The German Whistleblower Protection Act (Hinweisgeberschutzgesetz, HinSchG) has applied since 2 July 2023. It transposes EU Directive 2019/1937 into German law. Employers with normally at least 50 employees must set up and run an internal reporting channel (interne Meldestelle).
Not legal advice
This guide gives general information. It reflects the text of the law on gesetze-im-internet.de, retrieved on 27 September 2026. For your own case, ask a lawyer.
Who is obliged?
| Who | Provision | Obliged since |
|---|---|---|
| Employers with normally at least 250 employees | § 12 Abs. 1, 2 | 2 July 2023 |
| Private employers with 50 to 249 employees | § 42 Abs. 1 | 17 December 2023 |
| Certain financial companies of any size, such as credit institutions and insurers | § 12 Abs. 3 | 2 July 2023 |
| Federal and state government: organisational units chosen by the supreme authorities | § 12 Abs. 1 | 2 July 2023 |
| Municipalities and their companies | § 12 Abs. 1 | under state law |
The law counts employees “normally” employed (“in der Regel”, § 12 Abs. 2); it does not mention full-time equivalents. Employees include trainees and persons similar to employees (§ 3 Abs. 8).
What the internal reporting channel must do
-
Reports in text form and orally (§ 16 Abs. 3) Orally means by telephone or another voice transmission. On request, an in-person meeting must be made possible.
-
Only those responsible have access (§ 16 Abs. 2) Incoming reports are seen only by the people who receive and handle them, and by those who assist them.
-
Confidentiality of identity (§ 8) This covers the whistleblower, the accused and any other person named.
-
Handle anonymous reports where possible (§ 16 Abs. 1) The channel “should” handle anonymous reports. The law does not require an anonymous channel.
-
Stay in contact and ask questions (§ 17 Abs. 1 Nr. 3, 5) It must be possible to ask the whistleblower follow-up questions.
-
Independent and competent (§ 15) The appointed people may have other duties, but no conflicts of interest.
-
Inform (§ 7 Abs. 3, § 13 Abs. 2) Employees receive clear information about the internal procedure and about external reporting offices.
The deadlines at a glance
| Deadline | Provision | What |
|---|---|---|
| 7 days | § 17 Abs. 1 Nr. 1 | Confirm receipt of the report, within seven days at the latest |
| 3 months | § 17 Abs. 2 | Feedback within 3 months of the confirmation of receipt; without one, at the latest 3 months and 7 days after receipt |
| 3 years | § 11 Abs. 5 | Documentation is deleted three years after the procedure ends; longer only if necessary and proportionate |
The law sets no separate deadline for checking whether a report is well-founded (§ 17 Abs. 1 Nr. 4).
Fines under § 40
| Violation | Provision | Up to |
|---|---|---|
| No internal reporting channel set up or run | § 40 Abs. 2 Nr. 2 | €20,000 |
| Report or communication obstructed | § 40 Abs. 2 Nr. 1 | €50,000 |
| Retaliation against the whistleblower | § 40 Abs. 2 Nr. 3 | €50,000 |
| Confidentiality breached intentionally or recklessly | § 40 Abs. 3 | €50,000 |
| Confidentiality breached negligently | § 40 Abs. 4 | €10,000 |
The fine for a missing reporting channel has applied since 1 December 2023 (§ 42 Abs. 2). For obstruction, retaliation and breach of confidentiality, § 40 Abs. 6 refers to § 30 Abs. 2 Satz 3 OWiG. Against a company, the maximum can then be ten times as high.
What can be reported
The material scope is set out in § 2. Protection covers above all reports about:
- Criminal offences (§ 2 Abs. 1 Nr. 1)
- Administrative offences, where the provision protects life, limb or health, or the rights of employees and their representative bodies (§ 2 Abs. 1 Nr. 2)
- Violations of certain federal, state and EU rules, for example on money laundering, product safety, environmental protection and data protection (§ 2 Abs. 1 Nr. 3 ff.)
A mere dispute about holidays or working hours is not covered, as long as it involves no such violation.
What software covers and what it does not
The law prescribes no technology. Software can carry the text channel, the deadlines and the documentation. This is how it divides up with OpenWhistle:
| Duty | Provision | OpenWhistle |
|---|---|---|
| Channel in text form | § 16 Abs. 3 | Web form, optionally over Tor |
| Oral channel | § 16 Abs. 3 | not in the software; guidance in the admin area |
| Access only for those responsible | § 16 Abs. 2 | Roles; case handlers see only their own cases |
| Confidentiality | § 8 | no IP storage; identity visible only after a logged reason |
| 7 days, 3 months | § 17 | Counters in the dashboard, email reminder |
| Documentation, deletion | § 11 | encrypted case file, audit log; deletion after 1095 days |
| Independence, competence | § 15 | Your task |
Checklist in ten steps
-
Check the obligation.Normally at least 50 employees, or a financial company under § 12 Abs. 3?
-
Choose the organisational form.Your own employees or a third party such as an ombudsperson (§ 14 Abs. 1). With 50 to 249 employees, a shared channel is also possible (§ 14 Abs. 2).
-
Appoint the people.Independent, without conflicts of interest, competent (§ 15).
-
Set up the text channel.For example with OpenWhistle; the guide shows the installation.
-
Set up the telephone.A number that reaches only the reporting channel. Record only with consent (§ 11 Abs. 2).
-
Monitor the deadlines.Seven days for the confirmation, three months for the feedback.
-
Define the deletion policy.Deletion follows three years after the procedure ends (§ 11 Abs. 5). In OpenWhistle, that is the default.
-
Document data protection.Record of processing activities, privacy notice and, with every service provider, a contract under Art. 28 GDPR.
-
Involve the works council, if there is one.Co-determination rights under § 87 Abs. 1 BetrVG may be affected.
-
Inform employees.About the internal route and about external reporting offices (§ 7 Abs. 3, § 13 Abs. 2).
Set up the text channel for free
OpenWhistle is open source under GPL-3.0 and tracks the deadlines under § 17. The live demo shows both sides.
Try the live demo →Frequently asked questions
What happens if we do not set up a reporting channel?
That is an administrative offence with a fine of up to €20,000 (§ 40 Abs. 2 Nr. 2, Abs. 6). Whistleblowers can turn to an external reporting office at any time anyway (§ 7 Abs. 1).
Can we hire an external provider?
Yes. A third party can take over the tasks of the internal reporting channel (§ 14 Abs. 1). The duty to remedy a violation stays with the employer, though. You need a contract under Art. 28 GDPR with the service provider.
Does the HinSchG apply to every group company?
The duty falls on each employer separately (§ 12 Abs. 1). Several private employers with 50 to 249 employees may run a shared channel (§ 14 Abs. 2). Feedback and remedy remain with each one. In OpenWhistle, each organisation gets its own reporting link for this.
More resources: Step-by-step installation guide · Free whistleblowing system: what it really costs · Whistleblowing software providers compared 2026 · HinSchG full text (gesetze-im-internet.de)