Hinweisgeberschutzgesetz (HinSchG)

What is the Hinweisgeberschutzgesetz?

The Hinweisgeberschutzgesetz governs how reports of legal breaches in companies and public bodies are made, handled and protected. It transposes Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law into German law. It has been in force since 2 July 2023.

§ 1 HinSchG protects people who learn of breaches in a work-related context and report or disclose them. It also protects the people who are the subject of a report. Within a compliance management system, the internal reporting office is the channel through which such reports arrive.

Who must set up an internal reporting office?

Under § 12(2) HinSchG the duty applies to employers "with, as a rule, at least 50 employees each". What counts is the regular headcount, not the figure on a given date. Under § 3(9) HinSchG, employers are natural and legal persons as well as partnerships and other associations with legal capacity.

The sector therefore decides first and the headcount second. The steps from the applicability check to record-keeping are set out in the whistleblowing system checklist.

Which breaches are covered by the HinSchG?

The HinSchG applies only to reports about the breaches listed in § 2 HinSchG. The internal reporting office is therefore not a general complaints channel. The categories in § 2(1) include:

• breaches carrying a criminal penalty (no. 1);
• breaches carrying a regulatory fine, where the provision breached protects life, limb, health or the rights of employees and their representative bodies (no. 2);
• breaches in named areas of law, among them money laundering, product safety, environmental protection and data protection under Regulation (EU) 2016/679 (GDPR) (no. 3);
• breaches of public procurement law above the EU thresholds (no. 4) and of competition law (no. 8);
• breaches of Regulation (EU) 2024/1689, known as the AI Act (no. 10).

For information security the scope is narrow. § 2(1) no. 3(q) covers breaches of IT security rules only at essential and important entities of three types. These are cloud computing service providers (Annex 1 no. 6.1.4 of the BSI Act (BSIG)), as well as providers of online marketplaces and online search engines (Annex 2 nos. 6.1.1 and 6.1.2 BSIG). At other entities a security breach comes within the Act only through another category, for example as a criminal offence under no. 1.

Reporting channels: oral or text form, anonymity optional

Under § 16(3) HinSchG internal channels must accept reports "in oral or in text form". Oral means by telephone or another form of voice transmission. On request, the reporting person must be offered an in-person meeting within a reasonable time, and with their consent by video and audio link.

The channels must be open to employees and to agency workers placed with the employer (§ 16(1) sentence 1). The employer may open them to other people in work-related contact with it. Under § 16(2), only the people responsible for handling reports and those supporting them may access incoming reports.

On anonymity, § 16(1) says the internal reporting office "should" also process anonymous reports. It expressly imposes no duty to design the channels for anonymous reporting.

Six tasks and the deadlines under § 17 HinSchG

Under § 17(1) HinSchG the internal reporting office has six tasks:

1. acknowledge receipt of the report;
2. check whether the breach falls within the scope of § 2;
3. stay in contact with the reporting person;
4. check whether the report is well founded;
5. ask for further information where needed;
6. take appropriate follow-up action under § 18.

The feedback states the follow-up action planned and already taken, and the reasons for it. It must not affect internal enquiries or impair the rights of the people reported (§ 17(2) sentence 3). Both deadlines run from receipt or acknowledgement, not from the end of the review.

Outsourcing to a third party: the responsibility stays with the employer

Under § 14(1) HinSchG the tasks of the internal reporting office may be given to an employee, a team or a third party. A third party can be a law firm or an ombudsperson service, for example. Entrusting a third party does not release the employer from the duty to take appropriate measures itself to stop a breach.

Private employers with, as a rule, 50 to 249 employees may set up and run a shared office under § 14(2). What they share is the receipt of reports and the further procedural steps. The duty to stop the breach and to give feedback to the reporting person remains with each individual employer.

Internal or external report: the reporting person chooses

Under § 7(1) HinSchG, the reporting person chooses whether to report internally or externally. Under § 19 HinSchG, the federal external reporting office sits at the Federal Office of Justice.

Under § 7(3), employers should create incentives for internal reporting. They must provide clear and easily accessible information on the internal procedure. How the two routes differ is set out in the comparison of internal vs external reporting channels.

Prohibition of reprisals with a reversed burden of proof

Under § 3(6) HinSchG reprisals are acts or omissions in a work-related context that respond to a report. They cause, or can cause, the reporting person an unjustified disadvantage. § 36(1) HinSchG prohibits them, including threats and attempts.

§ 36(2) reverses the burden of proof. If a reporting person who has suffered a disadvantage claims it resulted from their report, a reprisal is presumed. Whoever imposed the disadvantage must then prove that it rested on sufficiently justified grounds or did not result from the report.

Which fines does § 40 HinSchG provide for?

§ 40(6) HinSchG sets three fine ranges. For fines against companies, § 40(6) sentence 2 refers to § 30(2) sentence 3 OWiG, the Administrative Offences Act, which multiplies the maximum by ten for the offences listed there.

For a missing internal reporting office, the tenfold increase does not apply.