Set up a complaint office: AGG, HinSchG and the obligations of the employer

Section 13 Paragraph 1 AGG obliges every employer to set up a complaints office for incidents of discrimination and to make their existence known in the company. The obligation applies regardless of the size of the company and has been in effect since August 18, 2006. The Whistleblower Protection Act, which implements EU Directive 2019/1937 and has been binding for companies with 50 or more employees since December 17, 2023, adds a second mandatory reporting point. Both offices pursue different protection goals and may be combined organizationally, but must legally operate clearly separately.

In practice, employers regularly confuse the two offices, operate them under a common email inbox without separating the processes or do not document the deadlines according to AGG or HinSchG. Both are vulnerable in the event of an audit and can lead to fines of up to 50,000 euros according to Section 40 HinSchG as well as claims for damages according to Section 15 AGG. This article shows how an audit-proof complaints office is set up in accordance with Section 13 AGG, how it differs from the HinSchG reporting office, which deadlines, responsibilities and training obligations apply, how the organisational separation is achieved cleanly despite a common platform and how CIVAC delivers both obligations as a compliance platform and officer-as-a-service with an SLA of two working days. The focus is on operational implementation in medium-sized businesses, not on repeating the legal text.

Section 13 Paragraph 1 AGG obliges every employer to set up a responsible body to which employees can turn if they feel disadvantaged due to a characteristic mentioned in Section 1 AGG. The characteristics are race or ethnic origin, gender, religion or belief, disability, age and sexual identity. The complaint must be examined in accordance with Section 13 Paragraph 2 AGG and the result must be communicated to the person making the complaint. Section 13 Paragraph 3 AGG protects the complaining person from reprimand unless they are obviously acting in an abusive manner in the matter.

The obligation applies regardless of the size of the company and also in small companies with fewer than ten employees, which are otherwise exempt from some labour law obligations. It includes the establishment of the office, its announcement in the company in accordance with Section 12 Paragraph 5 AGG, the acceptance of complaints, their confidential processing and written feedback to the person complaining. The complaints office must be a specific person or a clearly named function that employees can actually contact, not an anonymous collective address.

The consequences of a missing or inadequate complaints office are significant. In claims for damages according to Section 15 AGG, the employer's evidence situation deteriorates because the party to the lawsuit can rely on the lack of a remedy. The Federal Anti-Discrimination Agency regularly cites the lack of a complaints office as a key weakness in its annual reports. CIVAC orders the AGG Complaints Office with appointment certificate, reporting line and workspace within two working days, makes the audit export available at the push of a button and provides documented proof of training for each functional group. Others run compliance like a filing cabinet. We run it like software.

The Whistleblower Protection Act implements the EU Whistleblower Directive 2019/1937 into German law and has been binding for companies with 50 or more employees since December 17, 2023. Section 12 HinSchG requires the establishment of internal reporting points for violations of a wide range of regulations, including criminal law, fine law with the protection of life or health, EU sanctions, money laundering, data protection, food safety, product safety, traffic safety, environmental protection, consumer protection, privacy and IT security, public procurement and financial services.

According to Section 16 HinSchG, the HinSchG reporting point must provide several channels: written, oral, personal at the request of the informant. Anonymous reports must be processed as far as this is possible without undue effort. The confidentiality of identity must be strictly maintained; a violation is subject to a fine in accordance with Section 41 of the HinSchG. The confirmation of receipt must be issued within seven days, the follow-up notification of measures taken within three months of the confirmation of receipt.

The central difference to the Section 13 AGG Complaints Office lies in the area of ​​protection. The AGG office is limited to discrimination criteria, the HinSchG covers legal violations in the broadest sense. Discrimination can trigger both ways, for example in the case of sexual harassment as a violation of Section 3 Paragraph 4 AGG and at the same time as a violation of Sections 184 ff. StGB. The choice of channel rests with the person providing the information. The appointment certificate, signed, filed, verifiable. CIVAC offers both positions in the same workspace with separate case files, separate deadline calendars and a common audit export that maintains the separation of standards. Licence the workspace for your internal representatives, or have our representatives order it. Both paths provide the same legal robustness of processing against labour courts and supervisory authorities because the data lives in the same platform and the same audit export feeds it.

The separation between the AGG Complaint Office and the HinSchG Reporting Office is legal, not necessarily organisational. Both bodies can be operated by the same person or team, provided that case files are kept separately, deadlines per standard are correctly monitored and confidentiality rules are adhered to. A common technical platform with separate case files is the most efficient solution because it eliminates duplication of work in audit export, training and reporting to management.

The separation must be documented in the internal procedures. It regulates which receipt is classified as an AGG complaint, which as a HinSchG report and which as both, who carries out the classification, who monitors which deadlines and how the respective feedback is given to the reporting person. Triage logic has proven itself in practice: record receipt, check the protection area, document classification, start parallel processing, report joint lessons learned to management.

Personal independence is important. The person responsible for the complaints office and reporting office must not have a conflict of interest with the typical content of the complaint. The direct supervisor role, the HR management or the management itself are usually unsuitable because complaints can be made against these functions. An external order via CIVAC solves this problem structurally. The CIVAC workspace keeps every case file with a time stamp, status tracking, deadline monitor, documented responsibility and audit-proof versioning of every change. Confirmations of receipt are created automatically, follow-up messages are generated and released based on the documented status. The auditor calls, the evidence is ready. The FAQ page documents the demarcation rules between the duties with concrete case studies from practice and provides training material for those responsible for triage, so that the classification remains reproducible even when there is a change in personnel.

The deadlines for both positions are different and must be monitored separately. Section 13 Paragraph 2 AGG does not specify a specific timeline, but requires a timely review and feedback. Case law regularly interprets this as a period of two to four weeks, depending on the complexity and evidence. The HinSchG is more precise: seven days confirmation of receipt, three months follow-up notification. Deadline begins as soon as we become aware of it. According to § 40 HinSchG, missed HinSchG deadlines lead to fines of up to 50,000 euros, repeated violations lead to higher sanctions.

The documentation of each process is evidence and decides the evidence in the event of a dispute. § 22 AGG reverses the burden of proof for evidence of discrimination: As soon as the complaining party provides evidence, the employer must provide full proof that there was no discrimination or that there were permissible factual reasons. A clean complaint file with time-stamped receipts, documented hearings, feedback on results and follow-up measures is central to this evidence situation. Audit-proof, documented, § 13 AGG-proof.

The retention obligation for complaints results from § 11 HinSchG for HinSchG reports with a deadline of three years after completion of the procedure, for AGG processes from the general retention obligations under labour law and the need to defend against possible claims for damages until the statute of limitations according to § 15 Para. 4 AGG with two months from knowledge. The CIVAC workspace automatically manages both deadline calendars and triggers reminders before they expire. Processes are stored in an audit-proof manner with personal access, every read and write operation is logged, and the audit export provides the complete report in the format of the respective audit instance at the push of a button. This means that the employer is in a safe position to provide evidence both to the labour court in the AGG dispute and to the HinSchG supervisory authority.

Confidentiality is the foundation of every complaint office. Without it, the position fails in practice because employees do not dare to report incidents. Section 8 HinSchG requires that the confidentiality of the identity of the person providing the information, the persons affected by the report and other persons named in the report be maintained. Exceptions are strictly limited and only permitted with express consent or in cases of compelling criminal prosecution. According to Section 41 HinSchG, violations are subject to fines of up to 50,000 euros.

The GDPR applies in parallel. The processing of complaint and reporting data is based on Article 6 Paragraph 1 Letter c or Letter f GDPR, supplemented by Article 9 GDPR for special categories of people such as ethnic origin, religion or health. According to Art. 32 GDPR, data security must be protected by technical and organisational measures, which means a high level of protection is required for AGG and HinSchG processes due to their sensitivity. A data protection impact assessment in accordance with Art. 35 GDPR is regularly required.

Protection against reprisals is anchored in law. Section 36 HinSchG prohibits any discrimination against whistleblowers, Section 16 Paragraph 2 AGG prohibits disciplinary action because of a complaint. The burden of proof lies on the employer as soon as the person providing the information credibly demonstrates discrimination. Disciplinary measures range from transfers to poor reviews to dismissals and can trigger significant claims for damages. CIVAC documents every personnel action after receipt in a downstream audit trail with a time stamp, person responsible and written justification, so that the defence against the accusation of discipline can be carried out cleanly, quickly and with evidence. The technical separation of access rights ensures that only those authorised to edit have access. The appointment certificate, signed, filed, verifiable.

Simply setting up a complaints office is not enough. Section 12 Paragraph 2 AGG requires employees to be trained to avoid discrimination, Section 12 Paragraph 5 AGG requires that the complaints office be made known in the company in an appropriate manner. For the HinSchG, comparable obligations arise from Section 13 Paragraph 1 No. 5 HinSchG for clear and easily accessible information about the internal reporting procedures.

In practice, the announcement is made via several channels: written information in the employment contract and onboarding, visible notice in the company, permanent information on the intranet and in an easily findable area of ​​the company website, mention in regular employee communications and training courses. Confidentiality clauses that prevent employees from contacting the complaints office or reporting office are ineffective according to Section 36 HinSchG.

The content of the training must cover both mandatory areas. Mandatory topics include the characteristics of discrimination mentioned in Section 1 AGG, typical manifestations of harassment in the workplace, the reporting channels to the complaints office and the HinSchG office, the rights of the person reporting the information, protection against reprisals and the obligations of managers when dealing with reports. Repeat cycles of 24 months are standard practice. Others run compliance like a filing cabinet. We run it like software. CIVAC delivers ready-made training modules for AGG and HinSchG, documents proof of participation for each employee with a time stamp and triggers automated repeat reminders before the validity expires. The announcement texts are stored as templates and their publication on the intranet and website is recorded in the audit trail. This means that both the training and disclosure requirements of Section 12 AGG have been verifiably fulfilled. The effectiveness of the training is measured via knowledge queries, phishing equivalents and observed reporting culture, so that management can make a substantial statement about the company's culture in the quarterly report.

The choice between internal function and external appointment follows three criteria: independence, competence and confidentiality credibility. The internal function is possible, but often fails due to role conflicts. HR management is regularly biased because complaints against personnel decisions can affect them themselves. Management is rarely suitable because they can be the recipient of strategic complaints. The co-determination bodies such as the works council or representatives for the severely disabled are additional contact points, but do not replace the complaints office because they do not act on behalf of the employer.

The external appointment via an officer-as-a-service provider such as CIVAC solves the conflict problem structurally. The external person is not involved in day-to-day operations, has no personal relationships with superiors and can process complaints without regard to internal power structures. She also brings with her the methodological expertise from comparable mandates, which increases the quality of processing and the legal robustness of the decisions.

In medium-sized companies with 50 to 500 employees, external appointments are usually the most economical solution. An internal complaints office must be available in every situation, undergo regular training, maintain the principle of confidentiality and document reporting to management. Licence the workspace for your internal representatives, or have our representatives order it. CIVAC appoints the complaints office with an appointment certificate, reporting line to management, rules of procedure and workspace within the SLA of two working days. The appointed person brings experience from comparable mandates, trains the employees and takes over ongoing case processing with documented confidentiality. Group structures are mapped in the workspace via a group contract with company-specific evidence, which facilitates consolidated reporting to the parent company and eliminates duplication of work during audit export. The monthly flat rate replaces the hourly rate uncertainty of traditional consulting mandates.

Audit-proof documentation means that every process of a complaint office or HinSchG reporting office can be completely reconstructed at any time. This includes receipt with a time stamp, classification with justification, acknowledgment of receipt, hearings held, taking of evidence, assessment of results, feedback to the whistleblower and follow-up action taken. All steps must be stored in the system with a time stamp, responsible person and document versioning.

In the audit, auditors, supervisory authorities and major customers require the structured presentation of all processes in a reporting period in the supplier audit. They check for the completeness of the deadlines, the consistency of processing across processes, the existence of confirmations of receipt and follow-up notifications, and whether the position has been correctly announced within the company. Incomplete files or missed deadlines cannot be cured in the audit and lead to findings reports.

CIVAC structures every process in the workspace with separate case files per standard, automated confirmations of receipt, deadline monitor, resubmission logic and audit-proof versioning of every change. At the push of a button, the audit export provides a complete report on all processes for a selectable period of time in the format that the respective auditing body expects, be it the auditor according to IDW PS 980, the federal anti-discrimination agency or the HinSchG supervisory authority at the Federal Office of Justice. Audit-proof, documented, § 13 AGG-proof, § 12 HinSchG-proof. Versioning the case file ensures traceability even over years and even if the appointed person changes, without institutional knowledge being lost. The reporting structure to management is updated quarterly with aggregated key figures on transaction types, processing times, effectiveness of measures and trends over time. On request, a complete report on a single transaction is created without having to open the other files. The auditor calls, the evidence is ready.

CIVAC is a German compliance platform and officer-as-a-service with 25 live officer roles, 93 controls according to ISO/IEC 27001:2022, 490 ready-to-use audit templates and EU data residency for all stored data. Both the AGG Complaint Office and the HinSchG Reporting Office are operated via the workspace with an appointment certificate, reporting line to management, rules of procedure, documented reporting channels, training program and a complete calendar of deadlines. The SLA for standard inquiries is two working days instead of the classic two to six weeks of external consulting services.

Both positions are managed in the same platform with separate case files. Incoming processes are classified, routed to the responsible office and monitored according to the respective deadline. Confidentiality is technically secured through role-based access rights; every access is logged. Training records for each employee are kept with repetition logic. The audit export delivers the complete report for each standard in the format that the respective audit authority expects.

Licence the workspace for your internal representatives, or have our representatives order it. Both paths provide the same quality of evidence because the data lives in the same system and feeds the same audit export. Group structures are mapped into the workspace via a single group contract with company-specific evidence, which eliminates duplication of work and enables consolidated reports for the parent company.

Turn reading into a mandate. Employers with specific needs can reach the CIVAC Delivery team at info@civac.de or via the contact form on civac.de. The initial consultation clarifies the existing documentation, the number of employees, the industry and the migration path to the workspace. An indicative flat rate is determined within one working day, the appointment certificate within 48 hours of conclusion of the contract, the first training session within 30 days, and the first quarterly report within 90 days. This means that the obligation under Section 13 AGG and Section 12 HinSchG is not only formally fulfilled, but also operationally effectively established.