti-Corruption (BAK)](https://www.bak.gv.at/701/start.aspx) operates an official external reporting office under the HSchG and is the clearest federal reference point for general guidance.

## Data protection authority

For data-protection complaints relating to the handling of whistleblower reports, the relevant authority is the [Austrian Data Protection Authority (DSB)](https://dsb.gv.at/sites/site0344/media/downloads/beschwerde_an_die_datenschutzbehoerde_complaint_to_the_austrian_data_protection_authority_art15-18_20-22_dsgvo_gdpr.pdf).

## Key compliance points

- Austria's whistleblower regime follows the material scope listed in the HSchG, so employers should not market a channel as covering everything unless their own internal policy clearly says so.
- The official BAK materials stress confidential handling, secure communication and the possibility of anonymous reporting through the external system.
- In practice, Austrian organisations should point reporters to the correct external office for the relevant subject matter rather than assuming one central state inbox.

## Official sources

- [HSchG — official RIS text](https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=Bundesnormen&Gesetzesnummer=20012541)
- [BAK — reporting offices under the HSchG](https://www.bak.gv.at/701/start.aspx)
- [BAK — newly established reporting offices](https://bak.gv.at/en/news.aspx?id=576273413155337839546B3D)
- [BAK — HSchG FAQ](https://www.bak.gv.at/601/FAQ.aspx)
- [DSB — complaint form](https://dsb.gv.at/sites/site0344/media/downloads/beschwerde_an_die_datenschutzbehoerde_complaint_to_the_austrian_data_protection_authority_art15-18_20-22_dsgvo_gdpr.pdf)

---

[Deploy your reporting channel →](/pricing/)