An employee reports a suspicion of double billing through the intranet. The report lands in the management’s inbox, and the managing director shares the name within the leadership team to clear things up quickly. Three weeks later the name is known in the field service. The German Whistleblower Protection Act turns exactly this path into a regulatory offence: the identity of a reporting person belongs to the reporting office alone.
The Hinweisgeberschutzgesetz (HinSchG) has transposed EU Directive 2019/1937 into German law since 2 July 2023. It obliges employers to set up an internal reporting office and protects people who report breaches from reprisals. This page walks through the Act along the five questions on which a reporting office succeeds or fails in daily work: deadlines, confidentiality, access in an emergency, disclosure and deletion.
Who is affected?
Every employer with, as a rule, 50 or more employees needs an internal reporting office (Section 12 HinSchG). The count is per employer, not per group; a group company may however run the reporting office for other group companies as a commissioned third party (Section 14(1)). Private employers with 50 to 249 employees may set up a shared reporting office with others (Section 14(2)).
Employees, temporary agency workers and anyone who obtained information about breaches in a professional context may report: self-employed persons, employees of suppliers, applicants, former employees. Reportable are criminal offences, certain administrative offences and breaches of a long catalogue of legal areas (Section 2), from environmental protection through product safety to data protection.
Question 1: Which deadlines apply?
The reporting office acknowledges receipt within seven days at the latest and gives feedback within three months after that at the latest (Section 17 HinSchG). If receipt was not acknowledged, the feedback deadline ends three months and seven days after receipt. In between lie four duties without a deadline that still carry every report: checking the scope, keeping in contact, checking plausibility and taking appropriate follow-up measures.
The feedback names planned and taken follow-up measures with their reasons. It must not affect internal investigations or the rights of the persons reported or named (Section 17(2) sentence 3). The Act provides no extension of the deadline.
Outside Germany the deadlines of the respective transposition act apply. France and Greece count the acknowledgement in working days, Austria starts the feedback deadline with receipt, the Czech Republic and Hungary require feedback after 30 days.
Question 2: Who may know the identity?
The identity of the reporting person may become known only to the persons responsible for receiving reports or for follow-up measures, and to the persons supporting them in these tasks (Section 8(1) HinSchG). The rule also protects the persons who are the subject of a report and everyone else named in it. It applies even when the reporting office is not competent for the report at all (Section 8(2)).
In practice this means: management, HR and IT administration are not automatically part of the circle. Whoever sees a report needs a role in the reporting office. A shared mailbox several people can read, or a ticket system with an admin view on all tickets, breaches the rule as soon as someone outside the reporting office can look in.
The reporting office is independent in its work and must be free of conflicts of interest (Section 15(1)). On top comes the necessary competence, which the employer ensures (Section 15(2)). A person who is named in a report does not handle that report.
Question 3: What happens if the reporting office fails?
The Act does not regulate an emergency access. It requires the employer to run the internal reporting office (Section 12(1)) and to keep its deadlines. If the reporting office fails, two duties collide: the deadline of the report and the confidentiality rule. If the responsible person is in hospital and the deputy on holiday, the seven-day deadline still runs.
The clean answer is a deputy worthy of the name and, for the rare case that both fail, a regulated emergency access: a person from management is entered as responsible person of the reporting office for a limited time, with a documented reason, a waiting period during which the reporting office can object, and a log of every access. For that time they belong to the circle of Section 8.
Question 4: When may the identity be disclosed?
Disclosing the identity is the exception and needs one of the grounds of Section 9 HinSchG. The Act knows two ways:
- Duty to disclose (Section 9(2)): in criminal proceedings at the request of the prosecution authorities, by order in subsequent administrative proceedings, or by court decision. The reporting office informs the reporting person in advance and gives the reasons, unless the authority or court has said this would endanger the investigation.
- Disclosure with consent (Section 9(3)): when the disclosure is necessary for follow-up measures and the person has consented beforehand. The consent must exist separately and in text form for every single disclosure.
Whoever reports false information intentionally or with gross negligence loses the protection of their identity (Section 9(1)). The persons who are the subject of a report have exceptions of their own (Section 9(4)).
Question 5: When is data deleted?
The documentation of a report is deleted three years after the procedure is closed (Section 11(5) HinSchG). The reporting office may keep it longer only as far as this or another law requires and it is proportionate, for example while court proceedings are running.
Every report is documented in a durably retrievable way (Section 11(1)). For phone reports an audio recording or a verbatim protocol is permitted only with consent; otherwise the responsible person writes a content protocol (Section 11(2)). The reporting person gets the opportunity to check, correct and confirm the protocol (Section 11(4)); an audio recording used to prepare the protocol is deleted as soon as the protocol is finished.
After deletion a proof without personal data is useful: identifier, closure, period and time of deletion. It shows that the period was kept without preserving the content.
Mapping to ISO 27001
ISO/IEC 27002:2022 names the confidential reporting channel explicitly: under the control on management responsibilities it lists a confidential channel for reporting violations of information security policies and procedures (“whistleblowing”). If you run an ISMS, the internal reporting office under the HinSchG covers this point as well.
Directly relevant controls:
- A.5.4 Management responsibilities: confidential reporting channel as part of the management task.
- A.5.31 Legal, statutory, regulatory and contractual requirements: the HinSchG in the legal register.
- A.5.33 Protection of records: durably retrievable, unchangeable documentation with a deletion period.
- A.5.34 Privacy and protection of PII: processing of special categories in the reporting office, entry in the record of processing activities.
- A.6.8 Information security event reporting: the reporting route for security events and the whistleblowing channel complement each other.
Typical audit findings
- Reporting office without a deputy. A single designated person, no rule for holidays and sickness; the seven-day deadline depends on one person.
- Mailbox with too many readers. The reporting address is a shared mailbox the IT administration can read as well.
- Feedback missing or revealing too much. No feedback after three months, or feedback that names the persons interviewed.
- Disclosure without proof. The name went to HR, there is no consent in text form.
- No deletion. Reports from 2023 still sit unchanged in the mailbox, nobody knows when they were closed.
How Cenedril implements the five questions
The user manual describes the operation in detail: Set up the reporting office, Receive and review a report, Access and emergency access, Follow-up measures and feedback and Retention and deletion.
Sources
- HinSchG full text (gesetze-im-internet.de): official version
- Directive (EU) 2019/1937: European basis of the HinSchG
- Federal External Reporting Office (Federal Office of Justice): external reporting office