German Whistleblower Protection Act (HinSchG): obligations for companies, internal reporting office and fines

What this is about

The German Whistleblower Protection Act (Hinweisgeberschutzgesetz, HinSchG) entered into force on 2 July 2023. It transposes Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law. It protects natural persons who have obtained information on breaches in connection with their professional activities and report or publicly disclose it (section 1 HinSchG). Its material scope covers, among other things, breaches subject to criminal penalties, certain breaches subject to administrative fines and breaches in a catalogue of areas of law, including anti-money laundering and product safety (section 2).

Who must set up an internal reporting office

Employers with, as a rule, at least 50 employees must set up and operate at least one internal reporting office (section 12(1) and (2)). For certain financial sector undertakings, such as credit institutions and investment firms, the obligation applies irrespective of the number of employees (section 12(3)). Private employers with 50 to 249 employees had to set up their reporting offices from 17 December 2023 (section 42(1)).

Organising the internal reporting office

The tasks may be assigned to an employee, an organisational unit or a third party. An employer that engages a third party remains obliged to take appropriate measures to remedy a breach itself (section 14(1)). Several private employers with 50 to 249 employees may operate a joint office (section 14(2)).

The persons responsible act independently, must have the necessary expertise and may perform other tasks only where this does not lead to conflicts of interest (section 15).

Reporting channels must allow reports to be made orally or in text form. At the whistleblower's request, an in-person meeting must be offered (section 16(3)). Anonymous reports should be processed, but there is no obligation to provide channels for anonymous reporting (section 16(1)).

Procedure and deadlines

The internal reporting office acknowledges receipt of a report within seven days at the latest. It examines the report and takes appropriate follow-up action (section 17(1)). Within three months of the acknowledgement, the whistleblower receives feedback on follow-up action planned and taken (section 17(2)).

Reports must be documented while maintaining confidentiality. As a rule, the documentation is deleted three years after the procedure has been concluded (section 11). The identity of the whistleblower and of the persons named in the report must be kept confidential (section 8).

Protection against retaliation

Whistleblowers may choose between internal and external reporting. The Federal Office of Justice (Bundesamt für Justiz) hosts the federal external reporting office (sections 7 and 19). Retaliation is prohibited. Where a whistleblower suffers a professional disadvantage after a report, it is presumed to be retaliation, and the employer must prove otherwise (section 36). Infringements of the prohibition give rise to a claim for damages (section 37).

Fines under the HinSchG

Section 40 provides, among other things, for the following fines:

• No internal reporting office: up to EUR 20,000, applicable since 1 December 2023 (section 40(2), point 2, and (6); section 42(2)).
• Obstructing reports and retaliation: up to EUR 50,000.
• Intentional or reckless breach of confidentiality: likewise up to EUR 50,000.

For these three cases, the Act refers to section 30(2), third sentence, of the Act on Regulatory Offences (OWiG). As a result, fines against companies may be up to ten times higher.

Interface with the complaints procedure under the LkSG

Companies with at least 1,000 employees in Germany (section 1 of the Supply Chain Due Diligence Act, LkSG) must additionally establish a complaints procedure under section 8 LkSG. The two procedures differ:

• Who reports: The LkSG procedure is open to all persons, including employees of suppliers and local residents. The HinSchG channel is aimed at employees and may be opened to other persons in professional contact with the employer (section 16(1) HinSchG).
• What is reported: Under the LkSG, reports concern human rights and environmental risks and violations of duties in the company's own business area and at suppliers (sections 8 and 9 LkSG). Under the HinSchG, they concern breaches of law within the scope of section 2.
• Requirements: The LkSG requires publicly available rules of procedure in text form, impartial persons in charge who are not bound by instructions, confidentiality, protection against disadvantage and a review of effectiveness at least once a year (section 8(2) to (5) LkSG).

According to the guidance of the Federal Office for Economic Affairs and Export Control (BAFA) on the complaints procedure (October 2022), it may be advisable to build on existing whistleblowing systems. Companies should check which target groups and topics the existing system does not yet cover.

The Federal Government has introduced a bill amending the LkSG (Bundestag printed paper 21/2474 of 29 October 2025). Under the bill, failing to establish a complaints procedure would remain subject to a fine. The Bundestag held a first reading on 16 January 2026 and referred the bill to committee.

What companies typically examine

1. Obligation: Is the threshold of 50 employees reached, or does a special rule for the financial sector apply?
2. Organisation: Is the reporting office staffed independently, with the necessary expertise and free of conflicts of interest?
3. Channels and deadlines: Can reports be made orally and in text form, and are the seven-day and three-month deadlines met?
4. LkSG: Does a joint channel or do separate procedures reflect the different target groups and topics?

This post provides a general overview of the legal position and does not replace legal advice on individual cases.

← All posts