Germany's HinSchG, explained

Germany's own law, not just the Directive with a German label

The EU Whistleblowing Directive — Directive (EU) 2019/1937 — requires companies with 50 or more staff across the EU to give employees a protected, internal way to report wrongdoing; see the Directive, explained for the full baseline every member state builds on.

Germany transposed the Directive through the Hinweisgeberschutzgesetz (HinSchG) — the Whistleblower Protection Act — in force since 2 July 2023. It carries over the Directive's core mechanics unchanged: the same 50-employee threshold for who needs a channel at all (see the 50-employee threshold, explained), the same 7-day acknowledgement and 3-month feedback clock, the same broad list of prohibited retaliation. Where it earns its own guide is the handful of places it goes further than the Directive's floor, or settles something the Directive leaves to each member state to decide for itself.

The two-tier deadline — and a separate one for fines

HinSchG applied to entities with 250 or more employees from the moment it took effect, 2 July 2023. Smaller entities — 50 to 249 employees — got the same extended runway the Directive itself allows (Art. 26(2)), with the obligation to have a channel in place applying to them from 17 December 2023.

The fine provisions are a separate clock again. §40's penalties only became enforceable from 1 December 2023, regardless of company size — a deliberate grace period so a company crossing the July deadline wasn't immediately exposed to a fine for a gap it hadn't yet had time to close.

Where a violation actually costs you

§40 sets four separate maximum fines, not one figure that covers everything:

• Up to €50,000 — for obstructing a report or the follow-up communication with a reporter, or for retaliating (or attempting to) against someone who's made one.
• Up to €50,000 — for wilfully or recklessly breaching the duty to keep a reporter's identity confidential.
• Up to €20,000 — for simply not having a compliant internal reporting channel in place at all. This is the one most companies picture when they think "fine for non-compliance," but it's actually the smallest of the four.
• Up to €10,000 — for a merely negligent (not wilful) confidentiality breach.

For a company rather than an individual, these caps can go considerably higher: where a violation falls within the categories that reference § 30(2) of the Ordnungswidrigkeitengesetz (Germany's administrative-offences framework), the fine against the legal entity itself can run up to ten times the individual cap — up to €500,000 for the most serious violations. The headline number worth remembering isn't "€50,000 is the worst case" — it's that the ceiling for a company is meaningfully higher than the figure usually quoted.

Anonymous reporting: encouraged, not required

HinSchG doesn't require an internal channel to accept anonymous reports — §16 uses "sollte" (should), not "muss" (must): a channel should also process anonymous submissions, but there's no penalty for a channel that only takes identified ones. That's not a gap the Directive forces either way — Art. 6(2) of the Directive itself leaves the anonymity question to each member state, and Germany chose encouragement over mandate.

That makes anonymous reporting a genuine differentiator here, not just a compliance checkbox. Provoxis doesn't treat it as optional: anonymous reporting is always on for every reporter, with no setting to configure — see anonymous vs identified reporting, explained for how that works mechanically.

Can we just use an email address?

Yes, if it's set up properly. §16(2) requires internal channels to be built so that only the people responsible for receiving and handling reports, and the people helping them, can access incoming reports. Chamber of commerce (IHK) guidance lists an email address set up only for HinSchG reports as an acceptable way to take written reports. A general HR mailbox that IT administrators, archives and forwarding rules can also reach doesn't meet §16(2). See is an email inbox a compliant whistleblowing channel? for what an inbox needs to pass, and can you use Google Forms as a whistleblowing channel? for the form-based alternative.

Your works council has a say in how it's built, not whether

This isn't a purely German quirk — Article 8(1) of the Directive itself requires member states to ensure internal channels are established following consultation with social partners, where provided for by national law (see what a compliant channel actually requires for that baseline). Germany implements it through an existing mechanism rather than a new HinSchG-specific one: if your company has a Betriebsrat (works council), it likely has a real, enforceable role here — one that's easy to miss because HinSchG's own text doesn't mention it. German courts have confirmed that a works council's co-determination right under § 87(1) No. 1 of the Betriebsverfassungsgesetz (Works Constitution Act) extends to how an internal reporting channel is designed and operated — things like the reporting procedure, who handles cases, and whether it's run in-house or outsourced to an external provider. Whether a channel exists at all isn't up for negotiation — § 12 HinSchG already settles that — but the specifics of how it's built generally are. A German subsidiary standing up a channel without looping in its works council on the "how" is skipping a step that, if challenged, a labour court can actually unwind.

A slightly wider scope than the Directive's own text

§2 defines what HinSchG actually covers, and it reaches a little further than the Directive's own baseline in one specific way worth knowing: it treats a breach of a company's information or consultation duties towards its works council (Betriebsrat) as itself a reportable violation, not just something a works council happens to be told about separately. If your company has a works council, that's one more category of thing a report can legitimately be about.

Three external channels, not one

If an employee wants to escalate outside the company, where they go depends on what the report is about. The Bundesamt für Justiz (Federal Office of Justice) runs the general external channel for most subject matter. Two sector regulators run their own, separate channels for reports that fall inside their existing remit: BaFin for financial-supervision violations, and the Bundeskartellamt (Federal Cartel Office) for competition-law and Digital Markets Act violations. A report about the wrong subject sent to the wrong office doesn't fail — the offices coordinate — but knowing the split helps a reporter (or a handler advising one) get there faster.

Legal basis

• § 40 HinSchG — the fine provisions and their four separate maximum amounts.
• § 42 HinSchG — the transitional rule fixing 1 December 2023 as the date the fine provisions become enforceable.
• § 16 HinSchG — anonymous reports as encouraged ("sollte"), not required (§16(1)); access limited to the people responsible for reports and those supporting them (§16(2)); oral or written reports (either is enough, per the explanatory memorandum, BT-Drs. 20/3442, p. 81), and a meeting on request (§16(3)).
• IHK guidance on the HinSchG — lists an email address set up only for HinSchG reports as an acceptable written channel.
• § 12 HinSchG — the obligation to establish an internal reporting office, which sits outside the works council's co-determination right.
• § 87(1) No. 1, Betriebsverfassungsgesetz (BetrVG) — the works council's co-determination right over workplace conduct rules, extended by German case law to the design and operation of an internal reporting channel.
• Art. 8(1), Directive (EU) 2019/1937 — the EU-wide baseline requiring channels to be established following social-partner consultation, which Germany implements through the BetrVG rather than a new mechanism.
• § 2 HinSchG — the material scope, including breaches of works-council information and consultation duties.
• § 19 HinSchG and the Bundesamt für Justiz's own jurisdiction page — the split between the federal external office, BaFin, and the Bundeskartellamt.
• Art. 26(2), Directive (EU) 2019/1937 — the extended transposition deadline HinSchG's own 50–249-employee timeline follows.