> Germany's Hinweisgeberschutzgesetz (HinSchG): private-sector threshold, shared internal offices, and the official external and data protection authorities.

Source: https://ethicsportal.eu/whistleblower-laws/germany/
Updated: 2026-04-24

---

# Whistleblower law in Germany

Germany implemented Directive (EU) 2019/1937 through the **Hinweisgeberschutzgesetz (HinSchG)**, in force since 2 July 2023. For most private employers, the decisive trigger is **50 employees**, with a specific allowance for shared internal offices in the 50-249 band.

## Applicable law

- [Hinweisgeberschutzgesetz (HinSchG)](https://www.gesetze-im-internet.de/hinschg/BJNR08C0B0023.html)

## Who must establish an internal channel

Private employers with **50 or more employees** must establish at least one internal reporting office. The act also allows private employers with **50 to 249 employees** to establish and operate a joint internal reporting office.

## External reporting authority

The federal external channel is the [external reporting office of the Federal Office of Justice](https://formulare.bfj.bund.de/ffw/action/invoke.do?id=externeMeldestelle). Germany also maintains specialised external channels in regulated sectors such as financial services and competition law.

## Data protection authority

For private-sector GDPR complaints, the competent authority is usually the state-level data protection authority of the relevant Bundesland. The federal [BfDI complaints guidance](https://www.bfdi.bund.de/DE/Buerger/Inhalte/Allgemein/Datenschutz/BeschwerdeBeiDatenschutzbehoereden.html) explains this split.

## Key compliance points

- Internal offices must provide clear information about external reporting procedures and competent authorities.
- Germany requires written and oral intake and an in-person meeting option on request.
- Anonymous reports are not uniformly mandatory across all regimes, but the federal law strongly encourages handlers to process them.

## Official sources

- [HinSchG — official text](https://www.gesetze-im-internet.de/hinschg/BJNR08C0B0023.html)
- [Federal Office of Justice — external reporting office](https://formulare.bfj.bund.de/ffw/action/invoke.do?id=externeMeldestelle)
- [BfDI — complaints about data protection authorities](https://www.bfdi.bund.de/DE/Buerger/Inhalte/Allgemein/Datenschutz/BeschwerdeBeiDatenschutzbehoereden.html)

---

[Deploy your reporting channel →](/pricing/)