German Whistleblower Protection Act: who to train, and how

The Whistleblower Protection Act (Hinweisgeberschutzgesetz, HinSchG) protects people who obtain information about violations in a work-related context and report or disclose it. It transposes Directive (EU) 2019/1937 and entered into force on 2 July 2023. Its material scope in section 2 is broad: from criminal offences and certain administrative offences to breaches of numerous rules, for example on money laundering, product safety, environmental protection, data protection and competition.

Whistleblowers may choose between the employer's internal reporting office and an external reporting office (section 7(1)). Employers should create incentives to report internally first where effective internal action against the violation is possible (section 7(3)). That only works if staff trust the internal office — and for that they must know it.

Section 12 requires employers with, as a rule, at least 50 employees to establish and operate an internal reporting office. For private employers with 50 to 249 employees the duty applied only from 17 December 2023; under section 14(2) they may operate a joint office with others. The office may also be run by a third party (section 14(1)); responsibility for remedying violations stays with the employer.

Procedure is governed by sections 16 and 17: reports must be possible orally or in text form, receipt must be confirmed within seven days at the latest, and within three months of that confirmation the whistleblower receives feedback on planned or taken follow-up action. The whistleblower's identity must be kept confidential under section 8. The internal office must also provide clear and easily accessible information on external reporting procedures (section 13(2)).

The Act's only express qualification requirement concerns the reporting office itself. Under section 15(1) the people assigned to it are independent in their work; they may hold other duties as long as no conflicts of interest arise. Under section 15(2) employers must ensure that these people have the necessary expertise.

The Act does not define that expertise in detail. But the office's tasks show what it must be able to do: receive and document reports, assess their substance, ensure confidentiality, initiate follow-up and communicate with the whistleblower.

The Act imposes no training duty for the workforce as a whole. Even so, the system's success depends on staff knowing the reporting channels and knowing they are protected. A short briefing on joining and a recurring unit are often enough: what can I report, where, through which channel, what happens next, and what rights do I have?

Managers need more. Under section 36, retaliation against whistleblowers is prohibited, including threats and attempts. If a whistleblower suffers a detriment in connection with their work after a report, it is presumed to be retaliation; the person responsible must prove otherwise. Managers must therefore know how to respond when a report concerns them or when a team member has reported.

Section 40 lists administrative offences, including obstructing reports, taking retaliatory measures, breaching confidentiality and failing to set up an internal reporting office. The amounts of possible fines are set out in section 40(6).

For evidence it is advisable to record the reporting office's training with content and date and to document how staff were informed. Training materials must not contain real cases with identifiable people.

This article explains the law in general terms and is not legal advice. For any individual case, the official text in its current version prevails; if in doubt, consult a lawyer, your data protection officer or the competent supervisory authority.