The German Whistleblower Protection Act, without the legalese.
Who is obliged, which deadlines apply and what a missing channel costs — on one page.
The act at a glance
- Act
- Whistleblower Protection Act (HinSchG)
- In force since
- 2 July 2023
- Mandatory from
- 50 employees
- Fine
- up to €20,000 · § 40
- Implements
- EU Directive 2019/1937
The obligation hangs on a single number.
From 50 employees onwards every company in Germany must run an internal reporting channel. In some sectors the duty applies regardless of size. Failing to meet it risks more than a fine — it costs you the chance to hear about wrongdoing first.
- Under 50
- No duty to run an internal reporting channel.
- From 50 employees
- An internal reporting channel is mandatory — without exception since 17 December 2023.
Regardless of size, the duty applies to
- Securities, fund management and insurance businesses
- Municipalities and municipal enterprises above the size set by the federal state
- Subsidiaries whose parent company exceeds the threshold
What the law requires of you, and when.
- Statutory deadline
- Event or state
- 0immediatelyA report arrivesThe whistleblower submits their report — in writing through the channel, or orally. Receipt must be documented. Their identity may be known only to the people responsible for handling the case.§ 16
- 7daysAcknowledge receiptWithin seven days of receipt the whistleblower must receive an acknowledgement. For an anonymous report this happens through the access code — which is why the return channel is not a convenience feature but the precondition for meeting the deadline at all.§ 17 (1)
- 90daysFeedback on follow-up actionNo later than three months after the acknowledgement the whistleblower must learn which follow-up measures are planned or already taken. Ongoing internal investigations may still be protected.§ 17 (2)
- 3yearsRetain the documentationDocumentation of a case must be deleted three years after the case closes. You may keep it longer only while that remains necessary and proportionate — for instance during ongoing litigation.§ 11 (5)
What a violation costs — tiered under § 40.
A missing reporting office is not the most expensive mistake. What costs more is how a company handles a report.
- €20,000§ 12 (1)
Concerns you firstFailing to establish and operate an internal reporting channel
What protects youA reporting channel that is live in 15 minutes — with a link and QR code for every site.
- €50,000§ 7, § 8, § 36
Obstructing a report, retaliating, or breaching the confidentiality of an identity
What protects youThe identity is never collected and every access is logged — the evidence exists before you need it.
- €10,000§ 40 (2)
Remaining violations of the act
What protects youEvery step is documented with a timestamp, and the retention clock runs on its own.
For legal entities the range can be raised beyond these amounts under § 30 (2) of the Act on Regulatory Offences.
Source: § 40 of the Whistleblower Protection Act, official text on gesetze-im-internet.de. As of August 2026. This overview is not legal advice.
Compliant in 15 minutes. Then never think about it again.
Set up your reporting channel now and try it free for 14 days — with real reports, no commitment.
No credit card · Cancel anytime · Hosted in Germany
Setup complete
- Create account2 min
- Configure reporting channel10 min
- Inform employees3 min