Setting Up a Reporting Channel under the Whistleblower Protection Act (HinSchG): A Step-by-Step Guide to a Legally Compliant Reporting Office

The Whistleblower Protection Act (HinSchG), in force since 2 July 2023, requires companies that regularly employ at least 50 persons under § 12(1) HinSchG to establish an internal reporting office with a confidential reporting channel. The deadline for companies with 50 to 249 employees expired on 17 December 2023. Companies that are still not operating a functioning reporting channel are committing a regulatory offence under § 40 HinSchG and risk fines of up to €20,000.

This article describes, in nine steps, how a reporting channel under the HinSchG can be built, staffed, and operated in a permanently legally compliant manner. It is addressed to managing directors, compliance managers, and legal counsel who wish to implement the requirements belatedly or to review an existing solution for compliance.

§ 12(1) HinSchG ties the obligation to establish a reporting office to the number of employees. The decisive figure is the regular headcount, not the number on a specific reference date. All persons in an employment relationship within the meaning of the AGG are counted: permanent employees, part-time workers, trainees, and — according to prevailing legal opinion — also agency workers who are permanently deployed in the business.

Companies with 50 to 249 employees may under § 14(2) HinSchG operate a joint reporting office together with other companies. This does not, however, relieve them of the obligation to ensure that the joint body is in fact operational and that their own employees are informed of it. Group companies may under § 12(3) HinSchG establish a joint internal reporting office, provided the obligation to establish one is individually fulfilled for each group company.

Companies in the financial sector — such as credit institutions, investment firms or insurance undertakings — are subject to heightened requirements under § 12(3) sentence 3 HinSchG: they must establish their own internal reporting office regardless of their headcount.

Also consider whether your company acts as a data processor for third parties: the obligation to establish a reporting office remains unaffected in such cases, as it is linked to your own employment relationships and not to the nature of the activity.

§ 16(1) HinSchG requires the internal reporting office to be capable of receiving reports orally, in writing, or — at the employee's option — in the form of a personal meeting. This means that a digital form as the sole channel does not meet the requirements: at minimum, there must also be an oral reporting option — for example, a dedicated telephone number.

Three channel variants have become established in practice: a purely oral channel via a dedicated hotline; a purely written channel via a secure web form or an encrypted email address; and a combination of both. The third variant is most common, as it accommodates differing communication preferences among employees.

Digital channels are subject to heightened technical requirements: anonymity must be technically enabled, even if it is not legally mandated. Communications must be encrypted. A case-number system for anonymous return communication is required. Where no return communication channel exists, the complaint cannot be responded to under § 16(3) HinSchG.

For oral channels, a record-keeping requirement is recommended, subject to the whistleblower's consent under § 16(2) HinSchG: the conversation is recorded in text form, submitted to the whistleblower for review and correction, and treated as a report upon confirmation.

The technical channel alone does not satisfy the requirements of the HinSchG. § 15(1) HinSchG requires that the persons entrusted with the reporting office must be independent, free from conflicts of interest, and sufficiently qualified to assess incoming reports. These requirements are substantive and exclude typical internal assignments.

An HR manager is disqualified if reports may concern their own area of responsibility. A managing director is disqualified if they are themselves a potential subject of a report. A lawyer may be suitable, provided they are not simultaneously acting as a business adviser or M&A adviser to the company in a capacity that would give rise to a conflict of interest.

§ 14 HinSchG permits the appointment of an external third party as reporting office operator. The external operator thereby assumes the obligations of § 15 HinSchG in full. The appointment should be made in writing, clearly define the scope of duties, and contain provisions on confidentiality, reporting lines, and freedom from instruction.

The appointment of an external reporting office does not relieve the employer of the obligation to ensure that the external operator meets the statutory requirements. An annual review of the external operator's qualifications and independence is recommended.

A written procedural instruction is not a statutory requirement, but is a de facto necessity for a functioning and demonstrable reporting office organisation. It describes how incoming reports are handled from receipt through to closing notification, and who makes which decisions.

Minimum content of a procedural instruction for the internal reporting office:

• Responsible person and deputy arrangements
• Procedure for acknowledgement of receipt within seven days
• Review steps: plausibility check, fact-finding, legal subsumption
• Escalation rules: when is management involved? When are external lawyers engaged?
• Provisions for conflicted cases: who reviews when the operator is themselves affected?
• Feedback obligation: content and form of feedback under § 16(3) HinSchG
• Retention and deletion: deadlines by case category
• Reporting line: what aggregated information does management receive and when?

The procedural instruction should be reviewed annually and updated whenever organisational changes occur — change of operator, software migration, corporate merger. An outdated procedural instruction can be worse than none at all in an audit, as it indicates incorrect responsibilities.

The deadlines under § 16 HinSchG are tight and run automatically from receipt of the report. There is no possibility of extension and no exception for the operator's holiday or illness. Structured deadline management is therefore an operational necessity, not an optional improvement.

The three relevant deadlines at a glance:

1. 7 days: Acknowledgement of receipt under § 16(3) HinSchG. This can be automated by the system used, but must also be delivered via the anonymous return communication channel for anonymous reports.
2. 3 months from acknowledgement: Feedback on measures taken or planned under § 16(3) HinSchG. This is the deadline most frequently missed in practice, because fact-finding proceedings drag on.
3. No statutory deadline for case handling: The HinSchG prescribes no processing deadline; the feedback obligation replaces a substantive completion deadline.

For operational implementation, a bring-forward system is recommended that automatically reminds the operator of the acknowledgement of receipt at the latest on the third day after receipt, and signals a feedback deadline ten weeks after the acknowledgement. Software-based solutions are significantly superior to manual calendar tracking here. The deadline runs from the moment of knowledge — and ignorance affords no protection against fines.

Establishing the reporting office alone does not satisfy the requirements of the HinSchG. § 13 HinSchG obliges the employer to inform employees and persons who may come into contact with the company about the option to report to the internal reporting office and to external bodies. The information must be easily accessible and clearly understandable.

The following measures are recommended in practice: publication of the reporting office information on the intranet and on the website (where externally accessible); reference in the employment contract or works rules; annual reminder as part of compliance training; and a permanent notice in physical work environments.

The information must include at minimum: contact details of the internal reporting office; explanation of the procedure; reference to confidentiality protection and the prohibition on retaliation under § 36 HinSchG; and reference to external reporting bodies (Federal Network Agency, Federal Office of Justice, sector-specific authorities).

Employees who are unaware of the reporting office will not use it — and will instead go directly to external authorities or the public. A well-communicated internal reporting office is therefore also, from a business perspective, the first line of defence against uncontrolled external disclosures.

§ 15(1) HinSchG requires the reporting office operator to be sufficiently qualified. This includes a basic knowledge of the HinSchG, the EU Whistleblowing Directive framework (EU 2019/1937), and the relevant subject areas to which typical reports relate: employment law, data protection law, criminal and administrative offences law, and the sector-specific regulation of the company.

A one-off training session upon taking up the role is not sufficient. The requirements of the HinSchG and the case law on the GDPR are evolving; an annual refresher training is recommended. Evidence of training — date, content, duration, provider — must be documented and filed in the compliance management system.

For external operators, expertise is regularly evidenced by their professional qualifications (lawyers, compliance consultants). It is advisable to include an obligation to provide annual confirmation of continuing professional development in the appointment contract.

Training records form part of the documentation that must be produced in an audit. The Compliance Officer of the company should be involved in monitoring training obligations and should annually confirm the currency of the reporting office operator's qualifications.

A reporting channel operated in isolation is a passive inbox. A reporting channel integrated into a Compliance Management System (CMS) in accordance with IDW PS 980 is an active early-warning instrument. The requirements of an effective CMS demand that incoming reports are systematically evaluated and fed into the ongoing risk analysis.

In practice, this means: the reporting office operator produces quarterly or at least annual aggregated, anonymised reports for management and the Compliance Officer. This report contains case numbers by subject area, processing status and outcome. It identifies clusters and systemic risk areas without revealing the identity of whistleblowers or accused persons.

Management is obliged to take note of this report and to take action where needs for action are identified. Documenting this decision is part of the CMS and, in an audit, constitutes proof that no breach of supervisory duty under § 130 OWiG has occurred. Audit-ready, documented, § 130-compliant: that is the standard a functioning CMS must achieve.

CIVAC offers companies two routes to legally compliant fulfilment of HinSchG obligations: licence the workspace for your internal reporting office, or have our certified partners take over operation of the reporting channel as an external service. Both models share the same infrastructure and the same audit log.

The CIVAC workspace covers all eight implementation steps technically and organisationally: channel setup with anonymous return communication system, automated deadline management for the 7-day and 90-day obligations under § 16 HinSchG, procedural templates for intake, fact-finding and feedback, training module for the reporting office operator with certificate and evidence, role separation in the workspace, and an exportable case file for audit purposes. EU data residency and an ISO 27001:2022-compliant ISMS are integral components of the platform.

Those who cannot designate a suitable internal operator can appoint the external officer through CIVAC. Letter of appointment — signed, filed, demonstrable — within two business days. The external operator assumes responsibility for acknowledgements of receipt, fact-finding, deadline compliance, and quarterly reporting to management.

If you wish to set up the reporting channel now or have an existing solution reviewed for compliance, please speak with us. Turn reading into a mandate: info@civac.de.