Blog / What is a whistleblower system?

Compliance Management

What is a whistleblower system?

Dr. Thomas Altenbach

last updated on 01.07.2025

The most important points briefly:

Whistleblower systems are confidential channels for reporting wrongdoing.
Companies with 50+ employees must implement compliant systems since December 2023.
There are various types of whistleblowing systems, but digital systems offer the most advantages.
They promote transparency, protect against reputational damage, and strengthen the corporate culture.
The EU Whistleblower Directive and the German Whistleblower Protection Act (HinSchG) make such systems mandatory.
Digital systems offer the highest levels of security and anonymity.
A well-implemented system serves as an early warning system and strengthens trust within the company.

Whistleblower system explained simply

The EU Whistleblower Protection Directive decision presents new challenges for medium-sized businesses in the future: the deadline for implementing a whistleblower system for companies with 250 or more employees ended at the beginning of July 2023. Since 17 December 2023, according to the new German Whistleblower Protection Act even small companies (< 250 employees) can get involved. But what is a Whistleblower system At all?

Speaking generally, a whistleblowing system is a system used in companies and administrations to provide a confidential communication channel for their employees and external parties. This channel can be used by them to Reporting of possible misconduct, offences and violations against an ethical corporate cultureSchemmel et al.: Whistleblowing Systems, C.F. Müller, Heidelberg 2012).

A whistleblower system as the core of your compliance

The topic Whistleblowing System and Compliance is still managed carelessly in many companies. However, compliance, meaning adherence to legal regulations, has become extremely important, at the latest since the new EU Whistleblower Directive not just an option, or even a „bonus“, for companies today, but a Duty.

Discover in 90 seconds how to protect your business with a whistleblowing system:

These well-known scandals have spurred discussions on whistleblower protection:

As known cases from the past show, Whistleblowing: A Danger to Companies represent. If employees do not have a suitable way to submit tips internally to a reporting office, reports will be forwarded directly to the responsible Authorities or even the Public worn – this way the company has no adequate chance to react. The creation of a regulated infrastructure with a whistleblowing system forms a sound basis for detecting infringements early on.

The Protection of so-called whistleblowers retaliation is a central component of the discourse. Ein Whistleblower ist eine Person, die illegale oder unethische Aktivitäten in einer Organisation aufdeckt. Whistleblowers, or those who report information, are employees who report internal and external legal violations. Whistleblower system protects identity the whistleblower and creates a structured approach with violations.

The so-called EU Whistleblower Directive is an important impetus here, with which the EU has taken a big step towards whistleblower protection. The German federal government only transposed the directive into German law in May 2023, which means with a 1.5-year delay. Whistleblower Protection Act mentions not only whistleblower protection but also whistleblower systems or whistleblowing systems repeatedly.

What whistleblower systems are available on the market?

There is a wide variety of whistleblower systems. EU Whistleblower Directive there are no specific instructions for the technical implementation of the directive, meaning what kind of system companies should use.

Different systems are offered on the market.

All system types have different advantages and disadvantages, which a company must weigh up taking into account its processes and priorities when making a selection.

Ombudspersons

Here, an expert person is appointed, usually within the company or through an external lawyer, who acts as Ombudsperson acts and takes on the task of receiving and processing reports. While this solution is in accordance with the law, however, it brings some disadvantages. The offer to submit reports is linked to a person's availability. Additionally, personal contact can also create a high barrier to entry, and the ombudsman's good availability is very costly. The combination of a digital tool with a compliance officer Ombudsman service is, however, a practical solution, especially for smaller businesses.

Letterbox

Setting up a suggestion box for all company employees is quickly done. Some might still know it as a grievance box. However, the supposedly practical suggestion box solution is Not permitted in accordance with the Whistleblower Protection Act. Data Protection and Confidentiality difficult to guarantee, as processing the report is only possible manually. Furthermore, this solution does not allow for any dialogue between the anonymous informant and the person processing the report.

Telephone / Call Centre

When setting up a call centre, i.e. a telephone whistleblowing hotline, the following should be considered: the more critical the content of a report, the higher the Reluctance to pick up the phone and describing the observations to a real person. Additionally, one can Language barrier can lead to incomplete or even incorrect forwarding of incidents between the whistleblower and the case handler. Furthermore, intervention by IT administrators cannot be ruled out with this reporting office either, which is accompanied by limited confidentiality of the reports. A mailbox is also not a lawful solution, as this cannot confirm receipt of the message as required.

Email inbox

There is also little implementation effort involved in setting up an e-mail address exclusively for reporting incidents. However, the problem here is that the sensitive data not receiving the necessary protection experienced. With most email providers, the data is processed abroad, which means a higher risk. Furthermore, the data must be stored in compliance with GDPR for three years after the notification procedure has been completed. With an email inbox notification system, interference by internal IT administrators cannot be prevented. Additionally, with Breaches of confidentiality Companies face fines of up to €50,000.

Digital whistleblowing systems

Digital whistleblowing systems, such as LegalTegrity's, have a Real-time chat and provide the opportunity to report tips – Independent of time and place with every internet-enabled device. They impress with high user-friendliness and comply with the highest Data protection standards. Thanks to the chat function and data processing via secure server centres in Germany, LegalTegrity's whistleblowing system complies with the requirements of the Whistleblower Protection Act. In addition, this reporting office allows anonymous reports to be submitted, thus exceeding even the Legal condition justice.

All system types have different advantages and disadvantages, which a company must consider when selecting, taking into account its processes and priorities. Nevertheless, it can be stated that a digital whistleblowing system in the form of software is the most user-friendly and complies with all legal requirements.

Whistleblower Software from LegalTegrity
Learn in 5 minutes

Before you book a live demo appointment with LegalTegrity, you can get to know our software in just 5 minutes. Request our demo video to get an overview of all the system's important features and customisation options. You will receive the demo video via email.

Companies benefit from whistleblower systems by:

The Whistleblower Directive 2019/1937 The EU Whistleblower Directive has now been implemented in Germany. By the deadline of 17 December 2023, all companies with more than 50 employees must offer a whistleblowing system to their employees and business partners. Companies with more than 250 employees were required to take action by 02 July 2023. Authorities, offices and public institutions, such as cities and municipalities with more than 10,000 inhabitants, are also obliged to introduce a whistleblower system.

Regardless of the specific number of employees, however, all affected companies are advised to address the introduction of a whistleblower system as a matter of urgency.

Whistleblower system as a shield – an internal reporting system pays off in a variety of ways for any organisation. These are the Advantages of internal whistleblowing systems for your company:

With a system that complies with the law, you fulfil the legal requirements.
You protect your employees and your company from penalties, sanctions, and damage to your reputation.
Your company will automatically receive an early warning system.
You promote the values of integrity and transparency internally, thereby strengthening your image with business customers, partners, banks, investors and employees.
Your company actively works to foster an open business culture.

How does a digital whistleblower system work?

Digital whistleblowing systems are convincing due to their standardised procedure with a high level of protection for the whistleblower's identity. It is important that an anonymous exchange is always possible throughout the entire process of reporting and processing a notification, and that data is securely transmitted and stored in accordance with GDPR data protection standards.

The classic sequence of an incident can be simplified into five steps:

1. Whistleblowers observe legal violation
A collaborating individual witnesses an incident that breaches legal regulations. Even if the individual is unsure whether the misconduct If a report is required, one should not shy away from it. An examination by legal experts protects against errors.

2. Report via the digital whistleblower system
Through a whistleblowing system, a whistleblower can submit reports anonymously and confidentially from any internet-enabled device. A simple phone call is also possible. It is entirely up to the whistleblower whether they wish to leave their personal details or not. Additional information relevant to the report – such as images, documents, drawings, etc. – can be uploaded directly. It is important that the metadata is deleted.

3. Review of Notification & Communication
Upon receipt of a report, the system automatically notifies the responsible employee or ombudsperson. As a rule, digital whistleblowing systems can be used for both oral and written reports. It is important that the system converts voice messages or oral answers to the questionnaire into text. If the reporter and the responsible employee are in the system simultaneously, modern systems allow for real-time communication with the reporter. This gives the person responsible on the company's side the opportunity to enter into an anonymous dialogue with the whistleblower and ask important follow-up questions regarding the report.

4. Consequence of the report
Following the processing of the report and communication with the legal expert, a decision will be made regarding any potential consequences. The clarification of the event and the follow-up measures This can be done either internally or through legal action.

5. Follow-Up
Follow-up is also part of the whistleblowing system. After a period of time, it is checked whether the matter could be clarified or whether differences have been resolved.

Why should you opt for a digital whistleblowing system?

There are a number of reporting systems (analog and digital) with different advantages and disadvantages available on the market. From our perspective, however, one offers digital whistleblowing system, unlike, for example, mailboxes or emails, currently the safest and most efficient option.

Advantages of a digital whistleblowing system

allows anonymous reporting
enables confidential case processing
encrypts data securely
In our case, the data is securely located in the Deutsche Telekom Cloud.
available at any time, in real time and from anywhere, provided internet access is available
allows examination by independent experts
guarantees your company legal certainty
Working with a service provider allows for a quick resolution of queries.

Because a whistleblowing system can only be successful in a company if it is actually used. A digital system lowers the hurdles for the whistleblower to overcome before reporting an incident.

Whistleblowing System FAQs: Frequently Asked Questions

Wer braucht ein Hinweisgebersystem?

In Germany, it is Whistleblower Protection Act The German Transparency and Reporting Act (HinSchG) came into force, which from December 2023 obliges all companies with more than 50 employees to, Internal reporting channels to establish whistleblowing systems and to provide legal protection against retaliation for whistleblowers.

However, the EU Whistleblower Directive has not yet been transposed into national law in all EU countries and is therefore not yet legally mandatory for all companies. Why should your company still implement a whistleblowing system?

Seize the opportunity to set an example. Proactively introducing a digital, anonymous whistleblowing system will positively impact your company culture. By saying “yes” to a whistleblowing system, you as company management demonstrate transparency and openness. This promotes the entrepreneurial responsibility of your employees. You foster trust and loyalty within your company. At the same time, you create an internal early warning system for misconduct, which protects your company from scandals.

How many notifications are to be expected?

According to one study, a company with 1,000 employees can expect approximately 13 leads per year.Stubben & Welch, 2020).

These findings are also confirmed by LegalTegrity CEO Dr. Thomas Altenbach: „Based on my years of experience, including at Deutsche Bank and Daimler, with good communication of the whistleblowing system, one can expect around 10 reports per 1,000 employees per year.“

What capacities need to be planned for implementation?

With LegalTegrity, we have developed a whistleblowing system precisely tailored to the needs of medium-sized businesses. This includes that our digital whistleblowing system can be used immediately after booking, without complex IT implementation. The whistleblowing system can be used without training as it is self-explanatory. All that is needed is an internet connection – the system is accessible from any device. The data is securely hosted in the Deutsche Telekom Cloud.

Doesn't an anonymous system encourage abuse or complaining?

There is no scientific or statistical evidence that anonymity is being wrongly used to deliberately slander colleagues. By means of Whistleblowing Systems In your company, you can counter destructive critics through proactive and demonstrable communication. Such requirements can be communicated in the employment contract itself.

Doesn't a whistleblower system promote a surveillance culture within the company?

With a whistleblowing system, you proactively promote values such as enlightenment, trust and transparency within your company. These are precisely the values that protect your employees – both ethically and economically. Gone are the days when whistleblowing was perceived only negatively, because ultimately it protects your long-term business success.

Would you like to find out more? Then feel free to download our guide „Your Guide to Implementing the Whistleblower Protection Act in Your Company”. You are, of course, also welcome to contact one of our experts for a personal consultation.

Why is it not sufficient to set up a whistleblowing system in the form of an email inbox?

A whistleblowing system that operates solely as an email inbox is generally insufficient for the following reasons:

Lack of anonymity E-mails do not guarantee anonymity, which could make employees hesitant to give tips. As Dr. Thomas Altenbach says: “The e-mail is the postcard of the 21st century. It can be read many times even before it reaches the recipient.”
Secured access According to the Whistleblower Protection Act, only authorised persons may have access to reports, which is difficult to implement with email inboxes.
Data protection risks: Email providers often store data abroad, which carries higher data protection risks. The fines in the context of a GDPR violation are high! Furthermore, usually more people have access to email mailboxes.
GDPR Compliance: Reports must be stored in compliance with GDPR for three years, which is rarely guaranteed with email inboxes.
Inefficient case processing: Email inboxes complicate systematic, comprehensive documentation and case processing, leading to errors and a lack of transparency.

Does the works council have to be involved in the selection of a whistleblower system?

Yes, if you have a works council, the introduction of reporting channels under the Whistleblower Protection Act (HinSchG) is subject to mandatory approval. A works agreement must be concluded. As a customer of LegalTegrity, you will receive a template for the works agreement and support in dialogue with your works council free of charge.

For detailed information, you can Webinar recording on the role of the works council in whistleblowing systems look at.

(The male form used refers to all persons, regardless of gender.)

About the author

Dr. Thomas Altenbach

LegalTegrity CEO and founder Dr. Thomas Altenbach is a compliance expert with a passion for integrity and innovation. As a lawyer in the top management of international corporations and as a consultant for medium-sized companies, he became one of the most sought-after compliance specialists and a member of a UN expert group on corruption prevention. His interest in digitalisation in connection with compliance and the Mittelstand led to the founding of the Legal Tech company LegalTegrity.