Skip to content

Legal requirements for the introduction of a whistleblower system

The Whistleblower Protection Act (HinSchG) is the German implementation of the EU Whistleblower Directive, which aims to establish standardized protection for whistleblowers throughout the EU for the first time. The law is expected to come into force next year and will then apply in principle to companies with at least 50 employees – various transition periods have been set for different company sizes.

ProduktionNRW has organized a virtual information event for the mechanical and plant engineering sector in North Rhine-Westphalia on September 20, 2022, on the legal requirements for setting up such a whistleblower system. In addition to the legal requirements for the design of an internal whistleblowing system, aspects of whistleblower protection under labor law and data protection law were also addressed in particular.

Basics of the Whistleblower Protection Act

Anette Binder, a lawyer from VDMA’s legal department, first addressed the EU Whistleblower Directive. The Directive (2019/1937) on the protection of persons who report infringements of Union law entered into force on October 23, 2019, and should be implemented in national law by December 17, 2021.

As Germany has not yet transposed the directive, infringement proceedings have been initiated accordingly. The legislative process is currently picking up speed again, as there is a current government draft dated July 27, 2022, and the legislative process was continued in October 2022 and is nearing completion.

The purpose of the Whistleblower Protection Act is to protect whistleblowers who, for example, have obtained information in connection with their professional activities about violations listed in the HinSchG on the part of the employer. This may include, for example, violations that are punishable by law (such as bribery or fraud) or violate fine laws (such as employee rights).

The options for reporting violations can be implemented through an internal (such as a person or organizational unit within the company) or external reporting point (such as ombudspersons like law firms or electronic solutions). All employees must have access to a reporting office. Reporting channels can be textual, verbal, or even a face-to-face meeting. If a company fails to implement this whistleblowing system within the specified deadlines, sanctions of up to 100,000 euros in fines are possible.

In terms of the relationship between internal and external reporting options, it is advisable to make the internal reporting channels as attractive as possible, as this allows grievances to be dealt with internally first and damage to the company’s reputation can possibly be prevented.

This primarily affects companies from the SME sector, as larger companies have already introduced such reporting options for other reasons for the most part. considerations

Labor and data protection law considerations

Dr. Christian Hess, lawyer in the VDMA legal department, then presented the labor and data protection aspects of the directive. So far, German law has only included regulations relating to whistleblowing. Although case law has protected whistleblowers for some time, there was no comprehensive regulation on this complex. The EU Whistleblower Directive is more comprehensive and sets the conditions for the protection of whistleblowers. In order to strengthen the protection of whistleblowers, there is a ban on reprisals, such as dismissal or failure to promote whistleblowers.

The Directive and the HinSchG have an impact on other areas of the company. For example, there are no specific provisions in the area of the works council’s rights to information, co-determination and participation. The works council may have co-determination rights in certain areas, such as in the design of a reporting system.

With regard to data protection, the documentation of personal data must be deleted two years after the conclusion of proceedings – although it is questionable when proceedings are concluded. Attention must also be paid to the confidential processing of data with regard to the identity and information of the whistleblower. Anonymous reporting must also be possible.

In conclusion, it can be said that small and medium-sized companies in the mechanical and plant engineering sector in particular would be well advised to consider introducing a whistleblowing system even before the HinSchG comes into force. After all, the HinSchG is one thing above all: an early warning system about possible malpractice in the company and an offer of protection for its own workforce.

Further information:


The event was offered by ProduktionNRW. ProduktionNRW is the competence network of mechanical engineering and production technology in North Rhine-Westphalia and is carried out by VDMA NRW. ProduktionNRW sees itself as a platform to connect, inform and market companies, institutions and networks among each other and along the value chain. Significant parts of the services provided by ProduktionNRW are funded by the European Regional Development Fund (ERDF).