Setting Up an Internal Reporting Office for Whistleblowers

Anyone in Germany with at least 50 employees must operate an internal reporting office for reports of legal violations within the company, with a confidential reporting channel and fixed processing deadlines. For implementation, it is not enough to simply name an email address; the entire process from intake to feedback has to work.

In brief: under Sections 12 to 14 of Germany's Whistleblower Protection Act (Hinweisgeberschutzgesetz, HinSchG), companies with 50 or more employees must set up a confidential reporting channel through which employees and external persons can submit reports of legal violations. Incoming reports must be acknowledged within 7 days, and feedback to the whistleblower must follow within 3 months. Violations can be fined up to 50,000 euros.

Who Is Subject to the Reporting Office Requirement?

All companies with 50 or more employees are affected, regardless of legal form or industry. As soon as this threshold is reached, the obligation under Sections 12 to 14 HinSchG to operate an internal reporting office applies. Companies do not necessarily have to build a standalone structure: Sections 12 to 14 HinSchG expressly also permit group-wide or shared solutions. Several companies can therefore share a joint internal reporting office instead of maintaining separate resources for the reporting channel and case handling at each one. This is especially relevant for corporate groups with several entities that are just above the employee threshold, or for companies that want to pool resources rather than build a separate reporting office for every subsidiary. For those responsible within the company, this means: first clarify whether the employee threshold is reached, then decide whether a dedicated or a shared solution makes more sense. A tool such as Company Audit shows you exactly which of these obligations apply to your company.

What Do You Specifically Have to Do?

To meet the requirements of Sections 12 to 14 HinSchG, the following steps are essentially necessary:

1. Set up a confidential reporting channel (digital, by phone, or in person, with identity protection).
2. Designate a responsible office or person to handle incoming reports.
3. Define a process for acknowledging receipt within 7 days.
4. Define a review process with feedback to the whistleblower within 3 months.
5. Inform employees about the existence and use of the reporting office.

The reporting channel must be designed so that the whistleblower's identity remains protected, whether as a digital system, a phone line, or an in-person appointment with the designated office. In practice, digital reporting systems considerably ease compliance with the deadlines, since they automatically document the processing status of each report and remind the responsible office internally before a deadline expires. It is also important that the reporting channel does not just exist formally but is actively made known to employees, for example via the intranet, notices, or during the onboarding of new staff. Only then can the reporting office fulfill its purpose and actually be used if the need arises.

By When Do You Have to Respond to a Report?

Two fixed deadlines apply to handling incoming reports: receipt of a report must be acknowledged within 7 days, and the whistleblower receives feedback on the status or outcome of the review no later than after 3 months. Both deadlines should be firmly anchored in the reporting office's processing workflow, for example through automatic reminders in the reporting system, so they are not accidentally missed. If a report is ignored or allowed to drag on, the reporting office fails its statutory purpose, regardless of whether it formally exists. A clearly documented process with defined responsibilities, a deadline calendar, and a deputization rule helps reliably meet both deadlines even when the responsible person is on vacation or sick leave.

What Are the Consequences of a Violation?

Anyone who fails to meet the obligation to operate an internal reporting office, or who violates the requirements of the HinSchG, risks fines of up to 20,000 euros or up to 50,000 euros. The amount depends on the type and severity of the specific violation. For companies with 50 or more employees, it is therefore worth setting up the reporting office early and with documentation, including proof of internal communication to employees. Anyone who has already cleanly defined the reporting channel, responsibilities, and deadlines before a first report comes in reduces the risk of making mistakes under time pressure in an actual case and thereby violating the requirements of Sections 12 to 14 HinSchG.

Frequently Asked Questions

From What Company Size Does the Requirement Apply?

The obligation to operate an internal reporting office under Sections 12 to 14 HinSchG applies to companies with 50 or more employees, regardless of industry or legal form.

Can Several Companies Use a Shared Reporting Office?

Yes. Group-wide or shared solutions among several companies are permitted under Sections 12 to 14 HinSchG, so a joint internal reporting office can be operated for several entities.

Can External Persons Submit Reports Too?

Yes. The reporting channel must not be limited to employees; external persons such as customers or suppliers must also be able to submit reports of legal violations.

How Quickly Must the Reporting Office Respond to a Report?

Receipt of a report must be acknowledged within 7 days, and substantive feedback to the whistleblower must follow within 3 months.

What Happens in Case of Violations of the Reporting Obligation?

Violations of the obligations under Sections 12 to 14 HinSchG can be fined up to 20,000 euros or up to 50,000 euros.

Source: Sections 12 to 14 HinSchG. This article is general information and does not replace individual legal advice. As of July 2026.