Digital Reporting Channel under the Whistleblower Protection Act (HinSchG): Requirements, Software Selection and Operation

The Whistleblower Protection Act (HinSchG), in force since July 2023, requires companies with 50 or more employees under § 12 HinSchG to establish an internal reporting office with a confidential reporting channel. The EU Whistleblowing Directive (EU 2019/1937) provided the framework; the HinSchG (Whistleblower Protection Act) specifies deadlines, confidentiality protection, and the role of the appointed reporting office operator. A digital reporting channel is by far the most widely adopted implementation — it allows anonymous submissions, automated acknowledgements of receipt, and audit-proof documentation of the entire communication record.

This article describes the statutory minimum requirements for digital reporting channel software, explains typical selection criteria, identifies the risks of inadequate solutions, and shows how engaging an appointed external reporting office operator structurally reduces the residual liability of management.

§ 12(1) HinSchG obliges companies that regularly employ 50 or more persons to establish internal reporting offices. Companies with 50 to 249 employees may share a reporting channel jointly with other companies; from 250 employees upwards, the channel must be operated entirely independently. The obligation applies regardless of legal form — GmbHs, AGs, limited partnerships, civil law partnerships and bodies governed by public law are all equally covered.

Under § 16 HinSchG, the reporting channel must provide the following minimum functions: acknowledgement of receipt to the whistleblower within seven days; substantive feedback on measures taken or planned within three months of the acknowledgement; and the option to submit reports anonymously, even though confidentiality is not explicitly mandated by law. Anonymous reports must be capable of being received; whether they are followed up internally lies within the company's discretion.

In addition, the confidentiality requirement under § 8 HinSchG applies: the identity of the whistleblower may not be disclosed to third parties without their express consent. Software that does not technically support this requirement — for example through separate database fields, pseudonymisation, or encrypted communication channels — exposes the company to a significant risk of fines. Under § 40 HinSchG, violations can be penalised with fines of up to €20,000.

The role of the appointed reporting office encompasses not only the technical operation of the channel, but also the review of incoming reports, communication with the whistleblower, and documentation of all measures taken.

Not every whistleblowing software solution meets the requirements of the Whistleblower Protection Act (HinSchG). The following technical features are mandatory or strongly recommended for a legally compliant implementation:

• Anonymous communication: The channel must be able to accept submissions without requiring the reporter's real name and must enable bidirectional anonymous communication via a pseudonym or case number.
• Encryption: Communication content and stored reports must be encrypted — at minimum AES-256 at rest and TLS 1.3 in transit.
• Access log: Every access to a report must be logged; the system must be able to represent roles with tiered access rights.
• EU data residency: Since the HinSchG processes personal data, GDPR requirements apply. Storage of data outside the EU/EEA without standard contractual clauses is unlawful.
• Deadline management: The system should automatically alert to expiring 7-day and 90-day deadlines.
• Document export: A structured data export must be possible for internal audits and regulatory enquiries.

Software operated solely as an email alias or an unencrypted web form will typically not meet these requirements. Missing encryption or the absence of anonymous back-communication are recurring points of criticism in audits.

When selecting a digital reporting channel solution, a structured pre-assessment based on five practically relevant questions is recommended:

1. Is data processing GDPR-compliant? Ask about the server location, the data processing agreement (DPA) under Art. 28 GDPR, and existing ISO 27001:2022 certifications held by the provider.
2. Does the system support anonymous bidirectional communication? A pure input form without a response function does not satisfy § 16(3) HinSchG.
3. Is a roles and permissions concept in place? Only the designated persons may view reports; the assigned case handler must not be the subject of the report.
4. Is there automated deadline management? The 7-day and 90-day deadlines under § 16 HinSchG run automatically; manual calendar-based tracking is error-prone.
5. Can the solution be combined with an external reporting office operation? If no internal personnel are available for the reporting office function, the software must allow an external appointee to act as case handler.

Many standard solutions available on the market technically satisfy several of these points, but neglect organisational integration: the best software is of limited value if no qualified person is reviewing, assessing and forwarding incoming reports. This is precisely where the combination of reporting channel software and an appointed external operator comes in.

The HinSchG distinguishes between the technical reporting channel and the person or body operating it. Under § 15 HinSchG, the person entrusted with the tasks of the internal reporting office must be independent, free from conflicts of interest in relation to the matter reported, and sufficiently qualified to assess incoming reports. Typically, these are compliance officers, legal counsel, or specially trained HR managers.

In practice, however, many mid-sized companies do not have an internally available person with the necessary independence and expertise. An HR manager cannot simultaneously operate the reporting office for matters that concern their own department. A managing director is disqualified if they are themselves a potential subject of a report.

§ 14 HinSchG permits the appointment of a qualified external third party — such as a specialised compliance service provider — to operate the internal reporting office. This external operator must be contractually bound to confidentiality and must meet the requirements of § 15 HinSchG. The appointment does not relieve the company of its obligation to provide a functioning channel, but transfers operational responsibility for acknowledgements of receipt, fact-finding, and feedback to an independent body.

For management, this substantially reduces the liability risk under § 130 of the Administrative Offences Act (OWiG): documented evidence of a properly organised reporting structure is, in case of doubt, the decisive proof that no breach of supervisory duty has occurred.

The operation of a digital reporting channel constitutes a processing activity under Art. 4(2) GDPR and must be documented in the records of processing activities (RoPA) under Art. 30 GDPR. The legal basis is generally Art. 6(1)(c) GDPR (legal obligation under the HinSchG) or Art. 6(1)(f) GDPR (legitimate interest in clarifying the facts).

Particular care is required when processing special categories of personal data under Art. 9 GDPR: reports may concern health data, ethnic origin or political opinions, which trigger heightened protection requirements. Without a corresponding data protection impact assessment (DPIA) under Art. 35 GDPR, operating a reporting channel that captures such data is problematic under data protection law.

Whistleblowers, accused persons, and third parties have data subject rights under Arts. 15 to 21 GDPR; however, § 9 HinSchG provides a restriction on the right of access where the identity of the whistleblower or an ongoing investigation would be jeopardised. This restriction must be documented by the Data Protection Officer as part of their advisory role under Art. 39 GDPR and must be capable of being justified to data subjects.

If the reporting channel is operated by an external data processor, a DPA under Art. 28 GDPR is mandatory. For transfers to third countries, standard contractual clauses under Art. 46 GDPR are additionally required. EU data residency significantly simplifies the documentation requirements.

The HinSchG contains no standalone retention obligation for reporting data, and therefore the general data protection principles of storage limitation under Art. 5(1)(e) GDPR apply. In practice, a retention period of three years from the conclusion of the proceedings has become established, provided no criminal or employment law follow-on proceedings are ongoing that require longer retention.

Data relating to persons who were identified in the course of fact-finding as uninvolved or not accused must be deleted without delay — at the latest once the proceedings are concluded without measures being taken against those persons. This distinction places high demands on the data model of the software used: it must be able to manage personal data records at a granular level and enable selective deletion without impairing the remainder of the case documentation.

Retention periods for documents relevant under commercial law (§ 257 HGB, § 147 AO) are unaffected by this, but typically relate not to the reporting data itself, but to any accounting consequences of a clarified matter. A clear procedural instruction defining retention periods per case category is an integral component of a properly organised reporting office.

Digital reporting channel software should support an automated deletion concept with configurable deletion periods per case status. Manual deletion processes regularly lead, in practice, to oversights that are criticised in data protection reviews.

Recurring implementation errors can be observed in practice when establishing digital reporting channels, which make the company vulnerable both to regulatory authorities and to whistleblowers:

• No anonymous back-channel: A form without the option for anonymous return communication does not fully satisfy § 16(3) HinSchG. Whistleblowers who have remained anonymous cannot receive a response — trust in the system suffers.
• Missing acknowledgement of receipt: The 7-day deadline runs from receipt of the report. Without automated acknowledgement, a deadline breach quickly arises.
• Conflicted operator: The case handler responsible for a report is themselves part of the reported matter. A four-eyes review and clear escalation rules are imperative.
• No evidence of training for the operator: The person appointed to the reporting office must be sufficiently qualified under § 15 HinSchG. Without documented training, the evidence is missing.
• Missing DPIA: If a data protection impact assessment under Art. 35 GDPR is omitted despite a likely processing of special categories of data, a GDPR violation is at risk.

Deadlines run from the moment of knowledge — this applies to acknowledgements of receipt as much as to deletion obligations. Structured procedural instructions and software-based deadline management measurably reduce the error rate.

A digital reporting channel should not be operated as an isolated standalone solution, but as part of an integrated Compliance Management System (CMS) in accordance with IDW PS 980. Reports received through the channel are a key early-warning signal for systemic compliance risks; ideally, they feed into the regular risk analysis conducted by the Compliance Officer.

In practice, this means: the reporting office operator provides aggregated, anonymised case reports to management and the Compliance Officer. These reports show clusters by subject area, department, and case outcome. Without this feedback loop, the reporting channel remains a passive inbox rather than an active management tool.

For technical integration, standardised interfaces are recommended: an export to the document management system for closed cases, a notification link to the CMS dashboard for open deadlines, and a connection to the training module to train operators on a regular basis. CIVAC maps this linkage between reporting office operation, task management, documentation, and training in a unified workspace — all evidence in a single audit log, not scattered across separate systems.

Others manage compliance like a filing cabinet. CIVAC manages it like software. The difference becomes apparent at the latest when the auditor requests specific case documentation and evidence of deadlines met.

CIVAC offers two routes to meeting obligations under the Whistleblower Protection Act (HinSchG): licence the workspace for your internal appointees, or have our certified partners operate the reporting office as an external service. Both models share the same workspace, the same audit log, and the same documentation infrastructure.

The CIVAC workspace covers the following functions for whistleblower protection: structured case intake with automatic acknowledgement of receipt, anonymous back-communication channel, deadline management for the 7-day and 90-day obligations under § 16 HinSchG, role separation between intake handler and case officer, and an exportable case record for audit purposes. EU data residency and an ISO 27001:2022-compliant ISMS structurally eliminate residual data protection risks.

Those who cannot or do not wish to appoint an internally qualified reporting office operator can engage an external appointee through CIVAC. Letter of appointment — signed, filed, demonstrable — within two business days instead of the industry-standard two to six weeks. The external operator assumes responsibility for acknowledgements of receipt, fact-finding, deadline compliance, and reporting lines to management.

If you wish to meet the requirements of the HinSchG in a substantive rather than merely formal manner, please speak with us. Turn reading into a mandate: info@civac.de.