Whistleblowing: Fines of up to €20,000
4 min read
Employers with at least 50 employees as a rule must generally establish and operate an internal reporting office for reports of legal violations. Those that fail to comply face a fine of up to €20,000. The law provides for a higher maximum fine for obstructing a report or taking retaliatory action. The reporting office must also handle reports confidentially and meet statutory deadlines.
At a glance
- The obligation generally applies from 50 employees. It has applied to private employers with between 50 and 249 employees as a rule since 17 December 2023.
- A missing reporting channel can prove costly. Employers that fail to establish and operate a required internal reporting office face a fine of up to €20,000.
- Deadlines apply to handling reports. The internal reporting office must acknowledge receipt within seven days and generally provide feedback within three months of the acknowledgement.
Who must provide a reporting office
The Whistleblower Protection Act requires employers with at least 50 employees as a rule to establish and operate an internal reporting office. For certain employers, such as those in the financial sector, the obligation applies regardless of employee numbers. A company’s activities therefore also matter when determining whether the obligation applies.
For private employers with between 50 and 249 employees as a rule, the obligation began on 17 December 2023. The Act itself generally entered into force on 2 July 2023. It provides no general two-year grace period extending to spring 2026.
What is an internal reporting office? It receives reports of work-related violations and handles them in accordance with the Act. Its substantive scope covers criminal offences in particular and certain other legal violations. § 2 HinSchG sets out which reports fall within that scope.
Which fines the Act provides for
Failing to establish and operate an internal reporting office where required constitutes an administrative offence. § 40 HinSchG provides for a fine of up to €20,000. This is the statutory maximum and does not indicate the amount that will be imposed in a particular case.
Other violations can carry fines of up to €50,000. These include obstructing a report and taking retaliatory action. Where the fine is imposed on a company, Section 40(6) HinSchG refers to Section 30(2) sentence 3 OWiG for obstruction, retaliation and breaches of confidentiality. The maximum fine therefore increases tenfold to €500,000.
How the reporting office must operate
It must be possible to submit reports orally or in text form. If the reporting person requests it, a meeting in person must be arranged within a reasonable time. The identity of the reporting person and other persons protected by law must be treated confidentially in accordance with the HinSchG.
The internal reporting office must acknowledge receipt within seven days. It checks, among other things, whether the reported violation falls within the Act’s scope and whether the report is substantiated. Within three months of acknowledging receipt, it generally provides feedback on planned and completed follow-up measures and the reasons for them. The Act limits feedback where it would prejudice investigations or the rights of persons concerned. If receipt is not acknowledged, feedback must be provided no later than three months and seven days after receipt.
Companies can assign the duties of the internal reporting office to their own employees or to third parties. The persons responsible must be independent in carrying out their duties and have the necessary expertise. They may perform other duties provided these do not give rise to conflicts of interest.
What management should check
A first step is to check whether the obligation applies to the employer in question and whether the designated reporting channel is accessible. The company should then establish who receives reports, how confidentiality is maintained and who handles reports during absences.
The process should also include deadline monitoring: acknowledging receipt, checking the report, determining follow-up measures and providing feedback on time. Testing the reporting channel and documenting responsibilities can help identify gaps. The Act does not prescribe a general annual audit for this purpose.
Reporting persons can choose between internal and external reporting. External contacts include the Federal External Reporting Office at the Federal Office of Justice. Companies must also provide clear and easily accessible information about external reporting procedures.
Frequently asked questions
Can companies appoint an external party?
Yes. The HinSchG permits a third party to be entrusted with the duties of an internal reporting office. This does not affect the employer’s responsibility to take appropriate measures to remedy a violation.
Must the reporting office handle anonymous reports?
The Act provides that the internal reporting office should also handle reports received anonymously. The HinSchG does not require reporting channels to be designed to allow anonymous submissions.
What is the deadline for feedback?
The internal reporting office provides feedback within three months of acknowledging receipt. If no acknowledgement is given, feedback must be provided no later than three months and seven days after receipt. The content and scope of feedback are subject to statutory restrictions protecting investigations and the rights of persons concerned.
Read more on MyBusinessFuture
MyBusinessFutureDORA TLPT: Stress tests banks are currently failingMyBusinessFutureMicrosoft stack vulnerability in mid-sized businessesMyBusinessFutureSAP BPC: The SQL backdoor in quarterly accountsMore from the MBF Media Network
cloudmagazinCloudflare Containers: When Workers are too smallDigital ChiefsThe 40 per cent question: Where the AI budget really comes fromSecurityTodayNIS2 audit: Where the vendor list falls apart in two hoursImage source: AI-generated (November 2026)
Translated from the German original using artificial intelligence. The German version is authoritative.
