FAQ: Questions and answers

Who is a whistleblower?

A whistleblower is a natural person who reports or passes on information about violations of the law or unethical behaviour received within their organisation (company or authority) in connection with their work activities.

Which companies fall within the scope of the Whistleblower Protection Act?

The provisions of the HinSchG are linked to the term “employer”. This includes all natural and legal persons under public and private law as well as partnerships and associations with legal capacity.

Employers with more than 50 employees as well as all public institutions such as cities, municipalities, and districts with more than 10,000 inhabitants fall within the scope of the HinSchG. Regarding the implementation obligation of the municipalities and other legal persons under public law, see question ‘Do municipalities and other legal persons under public law already have to set up an internal reporting office?’.

Do municipalities and other legal persons under public law already have to set up an internal reporting office?

In principle, municipalities and legal persons under public law are currently not covered by the scope of application of the HinSchG, even after the promulgation of the HinSchG, insofar as they are authorities of the Länder. This means that until state law regulations are enacted, there is no obligation to set up an internal reporting service. However, employees in public authorities and other public-law institutions may invoke the EU Whistleblower Directive from 18 December 2021. Possible information may come from civil servants, employees, suppliers, and service providers and may concern, for example, violations of procurement, budgetary or labour law as well as municipal bylaws.

Do internal and external reporting offices also have to process anonymous hints?

The internal reporting office should process anonymous hints. However, there is no obligation to design reporting channels to allow anonymous hints.

The external reporting office should also process anonymous hints. However, subject to special legal regulations, there is no obligation to design the reporting channels in such a way that they enable anonymous hints to be submitted.

In what kind of form must whistleblowing be made possible?

The internal reporting offices shall allow for oral or textual reporting. Oral reporting must be possible by telephone or other form of voice transmission. It must also be possible to meet in person if the whistleblower so wishes.

External reporting offices, on the other hand, must allow both oral reports and reports in text form. Oral reports must be possible by telephone or by another form of voice transmission. A personal interview must also be possible if the whistleblower so wishes.

How can the acceptance of the internal reporting office be increased in the company?

The acceptance of the internal reporting offices in the company can be strengthened by the trust and independence of the reporting office. In this context, the possibility of commissioning a third party to outsource the reporting office is a good way to increase acceptance within the company.

What are reprisals?

Reprisals are acts or omissions in connection with professional activity which are a reaction to a hint or disclosure and because of which the whistleblower suffers or could suffer an unjustified disadvantage.

How does a notification procedure work?

The reporting procedure begins with the submission of a hint. An acknowledgement of receipt must be sent to the whistleblower after 7 days at the latest. The operators of the reporting office check the validity of the hint and contact the whistleblower to obtain additional information or evidence if necessary. Feedback on the current status of the procedure and on any follow-up measures must be provided after three months at the latest.

How long must the hints be kept?

All hints received must be documented and kept for three years after the conclusion of the procedure. For voice hints, audio recordings may only be kept with the consent of the whistleblower.

Which hints are not protected by the Whistleblower Protection Act?

Hints that concern national security or essential security interests of the state does not fall within the scope of protection of the HinSchG. Furthermore, professional secrecy obligations must also be observed, such as judicial secrecy and medical and legal professional secrecy.

Which persons can be whistleblowers?

The personal scope of application of the HinSchG extends to employees who have become aware of violations in connection with their occupational activity or in the run-up to an occupational activity. These include:

  • Employees whose employment relationship has either not yet begun or has already ended,
  • Trainees and paid and unpaid interns.
  • Supporters of the whistleblower,
  • Journalists,
  • Shareholders of the company
  • Persons who are members of the administrative, management or supervisory body of a company
  • Contractors,
  • Subcontractors
  • Suppliers
  • Temporary workers

Does the works council have to be consulted on the introduction of the internal reporting office?

Yes. In principle, the employer must set up an internal reporting office and consider the works council’s participation rights. Pursuant to section 80 (2) of the Works Council Constitution Act (BetrVG), the works council has a right to be informed about the planned establishment of a reporting office. Pursuant to section 87 (1) nos. 1, 6 BetrVG, the works council also has a right of co-determination if the establishment of the reporting office goes beyond the legal requirements.

Who bears the burden of proof if the whistleblower defends himself against reprisals?

If a whistleblower suffers a disadvantage in connection with his professional activity and claims to have suffered this disadvantage due to a whistleblowing statement, it is presumed that this disadvantage is a reprisal. The person who has disadvantaged the whistleblower must then prove that the disadvantage was based on sufficiently justified reasons or not on the whistleblowing.

What is a group privilege and how does it work?

This question has not yet been clarified uniformly. The European Commission is against a group-wide central reporting office. Accordingly, a reporting office that is only located at the parent company cannot apply to all subsidiaries and sub-subsidiaries. Thus, each individual subsidiary and sub-subsidiary, insofar as it falls within the scope of the Directive due to its number of employees, must also set up its own reporting office.

The German legislator explicitly allows the so-called group privilege. The explanatory memorandum to the law describes that a central reporting office is permissible as long as the commissioning company (subsidiary) remains responsible for the elimination and prosecution of an infringement. Here, too, confidentiality must be maintained. In the case of cross-border groups, it must also be considered that any language barriers in the central reporting system must not exist. Also, no additional hurdles should be imposed on whistleblowers.

It remains to be seen whether the group privilege will be maintained or whether infringement proceedings will be initiated against Germany for introducing the group privilege for this reason. For this reason, the group privilege should be viewed critically.

May companies that have already set up central internal reporting office continue to use them?

Yes, already implemented reporting offices can still be used as long as they meet the requirements of the HinSchG. If one follows the opinion of the European Commission, an additional internal reporting office must now be implemented at the respective subsidiaries.

Which law is applicable to cross-border groups?

In the case of groups operating across borders, the law of the respective state that protects respondents must be observed.

May trade secrets be included in the hints?

Trade secrets and confidential information may be reported provided that the whistleblower had reasonable grounds to believe that the disclosure of the trade secret was necessary to detect an infringement. In this context, the disclosure of trade secrets and confidential information is permissible.

Do internal reporting offices also need to be introduced in the public sector?

Yes. The obligation to establish and operate an internal reporting office applies directly to public employers. Public employers with at least 50 employees or at least 10,000 inhabitants are obliged to do so.

What is the threat to a company that has not set up an internal reporting office?

Failure to implement internal reporting offices is an administrative offence punishable by a fine of 50,000 euros.

What is the so-called duty of confidentiality and who does it protect?

The confidentiality requirement is intended to ensure that the data of the whistleblower, the person concerned by the information and other persons connected with the information are protected.

To what extent is whistleblowing compatible with data protection rules?

Personal data must always be processed in accordance with data protection regulations.

With the introduction of the General Data Protection Regulation (DSGVO) and the Bundesdatenschutzgesetz (BDSG), the rights of data subjects have been noticeably strengthened. Extensive rights of access and information were introduced for data subjects. Due to the secrecy requirement under the HinSchG, these rights to information and disclosure must be limited. Pursuant to section 29, paragraph 1, sentence 1 of the BDSG, the data subject’s right to information does not apply if the information would disclose information which, by its nature, must be kept secret. Secrecy is necessary in particular because of the overriding legitimate interests of a third party (in this case, the party obliged to provide information).

How many hints can be expected per year?

In the official explanatory memorandum to the HinSchG, the legislator assumes 4 dismissals per 1,000 employees per year.


What is the Supply Chain Duty of Care Act?

The Supply Chain Duty of Care Act (LkSG) came into force on 01 January 2023 and regulates the responsibility of companies for compliance with human rights and environmental protection rights in their own operations along the entire supply chain.

The LkSG applies from 2023 for companies with at least 3000 employees and from 2024 for companies with at least 1000 employees.

Can the whistleblowing system and the establishment of a complaints procedure be combined?

Yes! If companies are already affected by the LkSG now or in the coming year, it makes sense to combine both reporting offices. In this way, synergy effects can be used, and costs saved.