The most important points briefly:
- Whistleblower systems are confidential channels for reporting wrongdoing.
- Companies with 50 or more employees have been required to operate legally compliant internal reporting channels since December 2023. interne Meldestellen betreiben.
- There are various types of whistleblowing systems, but digital systems offer the most advantages.
- They promote transparency, protect against reputational damage, and strengthen the corporate culture.
- The EU Whistleblower Directive and the German Whistleblower Protection Act (HinSchG) make such systems mandatory.
- Digital systems offer high security and enable anonymous reports.
- A well-implemented system serves as an early warning system and strengthens trust within the company.
Whistleblower system explained simply
But what exactly is a whistleblowing system? In general terms, a whistleblowing system is a system used in companies and public administrations to provide their employees and third parties from the wider environment with a confidential communication channel. This channel can be used to report possible misconduct, criminal offences, and violations of an ethical corporate culture.
A whistleblower system as the core of your compliance
The topic Whistleblowing System and Compliance is still handled negligently in many companies. However, compliance, which in German means adherence to legal regulations, has been a requirement for some time at the latest The EU Whistleblower Directive and the HinSchG not just an option or even an „optional extra“ for companies, but a Duty.
Discover in 90 seconds how to protect your business with a whistleblowing system:
As well-known cases from the past have shown, whistleblowing can pose a risk to companies. If employees do not have an appropriate way to submit reports internally to a reporting office, reports may be submitted directly to the competent authorities or even disclosed to the public – leaving the company without a reasonable opportunity to respond. Establishing a structured infrastructure with a whistleblowing system provides a solid foundation for identifying violations at an early stage.
The protection of whistleblowers against reprisals is a central part of the debate. Whistleblowers, also known as reporting persons, are individuals who report violations of internal rules or external legal requirements. A whistleblowing system protects the identity of whistleblowers and ensures that violations are handled in a structured manner.
The EU Whistleblower Directive is an important impetus here, with which the EU has taken a big step towards whistle-blower protection. The German federal government only transposed the directive into German law in May 2023, which means around 1.5 years late. Whistleblower Protection Act came into force on 2 July 2023 and, in addition to whistleblower protection, repeatedly mentions whistleblower systems or whistleblowing systems.
Current note: For the delayed transposition, Germany was ordered to pay a penalty of 34 million Euros by the European Court of Justice (Case C-149/23) on 6 March 2025.
What whistleblower systems are available on the market?
There is a wide variety of whistleblower systems. The EU Whistleblower Directive and HinSchG do not provide specific guidance on technical implementation, i.e. what sort of system companies should use.
Different systems are offered on the market.
Ombudspersons
Here, an expert person is appointed, usually within the company or through an external lawyer, who as an Ombudsperson acts and takes on the task of receiving and processing reports. While this solution is in accordance with the law, however, it brings some disadvantages. The offer to submit reports is linked to a person's availability. Additionally, personal contact can also create a high barrier to entry, and the ombudsman's good availability is very costly. The combination of a digital tool with a compliance officer Ombudsman service is, however, a practical solution, especially for smaller businesses.
Letterbox
Setting up a physical reporting box for all company employees is quick and easy. Some may still know it as a suggestion box. However, this seemingly practical solution is not permitted under the Whistleblower Protection Act. Data protection and confidentiality can hardly be guaranteed because reports can only be processed manually. In addition, this solution does not allow anonymous whistleblowers to communicate with the person handling the report.
Telephone / Call Centre
When setting up a call centre, i.e. a telephone whistleblowing hotline, the following should be considered: the more sensitive the content of a report, the greater the reluctance to pick up the phone and describe the observations to another person. In addition, a language barrier between the whistleblower and the person handling the report can result in incidents being communicated incompletely or incorrectly. Furthermore, interference by IT administrators cannot be ruled out for this reporting channel either, which may limit the confidentiality of reports. A voicemail box is also not a legally compliant solution, as it cannot provide the required confirmation that the report has been received.
Email inbox
There is also little implementation effort involved in setting up an e-mail address exclusively for reporting incidents. However, the problem here is that the sensitive data not receiving the necessary protection experienced. With most email providers, the data is processed abroad, which means a higher risk. Furthermore, the data must be stored in compliance with GDPR for three years after the notification procedure has been completed. With an email inbox notification system, interference by internal IT administrators cannot be prevented. Additionally, with Breaches of confidentiality Companies face fines of up to €50,000.
Digital whistleblowing systems
Digital whistleblowing systems such as LegalTegrity's offer real-time chat and enable reports to be submitted regardless of time or location from any internet-enabled device. They are highly user-friendly and meet the highest data protection standards. Thanks to the chat function and data processing in secure data centres in Germany, LegalTegrity's whistleblowing system meets the requirements of the Whistleblower Protection Act. In addition, this reporting channel enables anonymous reports to be submitted and therefore even meets the recommended standard set by law.
All system types have different advantages and disadvantages, which a company must consider when selecting, taking into account its processes and priorities. Nevertheless, it can be stated that a digital whistleblowing system in the form of software is the most user-friendly and complies with all legal requirements.
Learn in 5 minutes
Before you book a live demo appointment with LegalTegrity, you can get to know our software in just 5 minutes. Request our demo video to get an overview of all the system's important features and customisation options. You will receive the demo video via email.
Companies benefit from whistleblower systems by:
The Whistleblower Directive 2019/1937 has now been implemented in Germany.
An overview of duties and deadlines:
- 250 or more employees: obligation in force since 2 July 2023.
50 to 249 employees: mandatory since 17 December 2023.
Authorities, offices and public institutions, as well as cities and municipalities with more than 10,000 inhabitants are also obliged.
Those who fail to establish or operate an internal reporting office risk a fine of up to €20,000 since December 1st, 2023; for hindering reports, retaliation or breaches of confidentiality, fines of up to €50,000 are threatened. Regardless of the specific number of employees, it is advisable for all affected companies to address the introduction of a whistleblowing system immediately.
Whistleblower system as a shield – An internal reporting system brings numerous benefits to any organisation and acts as an early-warning system for irregularities.
How does a digital whistleblower system work?
Digital whistleblowing systems are effective thanks to their standardised procedures, which offer a high level of protection for the whistleblower’s identity. It is important that the entire process of reporting and handling a report allows for anonymous communication, and that data is transmitted and stored securely in accordance with the GDPR.
The classic sequence of an incident can be simplified into five steps:
1. Whistleblowers observe legal violation
A collaborating individual witnesses an incident that breaches legal regulations. Even if the individual is unsure whether the misconduct If a report is required, one should not shy away from it. An examination by legal experts protects against errors.
2. Report via the digital whistleblower system
Through a whistleblowing system, a whistleblower can submit reports anonymously and confidentially from any internet-enabled device. A simple phone call is also possible. It is entirely up to the whistleblower whether they wish to leave their personal details or not. Additional information relevant to the report – such as images, documents, drawings, etc. – can be uploaded directly. It is important that the metadata is deleted.
3. Review of Notification & Communication
Upon receipt of a report, the system automatically informs the responsible employee or ombudsman. As a rule, digital whistleblower systems can be used for both oral and written reports. If the reporter and the person handling the case are logged into the system simultaneously, modern systems allow for real-time communication. This enables an anonymous dialogue and important follow-up questions. Legally required are: The reporter must be confirmed receipt of the report within seven days, and feedback on planned or implemented follow-up actions must be provided within three months.
4. Consequence of the report
Once the report has been processed and discussions have taken place with the legal expert, a decision will be made regarding any potential consequences. Clarification of the incident and the follow-up measures This can be done either internally or through legal action.
5. Follow-Up
Follow-up is also part of the whistleblowing scheme. After a certain period of time, a check is carried out to ascertain whether the matter has been resolved or whether any differences have been settled. The documentation of a report is in accordance with Section 11, paragraph 5 of the HinSchG to be deleted three years after the conclusion of the proceedings – so the period begins not with receipt of the notification, but with the conclusion of the proceedings.
Why should you opt for a digital whistleblowing system?
There are a number of reporting systems (analog and digital) with different advantages and disadvantages available on the market. From our perspective, however, one offers digital whistleblowing system, unlike, for example, mailboxes or emails, currently the safest and most efficient option.
Advantages of a digital whistleblowing system
allows anonymous reporting
enables confidential case processing
encrypts data securely
in our case, the data is with Deutsche Telekom Cloud
available at any time, in real time and from anywhere, provided internet access is available
allows examination by independent experts
guarantees your company legal certainty
Working with a service provider allows for quick clarification of questions.
Because a whistleblowing system in a company is only succesfull, when it is actually used. A digital system lowers the hurdle for the whistleblower to overcome making a report of an incident.
Whistleblowing System FAQs: Frequently Asked Questions
(The male form used refers to all persons, regardless of gender.)
