It rarely happens this quickly: After being passed by the Bundesrat in mid-May and promulgated on June 2, the German Whistleblower Protection Act (HinSChG) has now come into force on July 2, 2023. The law finally transposes the EU Whistleblower Directive into national law. Due to delays on the part of Germany, infringement proceedings have already been initiated against the Federal Republic in the past.

Background to the Act

The basis of the legislation, which is set as a standard throughout Europe, is the "protection of natural persons who have obtained information about violations in connection with their professional activities or in the run-up to professional activities and who report or disclose such information to the reporting bodies provided for under this Act." (HinSchG, Section 1 §1). Companies must handle whistleblower identity information in a GDPR-compliant manner and must protect the individual from any form of post-report hostility.

The HinSchG applies to both national and EU law if the reported anomalies are relevant offenses that are subject to criminal penalties or fines and must be investigated.

Changes for companies with 250 or more employees

By July 2, when the law came into force, companies with 250 or more employees were already required to introduce secure whistleblower systems within the company. This (digital) reporting office to be set up will be firmly integrated into the company's compliance management and must confirm to whistleblowers that a report has been received within a period of seven days. Within three months, the whistleblowers receive information from the reporting office about which measures have been used to process the reported information. This can be, for example, an internal or external investigation of the case or direct forwarding to the responsible supervisory authority.

Deadline extension for smaller companies

Companies with between 50 and 249 employees have until December 17, 2023 to integrate the relevant reporting systems into the company and to inform their employees about the new requirements. In addition, the same requirements apply to them as to companies with a higher number of employees.

Involving employees correctly

In order to provide employees with the important information on the tasks of the new legislation and the associated rights and obligations of the company, training courses and digital courses such as e-learning are a good method of making the same information available to many employees quickly and at a flexible time. Only when employees at all levels of the company know how to handle the changes correctly can the internal whistleblowing system be properly implemented and applied. This in turn creates acceptance and ensures trust among customers, partner companies and in public perception in general.