In Germany, employees may choose freely: the employer's internal reporting office, or an authority's external reporting office (§ 7 Abs. 1 HinSchG) [1]. They should prefer the internal one where it can act effectively and no reprisal is to be feared. There is no duty to report internally first.

Not legal advice

This article gives general information. It reflects the HinSchG as amended on 25 September 2026 [1].

The reporting routes

Reporting routes under the HinSchG: whoever knows of a breach in a work context chooses freely between the employer's internal reporting office and an external reporting office at the BfJ, BaFin, Bundeskartellamt or a state. Without a remedy internally, the external route stays open. If no follow-up comes there in time, public disclosure is protected under the conditions of § 32. Reporting routes under the HinSchG: whoever knows of a breach in a work context chooses freely between the employer's internal reporting office and an external reporting office at the BfJ, BaFin, Bundeskartellamt or a state. Without a remedy internally, the external route stays open. If no follow-up comes there in time, public disclosure is protected under the conditions of § 32.
Internal and external rank equally. The public is the last route.

Which external reporting channel is responsible

External office Responsible for Provision
Federal Office of Justice (BfJ) [2] everything no other external office covers § 19 Abs. 4
BaFin [3] financial supervision, such as banks, insurers, securities trading, and money laundering there § 21
Bundeskartellamt [4] competition law and the Digital Markets Act § 22 Abs. 1
A federal state, if it has set one up its own state and municipal administration § 20

Reporting persons may go to the Bundeskartellamt at any time, even while an internal procedure is running (§ 22 Abs. 1).

What the external office does

Step Deadline Provision
Confirm receipt promptly, within 7 days at the latest § 28 Abs. 1
Check whether the breach falls under the law no deadline of its own § 28 Abs. 2
Give feedback within 3 months, 6 months in extensive cases § 28 Abs. 4

The external offices also advise before a report, and point to the internal route when they do (§ 24 Abs. 2).

When going public is protected

Whoever makes information public is protected only under the conditions of § 32. The usual case: after an external report, no follow-up or feedback came within the deadline. Exceptions apply, for example in an emergency or where evidence could be destroyed.

What this means for employers

  • Inform. The internal reporting office provides clear information on the external procedures (§ 13 Abs. 2).
  • Make the internal route attractive. Incentives are welcome, but external reporting must not be made harder (§ 7 Abs. 3).
  • Do not obstruct. Obstructing a report risks a fine of up to €50,000 (§ 40 Abs. 2 Nr. 1, Abs. 6).
  • Act quickly and visibly. An internal office that confirms, follows up and takes measures is the best reason to report internally.

OpenWhistle names the external offices, OLAF of the EU included, on a page of its own, linked from every footer and beside the report form [5]. Whether you must run an internal office: Who needs a whistleblowing system?

An internal route that works

OpenWhistle tracks the deadlines of § 17 per case and keeps contact via case number and PIN. The live demo shows both sides.

Open the live demo →

More resources: HinSchG compliance guide · Who needs a whistleblowing system? · Anonymous whistleblowing

Sources

  1. Hinweisgeberschutzgesetz (HinSchG), as amended on 25 September 2026, gesetze-im-internet.de (German). Retrieved 27 October 2026.
  2. Bundesamt für Justiz, Externe Meldestelle des Bundes (German). Retrieved 27 October 2026.
  3. BaFin, whistleblower office (German). Retrieved 27 October 2026.
  4. Bundeskartellamt, reports of competition violations (German). Retrieved 27 October 2026.
  5. OpenWhistle, CHANGELOG.md: section 2.4.0, External reporting offices. Retrieved 27 October 2026.