Most readers of an English-language page on the Hinweisgeberschutzgesetz are not the law's intended addressee. They are the group compliance officer, the general counsel or the head of internal audit of a company that has acquired, founded or inherited a German entity, and someone has told them that entity needs a reporting channel of its own. The instinctive reply — we already run a global hotline — is half right, and the wrong half is the expensive one.
The Hinweisgeberschutzgesetz, abbreviated HinSchG and usually rendered in English as Germany's whistleblower protection act, transposes the European whistleblowing directive into German law. It pursues two aims at once: people who report wrongdoing are to be protected from detriment, and organisations are to build an orderly route on which reports arrive internally before they go external or public.
Who has to establish an internal reporting office
The duty under § 12(1) sentence 1 HinSchG applies, under § 12(2), only to employers with, as a rule, at least 50 employees each. What counts is the regular number of employees, not a headcount on a particular date.
Irrespective of employee numbers, the duty catches certain undertakings in the financial and securities sector, which § 12(3) HinSchG lists expressly. For private employers with, as a rule, between 50 and 249 employees, the transitional rule in § 42 HinSchG provided that they had to establish their internal reporting offices only from 17 December 2023.
The threshold attaches to the employer. In a group, that means the German entity, not the group. This is where the global-hotline answer begins to come apart.
What a group hotline settles, and what it does not
German law is accommodating about who operates the channel and strict about who remains answerable for it.
Under § 14(1) HinSchG a third party may be entrusted with the tasks of an internal reporting office: a law firm, an ombudsperson service, in many groups a group function. Entrusting a third party does not, however, release the entrusting employer from the obligation to take appropriate measures itself. Investigating the matter and putting a stop to the wrongdoing remain with the company.
Private employers with, as a rule, between 50 and 249 employees may under § 14(2) HinSchG establish and operate a shared unit. What is shared is the receipt of reports; the duty to give feedback to the reporting person remains with the individual employer.
Read together, the two provisions describe what a group actually has to be able to show: that the German entity's own reports are received, acknowledged, followed up and answered within the German deadlines, whoever runs the intake platform.
What can be reported
The material scope sits in § 2 HinSchG and is narrower than the everyday word "whistleblowing" suggests. It covers, among other things, criminal offences; certain offences subject to fines, where the provision breached serves to protect life, limb or health or the rights of employees; and breaches of numerous expressly named areas of law, among them money laundering, product safety, environmental protection, food and pharmaceutical law, public procurement, data protection, consumer protection and competition law. The statutory text is the authority for the full list.
The internal reporting office is therefore not a general channel for every kind of grievance. It is nonetheless worth deciding in advance how reports falling outside the scope will be handled, rather than turning them away without a rule.
Reporting channels and anonymity
Under § 16(3) HinSchG internal reporting channels must make reports possible in oral or in text form; at the reporting person's request, an in-person meeting must additionally be made possible within a reasonable time. Only the responsible persons and those supporting them may have access to incoming reports.
On anonymity the statute is more precise than it is usually reported to be. The internal reporting office should also process reports received anonymously. There is, however, no obligation to design the reporting channels so that anonymous reports can be submitted at all. Offering an anonymous route goes beyond the statutory minimum, which is often a sensible choice, since it raises the likelihood that anything is reported in the first place.
Access must be open at least to the employer's own employees and to temporary agency workers assigned to it. The circle may be extended to further people who are in contact with the undertaking in the course of their professional activity.
The deadlines in § 17 HinSchG
| Step | Deadline |
|---|---|
| Acknowledgement of receipt to the reporting person | after seven days at the latest |
| Feedback on follow-up planned and taken | within three months of the acknowledgement, and at the latest three months and seven days after the report was received |
Feedback must not prejudice internal enquiries or the rights of the persons concerned. These deadlines are the most common operational stumbling block, because they run whether or not the facts have been established.
External reporting offices
Reporting persons may choose between an internal and an external report. Under § 19 HinSchG the Federation maintains an office for external reports at the Bundesamt für Justiz (the Federal Office of Justice); further external reporting offices exist under §§ 20 to 23 HinSchG. For a company that is a strong practical argument for a functioning internal channel: a report handled reliably in-house goes outside first far less often.
Prohibition of reprisals, and fines
Under § 36(1) HinSchG reprisals against reporting persons are prohibited, and the prohibition extends to threatening and attempting them. § 36(2) shifts the burden of proof: where a reporting person suffers a detriment after making a report and asserts that this is a consequence of the report, the detriment is presumed to be a reprisal. The employer then has to show that the detriment rested on sufficiently justified grounds, or that it did not rest on the report.
The fining provision in § 40 HinSchG covers, among other things, obstructing a report, reprisals, breach of the confidentiality requirement, and failure to establish and operate an internal reporting office. Depending on the breach, the range extends to fifty thousand euros or to twenty thousand euros.
A short checklist for a group entering Germany
- Establish the German entity's own regular employee number, and check § 12(3) separately if it sits in financial services.
- Decide who operates the intake, and record that entrusting them does not move the entity's own duties anywhere.
- Map the German deadlines onto the group process rather than the other way round.
- Make sure the channel takes reports in oral or in text form and can arrange a meeting on request.
- Settle the anonymity question deliberately, knowing that offering an anonymous route exceeds the minimum.
Where Rizzqo fits, and where it does not
Rizzqo contains no whistleblowing system. A reporting channel under the Hinweisgeberschutzgesetz needs a solution built for that purpose, and this entry explains the law rather than the scope of a product. What can be modelled in Rizzqo is the reporting channel as an object: where it is operated externally, the operator is a supporting asset with a category, a named owner and a link to the process it carries.
The same mechanics then apply as for any other provider. Requirements held for that category appear against the asset, and because particularly sensitive personal data passes through a reporting channel, the protection need of the process it carries feeds into the assessment.