Everything You Need to Know About the Whistleblower Protection Act

1. What is the Whistleblower Protection Act (HinSchG)?
2. Why is the HinSchG important?
3. What you as an entrepreneur need to bear in mind
4. How to properly handle an internal report
5. Benefits of the Whistleblower Protection Act for your business
6. Implementing the Whistleblower Protection Act: 5 whistleblower softwares

Probably everyone of us knows this situation: Observing malpractice or even illegal activities in the company and facing the difficult decision of whether to keep silent or speak up. The thought of becoming a "whistleblower" can make one shudder. The worry about one's own job, career or social reputation rightly causes discomfort for many employees. But this is where the Whistleblower Protection Act comes into play - a law that not only promotes, but also protects, since July 2023 the courageous step of exposing malpractices.

What the law entails, which rights and obligations it brings for you as an employer and why it also offers numerous advantages for companies, you will find out in this article. As always with legal topics, the information provided in this article is intended exclusively for the general understanding of the Whistleblower Protection Act and does not constitute legal advice. For specific legal concerns, you should consult a qualified lawyer.

An expert talk on the new Whistleblowing Act took place on December 14, 2023. Our colleague Jana spoke with attorney Dr. Michael Fausel and Johannes Jakob from whistle.law about the new law and its concrete implementation. Click on the following link to watch the recording now.

What is the Whistleblower Protection Act (HinSchG)?

The Whistleblower Protection Act is a legal framework that came into effect on July 2, 2023 and aims to protect individuals who expose malpractices in organizations or companies. This legislation creates a safe channel for employees, contractors or even third parties who want to point out serious malpractices, without them having to fear retaliation or discrimination. Here are the key points:

• At its core, the HinSchG entails the provision of internal reporting offices through which employees can anonymously provide information.

• The law applies to companies with more than 50 employees.

• Exceptions such as capital management companies must implement the HinSchG regardless of their number of employees.

• Companies with between 50 and 249 employees have a grace period until December 17, 2023 to set up the internal reporting offices.

Does it sound like a lot of work? With the right tool you can implement the HinSchG uncomplicatedly and above all legally! Just take a look in our category for Whistleblower Software!

Why is the HinSchG important?

The roots of the Whistleblower Protection Act lie in the realization that malpractices within organizations are often known internally before they reach the public. These can be a wide range of issues, such as financial misconduct, fraud, corruption, health and safety breaches, or environmental crimes. Without a safe channel to report such malpractices, they can remain hidden or continue with potentially serious consequences for society and the economy.

The Whistleblower Protection Act not only serves to protect individual whistleblowers, but also fosters a culture of transparency and accountability within organizations. This, in turn, can strengthen the public's trust in companies and institutions.

For companies, the Whistleblower Protection Act entails a requirement to put in place mechanisms for reporting malpractices and fostering a culture in which employees feel comfortable expressing their concerns. It also requires companies to avoid retaliation against whistleblowers and instead proactively address identified issues.

What you as an entrepreneur need to bear in mind

The Whistleblower Protection Act implements EU Directive 2019/1937 into German law and aims to create a safe framework for reporting malpractices in companies and authorities. As an entrepreneur, you should familiarise yourself with the obligations that this law brings with it in order to be legally covered and promote a trusting corporate culture. Here are the key obligations and measures you need to take for the HinSchG:

Setting up reporting offices:

• Internal reporting offices: According to §§ 12 to 18 HinSchG, you have to set up an internal whistleblower system in your company through which employees can report malpractices.

• External reporting offices: External reporting offices are operated by the public sector (§§ 19 to 31 HinSchG). These can also be used for reports from your company, especially if serious malpractices are reported or if internal reporting offices are deemed inadequate.

Processing of reports

• You are obliged to handle and take seriously all reports that come via the internal reporting points. This includes a thorough investigation of the reported misconduct and, if necessary, the initiation of appropriate measures. In addition, you are obliged to inform the whistleblower about the measures you have taken within 3 months.  

Protection of reporting persons

• Persons who report malpractices must be protected from any form of retaliation or disadvantage. This includes protection from dismissal, bullying, denial of promotion or other negative consequences as a result of their report.

Ensuring anonymity and confidentiality

• If whistleblowers wish, their reports must be able to be made anonymously. The identity of whistleblowers must not be disclosed without their explicit consent.

Education and training

• Your company should carry out educational and training measures to inform the employees about their rights and obligations in the context of whistleblower protection.

Documentation and tracking

• It is important to document all steps in dealing with reports of violations in order to be able to prove compliance with the legal requirements if necessary.

How to properly handle an internal report

The Whistleblower Protection Act specifies certain steps that must be followed in the process of an internal report. Should the worst case scenario occur, your reporting office must take the following steps:

1. Confirm receipt of the report: Confirm to the reporting person the receipt of their report within no later than seven days.

2. Check the scope: Check if the reported violation falls within the factual scope of application according to § 2 of the Act.

3. Keep in touch: Maintain contact with the reporting person throughout the entire process.

4. Check plausibility: Thoroughly review the validity of the incoming report.

5. Request additional information: Request further information from the reporting person if needed.

6. Take appropriate follow-up measures: Take appropriate follow-up measures according to § 18 of the law based on the results of the review.

7. Provide feedback: Provide the reporting person with feedback within three months of confirming receipt of the report about planned and already implemented follow-up measures and the reasons for these. Ensure that the feedback does not interfere with internal investigations or inquiries and that the rights of other parties involved are not infringed.

By following these steps, you ensure a structured and legally compliant handling of internal reports in your company.

Benefits of the Whistleblower Protection Act for your business

Admittedly: While the HinSchG initially means a considerable effort for you as an employer in its implementation and later management of possible reports, the law creates real advantages not only for your employees but also for you as an entrepreneur:

Promoting an open corporate culture

The law promotes a culture of openness and trust where employees are encouraged to voice concerns or malpractices without fear of retaliation. This can improve employee satisfaction and retention.

Early detection of problems

Through the Whistleblower Protection Act, you can detect malpractices in your company at an early stage and tackle them before they develop into bigger or even public problems. This can minimize financial losses and legal risks.

Improving compliance

An effective whistleblower protection system helps your company to better comply with legal regulations and achieve a higher level of compliance. This in turn can reduce the risks of legal sanctions and penalties.

Increasing public trust

Companies that deal transparently with malpractices and pursue an active whistleblower protection policy can strengthen the trust of the public and stakeholders. This can in turn positively influence the corporate image and customer loyalty.

Improving corporate governance

The Whistleblower Protection Act can serve as an opportunity to review and improve corporate governance and internal control systems, ultimately strengthening the corporate structure.

Risk management

By creating secure reporting channels and promoting open communication, your company can improve its risk management strategies and better respond to potential risks.

For more information on the topic as well as interesting best practice examples, it is worthwhile to follow this link and watch our past expert talk.

Implementing the Whistleblower Protection Act: 5 whistleblower softwares

The easiest way to set up a whistleblower system is by choosing the right Whistleblower Protection Act software. This not only ensures transparency in your company, but also the necessary legal and data security. We have already brought you five of the most popular solutions from OMR Reviews:

whistle.law

Hintbox

PRIMA Hinweisgeber

Parlabox

BKMS Incident Reporting Essentials