Germany
HinSchG: Germany's Whistleblower Protection Act — Compliance Guide
How German organisations must implement internal reporting channels under the Hinweisgeberschutzgesetz, including works council involvement and statutory deadlines.
What is the Hinweisgeberschutzgesetz (HinSchG)?
The Hinweisgeberschutzgesetz (HinSchG) came into force on 2 July 2023, transposing Directive (EU) 2019/1937 into German law. It establishes comprehensive protection for whistleblowers and sets detailed requirements for internal reporting procedures.
The Federal Office of Justice (Bundesamt für Justiz) serves as the external reporting body for certain sectors and oversees compliance aspects.
Scope of application
- Private employers with generally more than 50 employees
- Public sector employers as defined in the Act
- Certain regulated sectors regardless of employee count
- Group companies must ensure subsidiary compliance
Key requirements under HinSchG
German law imposes specific procedural requirements that go beyond minimum EU standards in several areas:
- Establishment of secure internal reporting channels (written, oral or in-person)
- Acknowledgement within 7 days, feedback within 3 months
- Documentation in an electronic record register (Hinweisgeber-Register)
- Works council (Betriebsrat) co-determination rights in certain cases
- Prohibition of retaliation with reversal of burden of proof
- Data protection compliance under GDPR and BDSG
Why dedicated software is recommended
German regulators and legal practitioners increasingly expect structured, auditable systems rather than ad-hoc email processes. A dedicated platform provides IP stripping, metadata removal, deadline automation and exportable registers suitable for Betriebsprüfung or legal audits.
QReportly supports German-language reporting interfaces, GDPR-compliant EU hosting and HinSchG-aligned document templates.