Updated version – as of July 2026
In recent years, whistleblowers have repeatedly made headlines. The Wirecard scandal attracted particular attention and is one of the most prominent examples of whistleblowing. The public debate about how whistleblowers are treated has intensified, and the EU Whistleblower Directive (Directive (EU) 2019/1937), adopted in 2019, provided an important legal impetus for the protection of whistleblowers.
What is a “whistleblower” and how is the term defined more precisely under the EU Directive and the Whistleblower Protection Act?
What is a whistleblower?
Well-known whistleblowers include Julian Assange and Edward Snowden, but what exactly is a whistleblower? In German, a whistleblower may also be referred to as a “Hinweisgeber”.
A whistleblower is, at first instance, „only“ a natural person who reports information about misconduct within companies or public institutions. The information must have been obtained by the person in connection with their work activities. In terms of content, there is a broad scope – it can involve serious misconduct such as criminal offences or general dangers to employees or the entire company. However, it can also include less significant incidents, such as breaches of ethics or violations of internal policies.
This definition is deliberately based on the EU Whistleblower Directive, as it specifies who should be protected when reporting information through a whistleblowing system. The EU Directive provides the basis for national implementation in all EU Member States – in Germany through the Whistleblower Protection Act.
Anyone can be a whistleblower.
The natural persons protected by the EU Whistleblowing Directive and the HinSchG include all employees of a company: not only current full-time or part-time staff, but also trainees, former and future employees.
Employees therefore form the largest group of potential whistleblowers. Members of the management board or other persons in leading positions, as well as members of the supervisory board and shareholders, are also protected. Outside the company, customers, contractors and suppliers can also be whistleblowers.
In summary, the protection includes all groups of individuals who are connected with your company and can therefore gain information about misconduct.
What is the Whistleblower Directive?
In October 2019, the EU adopted its first Whistleblower Directive, which applies to almost all companies in the EU. The Whistleblower Directive had to be transposed into national law by the end of 2021. In Germany, this took place with considerable delay through the Whistleblower Protection Act, which entered into force on 2 July 2023.
In the EU, the protection of whistleblowers was not uniformly regulated for a long time. This led to unequal treatment and legal uncertainty. In order to enable fair competition and a well-functioning internal market within the EU, uniform standards are being introduced in all EU Member States with the implementation of the EU Whistleblower Directive.
Current situation in Germany
The implementation deadline for the EU Whistleblower Directive had already passed at the end of 2021. Germany transposed the directive around two and a half years late. The Whistleblower Protection Act (HinSchG) was passed by the Bundestag and Bundesrat on 12 May 2023 and has came into force on 2 July 2023.
Due to the delayed implementation, the European Court of Justice (ECJ) ordered Germany to pay a penalty of 34 million euros on March 6, 2025, in case C-149/23.
Which topics are covered by the EU Whistleblower Directive?
In all EU Member States, whistleblowers who report breaches of EU regulations must be protected.
The EU standard must not be undercut in national implementation; states may be stricter and add additional national areas of application.
Germany has availed itself of this option: the Whistleblower Protection Act (HinSchG) goes beyond the Directive and covers not only breaches of EU law but also numerous breaches of national law—specifically, violations subject to criminal penalties and certain administrative fines. In its judgment of December 4, 2025 (Case No. 2 AZR 51/25), the Federal Labour Court (BAG) confirmed that this extension of protection beyond the scope of the EU Directive is permissible.
How must companies in the EU deal with whistleblowers in the future?
Affected companies must implement the provisions of the Whistleblower Protection Act and meet the required standards. Unlike before, this is no longer mere preparation: the obligations are binding, and violations can be penalised by fines.
Is your company affected?
All employers with an average of at least 50 employees (§ 12 HinSchG) are generally required to establish an internal reporting office. The following deadlines apply:
- 250 or more employees: obligation in force since 2 July 2023.
50 to 249 employees: Obligation since 17 December 2023 (extended transitional period).
For certain sectors (e.g. credit, financial services and securities institutions), the obligation applies regardless of the number of employees.
Authorities, state and regional administrations, as well as municipalities with more than 10,000 inhabitants are also affected. For companies with fewer than 50 employees, there is no obligation to set up an internal reporting office.
Fines for infringements
Fines have been imposed since 1 December 2023 (Section 40 HinSchG). Anyone who fails to establish or operate an internal reporting office risks a fine of up to €20,000. Anyone who obstructs a report, takes retaliatory action or breaches the confidentiality requirement may face a fine of up to €50,000.
Expectations of companies
The requirements for reporting systems are set out in detail in the HinSchG. The most important points in brief: Companies must provide secure and confidential internal reporting channels that allow reports to be submitted both in writing and orally.
Our tips for installing a whistleblowing channel
Appoint at least two contacts who are perceived as neutral and trustworthy by employees so that responsibilities are clearly regulated in the event of an absence. In addition, appoint an external contact. If the internal persons responsible are unexpectedly unavailable, the functionality of the reporting channel can still be maintained.
There are many different Whistleblower reporting channels. Opt for those that automatically monitor deadlines for you.
Learn in 5 minutes
Before you book a live demo appointment with LegalTegrity, you can get to know our software in just 5 minutes. Request our demo video to get an overview of all the system's important features and customisation options. You will receive the demo video via email.
How should a whistleblower proceed?
Pursuant to the HinSchG, whistleblowers are free to decide whether to make a report via the Internal reporting channel from the employer or directly via a External reporting office (for example, at the Federal Office of Justice). There is no obligation to report internally first – however, the law is intended to make internal reporting attractive. Whistleblowers may generally only go public under stricter conditions, for example, if an external report was not responded to in a timely manner or if there is an immediate danger to the public interest.
Tip: Make your internal reporting channel as accessible and trustworthy as possible. This way, you can ensure that information reaches you first and you can take the necessary steps.
In what capacity must the protected whistleblowers be connected to the company?
Anyone who has obtained information about infringements in a professional context is considered a whistleblower worthy of protection.
Protection only exists if, at the time of reporting, a whistleblower had reasonable grounds to believe that the information reported was true and fell within the scope of the law.
Tip: As an entrepreneur, you should consider whether you could also open up your reporting channels to suppliers and business partners. This way, you ensure comprehensive protection for individuals connected to the company.
What about groups of people who are not protected?
The fear of misuse often arises instinctively. What happens if competitors want to boycott your company or other individuals wish to publish damaging information? These groups are not covered by the protection. Most importantly, there is no statistical evidence that the introduction of a whistleblowing system leads to an increase in false reports or creates a wave of denunciations within the company.
As a company, what measures may you take against whistleblowers?
If an employee goes directly to the authorities or to the public, disappointment is often great. The HinSchG has clearly provided for this: the catalogue of prohibited Retaliation is very comprehensive.
Whistleblowers must be protected from all direct and indirect reprisals. This also includes the protection of third parties who are in close contact with the whistleblower.
Attention – current case law: The Federal Labour Court ruled on 4 December 2025 (Ref. 2 AZR 51/25) that dismissal can also constitute a prohibited act of retaliation. There is no upstream protection in this regard – protection only applies from the point of an actual report or disclosure. Particularly relevant for employers: according to Section 36 (2) Sentence 2 of the HinSchG, the burden of proof is reversed regarding causality. It is sufficient if the whistleblower claims that the measure was a reaction to their report. The employer must then prove that the measure was not based on the report – for example, because they had no knowledge of it or the measure had already been decided upon for other reasons. Therefore, document personnel measures carefully.
Should anonymous reports be allowed?
The HinSchG does not oblige companies to technically design their reporting channels for anonymous reports. Section 16 (1) HinSchG merely formulates a „should“ provision: the internal reporting office should also process anonymously received reports. However, there is no obligation to provide anonymous reporting channels. In practice, however, enabling anonymous reporting is still recommended, as it lowers the threshold for whistleblowers.
Why it's worth using a whistleblowing system
Appoint external or internal trusted persons whom employees can also approach personally if they wish to submit information confidentially but not anonymously. In addition, establish a whistleblowing system that allows whistleblowers to remain anonymous. The system should be easily accessible and straightforward to use, regardless of the user’s level of education. Communicate positively about whistleblowing and its importance for the long-term success of your company.
Name external or internal trusted individuals who employees can also approach personally if they wish to give confidential, but not anonymous, information. Additionally, establish a Whistleblower system that allows Anonymity. These should be easily accessible and very straightforward to use, regardless of educational level. Speak positively about whistleblowing and its great importance for the long-term success of your company. Clearly and transparently explain internal reporting channels for all employees.
Would you like to learn more about the lean and efficient option of using a digital whistleblowing system to implement the Whistleblower Protection Act? Then contact one of our experts for a personal consultation and an appointment for a software demo.
(The masculine form used refers to all people, regardless of gender.)
