How to Set Up a Whistleblower System for Your Company

1. What is a reporting channel?
2. Choosing the right reporting channel
3. Implementing the Whistleblower System
4. Anonymity and data protection in the whistleblower system
5. 5 Tools for Whistleblower Systems

In the modern business world, ethical practices and transparency are increasingly coming to the fore. Companies are looking for effective ways to foster a culture of accountability and avoid unlawful behavior. A key element in this is the implementation of a robust whistleblower system. A whistleblower system allows your employees and stakeholders to express concerns about legal or ethical violations confidentially and without fear of retaliation. With the entry into force of the Whistleblower Protection Act in July 2023, the establishment of such a system has not only become good business practice, but also a legal obligation for all companies with more than 50 employees. 

As you set out to implement a whistleblower system in your business, you will encounter a variety of considerations and decisions. From choosing the right whistleblowing software to training your team and establishing internal reporting points - implementing a whistleblower system requires thorough planning and consideration. This article shows you how to master this task with ease. 

As always with legal topics, the information provided in this article is for general understanding of Whistleblower Protection Act and does not constitute legal advice. For specific legal concerns, you should consult a qualified lawyer. 

What is a reporting channel?

A reporting channel is a specified way for individuals - often employees, but also external stakeholders - to express concerns about potential illegal or unethical practices within an organization. The creation of such a channel is an important step in promoting an open and law-abiding corporate culture, enabling stakeholders to report potential problems safely and often anonymously. 

In contrast, an internal reporting point refers to a special unit or department within the organization responsible for receiving, investigating, and processing reports received via the reporting channel. The internal reporting point is therefore the organizational framework in which concerns reported via the reporting channel are handled. It usually consists of trained staff who evaluate, follow up and take appropriate action to respond to the reported concerns.

While the reporting channel provides the mechanism for reporting, the internal reporting point provides the structure and procedure to effectively manage and respond to these reports. Both elements are crucial for the development of a robust and effective whistleblower system that enables the organization to maintain legal compliance, identify potential risks and promote a culture of accountability and transparency. More information on the characteristics of an internal reporting point can be found in our corresponding article.

Choosing the right reporting channel

Reporting channels are essential components of a functioning whistleblower system in companies and other organizations. Through them, your employees and sometimes also external persons get the opportunity to point out possible violations or shortcomings. Here is an overview of the different types of reporting channels and the legal requirements under the Whistleblower Protection Act (HinSchG), which you should know:

Telephone Hotlines

A common reporting method is the establishment of a telephone hotline that allows concerns to be expressed anonymously or by name. Section 16 (3) of the HinSchG requires reporting channels to allow reports in oral form, and telephone hotlines meet this requirement.

Online Portals

Online reporting portals and forms allow your employees to express concerns digitally. These can be submitted in text form, which is also a requirement of the HinSchG. 

E-mail Systems

E-mail is another channel through which reports in text form can be made. It is a simple and direct method, although anonymity may not always be guaranteed here. However, this is not required by the Whistleblower Protection Act.

Personal Reporting

The HinSchG also requires employees to have the ability to report their concerns personally to a responsible person at the internal reporting point. This should be made possible within a reasonable time after the reporting employee's request.

Video and audio conferences

Also in accordance with the HinSchG, reports can be made via video or audio conferences if the reporting employee agrees.

Mailbox Systems

A physical or electronic mailbox can also serve as a reporting channel, where employees can express their concerns in writing.

The legal requirements also emphasize the importance of confidentiality and security of the information reported via these channels. According to § 16 paragraph 2 of the HinSchG, only the persons responsible for receiving and processing the reports, as well as the persons supporting them in these tasks, should have access to the reports.

Implementing the Whistleblower System

Implementing an effective whistleblower system is a proactive step in promoting a transparent and lawful corporate culture. Such a system allows employees to report concerns or possible violations of laws and guidelines. Here is a detailed guide on how to implement a whistleblower system in your company, taking into account the legal requirements and provided notes:

• Understanding legal requirements: According to the Whistleblower Protection Act, your reporting channels must be designed to allow reports in oral or textual form. This includes the opportunity for a personal meeting, or with the consent of the reporting person, transmission via video and sound.

• Choosing the right technology: The implementation of a whistleblower system is greatly facilitated by the use of software. There are specialized whistleblowing software solutions that simplify the process from reporting to tracking and processing. You can find suitable tools in our category for Whistleblowing Software or our list of the best Tools for the Whistleblower Protection Act.

• Setting up the reporting channel: Online forms are a common and effective method for enabling reports. You can provide an online form on the company's website or intranet, which is easily accessible through a link. When using software, the process is relatively simple: you create your form, integrate it on the desired platform, and your reporting channel is ready to use.

• Managing reports: A major advantage of using software is the ability to centrally manage, track and process reports. Within the software, you can handle all communication, making the process efficient and clear.

• Training and Sensitization: It is important that employees are informed about the whistleblower system and know how to use it. Appropriate training and sensitization is therefore essential.

Anonymity and data protection in the whistleblower system

Data protection and anonymity are two important aspects in the area of whistleblowing. Here are some of the main points you should consider when setting up the whistleblower system:

• Anonymity: There is no legal requirement that your reporting channels must allow anonymous submission of reports. Most software offers this anyway, for example by creating an individual tracking code in case of a report. With this, users can log into the system afterwards without entering credentials such as email address and track their reporting history. 

• Data Protection: Of course, all reporting channels and whistleblower system must comply with common data protection regulations (GDPR). In addition, you must ensure that only those individuals who process and receive the reports have access to these. 

• Data retention: Certain data such as logs, audio or video recordings may only be recorded with the prior consent of the reporting persons. All data must then be deleted after a maximum of 3 years.

5 Tools for Whistleblower Systems

Now that you know what to look for when setting up a whistleblower system, are you still looking for the right tool? Then take a look at these five providers:

whistle.law

hintcatcher

Whistle Willow

Whistlelink

Ethicontrol