The German Whistleblower Protection Act (HinSchG) requires neither an ombudsperson nor any particular software [1]. It requires an internal reporting office with reporting channels (§ 12, § 16). The office can be your own employees or a third party, such as an ombudsperson (§ 14 Abs. 1). Whistleblowing software is the channel through which reports reach it.

Not legal advice

This article gives general information. It reflects the HinSchG as amended on 25 September 2026 [1].

Who does which task

Ombudsperson and whistleblowing software working together: the reporting person reports through the whistleblowing software, the written channel that tracks the deadlines. The report reaches the internal reporting office, own employees or an ombudsperson, independent and competent under § 15. The employer remedies the breach and always stays responsible under § 14 Abs. 1. Phone and meetings are organised by the office. Ombudsperson and whistleblowing software working together: the reporting person reports through the whistleblowing software, the written channel that tracks the deadlines. The report reaches the internal reporting office, own employees or an ombudsperson, independent and competent under § 15. The employer remedies the breach and always stays responsible under § 14 Abs. 1. Phone and meetings are organised by the office.
The software carries the channel, the office the decision, the employer the remedy.
Task Software People
Accept reports in writing (§ 16 Abs. 3) yes no
Oral reports, a meeting on request (§ 16 Abs. 3) no yes
Access only for those responsible (§ 16 Abs. 2) roles and permissions who is responsible
Confirm receipt in 7 days, give feedback after 3 months (§ 17) tracks the deadlines writes the answer
Check the report, take follow-up measures (§ 17 Abs. 1, § 18) documents decides and acts
Be independent and competent (§ 15) no yes
Remedy the breach (§ 14 Abs. 1) no the employer, always

Three models

Model Fits when Mind
Your own employees as the reporting office there are people without a conflict of interest ensure their competence (§ 15 Abs. 2)
An external ombudsperson as the reporting office nobody inside is independent enough remedy stays with the employer (§ 14 Abs. 1)
The ombudsperson works in your system you want to keep data and channel yourself give the ombudsperson access through roles

Some providers bundle both: with WhistlePort's package 3, lawyers examine and handle the reports, for €79 a month plus VAT on top of the platform [3]. If a third party processes the reports on your behalf, you need a contract under Art. 28 GDPR [2].

One ombudsperson, several companies

An ombudsperson often serves several clients. OpenWhistle keeps them apart in one installation: each organisation has its own reports, categories and accounts, and its own reporting link [4]. How to set it up is in Multi-tenancy. Companies with 50 to 249 employees may also share a reporting office (§ 14 Abs. 2).

The channel for your reporting office

OpenWhistle is free and open source. Whether your employees or an ombudsperson handle the cases is a matter of roles.

Open the live demo →

More resources: Who needs a whistleblowing system? · HinSchG compliance guide · Whistleblowing software providers compared

Sources

  1. Hinweisgeberschutzgesetz (HinSchG), as amended on 25 September 2026, gesetze-im-internet.de (German). Retrieved 27 October 2026.
  2. Regulation (EU) 2016/679 (GDPR), EUR-Lex. Retrieved 27 October 2026.
  3. WhistlePort, prices (German): package 3. Retrieved 27 October 2026.
  4. OpenWhistle 2.4.0, source code: organisations and roles. Retrieved 27 October 2026.