Whistleblower law in Germany #
Germany implemented Directive (EU) 2019/1937 through the Hinweisgeberschutzgesetz (HinSchG), in force since 2 July 2023. For most private employers, the decisive trigger is 50 employees, with a specific allowance for shared internal offices in the 50-249 band.
Applicable law #
Who must establish an internal channel #
Private employers with 50 or more employees must establish at least one internal reporting office. The act also allows private employers with 50 to 249 employees to establish and operate a joint internal reporting office.
External reporting authority #
The federal external channel is the external reporting office of the Federal Office of Justice . Germany also maintains specialised external channels in regulated sectors such as financial services and competition law.
Data protection authority #
For private-sector GDPR complaints, the competent authority is usually the state-level data protection authority of the relevant Bundesland. The federal BfDI complaints guidance explains this split.
Key compliance points #
- Internal offices must provide clear information about external reporting procedures and competent authorities.
- Germany requires written and oral intake and an in-person meeting option on request.
- Anonymous reports are not uniformly mandatory across all regimes, but the federal law strongly encourages handlers to process them.
Official sources #
- HinSchG — official text
- Federal Office of Justice — external reporting office
- BfDI — complaints about data protection authorities
Deploy your reporting channel →
Last updated: