Legal framework

Whistleblower Protection Act (HinSchG)

The German Whistleblower Protection Act entered into force on 2 July 2023 and transposes EU Directive 2019/1937 into national law. It protects people who report legal violations in a professional context and creates mandatory reporting structures.

Personal scope

Protection covers not only employees but also civil servants, board members, interns, applicants as well as external contractors and subcontractors.

Material scope (§ 2 HinSchG)

Covered are in particular:

• Criminal offences and serious regulatory breaches
• Violations of data protection, environmental, tax and consumer protection law
• Money laundering and financial market violations
• Breach of constitutional loyalty by civil servants

The German HinSchG goes beyond the EU minimum and also covers violations of national law.

Obligation to set up an internal reporting body (§ 12 HinSchG)

Companies with usually at least 50 employees, the public sector and municipalities with more than 10,000 inhabitants must set up and operate an internal reporting body. For the financial sector, the obligation applies regardless of headcount.

External reporting bodies

The central external reporting body has been set up at the German Federal Office of Justice (BfJ). BaFin and the Federal Cartel Office serve as external bodies in their respective areas. There is no obligation to report internally first — the reporting person has free choice.

Procedure and deadlines (§ 17 HinSchG)

• Acknowledgement of receipt within 7 days
• Feedback on follow-up measures within 3 months
• Anonymous reports must be allowed and processed
• Telephone reports: audio recording only with consent, otherwise a content record

Confidentiality (§ 8 HinSchG)

The identity of the reporting person, the persons concerned and persons named in the report must be protected. Disclosure is only permitted in narrowly defined exceptional cases (§ 9 HinSchG).

Ban on reprisals (§ 36 HinSchG) and reversed burden of proof

Dismissals, warnings, transfers, non-promotions and other disadvantages in response to a report are prohibited. If a disadvantage occurs after a report, the employer must prove that it is unrelated to the report.

Fines (§ 40 HinSchG)

• No internal reporting body in place: up to €20,000
• Obstructing a report, breaching confidentiality, reprisals: up to €50,000

Trade secrets

If a report contains a trade secret, disclosure to a competent reporting body is permitted, provided that the reporting person had reasonable grounds to believe that disclosure was necessary. NDA clauses are overridden accordingly.

What is not covered

Private disputes, personal conflicts or purely subjective matters do not fall under the HinSchG. Knowingly false reports are not protected and may trigger damages and criminal consequences.