# Whistleblower system according to HinSchG (Whistleblower Protection Act): Reporting channel, deadlines, case processing > Since December 2023, companies with 50 or more employees need an internal reporting channel. How to set up a whistleblower system that is used, adheres to deadlines, and retrieves complaints from the HR inbox. URL: https://techport.ai/en/hr-beratung/mitbestimmung-und-compliance/hinweisgeber --- 1. [HR Consulting](/en/hr-beratung)/ 2. [Co-determination and Compliance](/en/hr-beratung/mitbestimmung-und-compliance)/ 3. Complaint and Whistleblower Management [Co-determination and Compliance](/en/hr-beratung/mitbestimmung-und-compliance) # Complaint and Whistleblower Management By Redaktion techport.ai, HR-Beratung · Last updated on 21 August 2026 The company has a reporting channel because the law requires it. It consists of an email address that the compliance officer reads when they have time. Last year, one report was received. At the same time, twelve complaints about managers, three reports of working time violations, and one allegation of sexual harassment landed in the HR inbox. None of these were recorded as official reports, none were processed within the deadlines of the Whistleblower Protection Act, and for two cases, it is no longer possible to ascertain what happened. A whistleblower system is not a letterbox. It is a process: receipt, confirmation, examination, measures, feedback, documentation. And it must also capture cases that do not come through the official channel. ## How you can tell * The reporting channel is not used; complaints still arrive, just elsewhere. * Deadlines for acknowledging receipt and providing feedback are not monitored because no one knows them. * Cases are processed via email. Who decided what and when is not recorded anywhere. * The workforce either does not know about the reporting channel or does not trust it. ## Why this happens The Whistleblower Protection Act was implemented as a compliance obligation, not as a process. The reporting channel was set up and then forgotten. HR, Compliance, and the Works Council have parallel channels for similar cases, without coordination. And without case management, each process is a unique item in an inbox. ## Our approach 1. **Consolidate channels.** We identify where complaints and reports are currently received: reporting channel, HR, works council, managers, complaints office under the AGG (General Equal Treatment Act). This creates a process that directs all incoming reports to the same processing, with due regard for confidentiality and responsibility. 2. **Define case processing.** For each type of case: Who examines, who decides, which deadlines apply, when the works council must be involved, when external bodies. With templates for acknowledging receipt, hearings, and closure. 3. **Implement a system.** A case management system with confidential access, deadline monitoring, documentation, and permissions that technically secure confidentiality. This can be a specialised whistleblower system or a suitably configured ticket system, depending on the size. 4. **Publicise.** The reporting channel is explained in onboarding, on the intranet, and in training sessions, with a clear statement of what happens and what does not. Trust is built through experience, and the initial experience must be positive. ## What you gain * Every report is recorded, processed within deadlines, and documented, regardless of how it is received. * In the event of a dispute, you document what you did and when. * Problems become known internally before they are reported externally. ## From Our Projects When we consider the intake channels for complaints and reports, in practice, the majority of relevant cases do not end up in the official reporting office, but with HR, the works council, or managers. A process that directs all channels into the same handling procedure is, in our experience, more important than the reporting system itself. The deadline monitoring within the system is the element that makes the difference in the event of a dispute, because it documents what happened when. ## Good to know Since 17 December 2023, the [Hinweisgeberschutzgesetz](https://www.gesetze-im-internet.de/hinschg/) (Whistleblower Protection Act) has obliged companies with 50 or more employees to maintain an internal reporting office. Receipt must be confirmed within seven days, and feedback on measures provided within three months. The confidentiality of identity must be maintained, reprisals are prohibited, and in the event of a dispute, the burden of proof lies with the employer. Violations can be penalised with fines of up to 50,000 Euros. In addition, there is an obligation to establish a complaints office according to § 13 AGG (General Equal Treatment Act), which is sensibly managed within the same process. ## Frequently asked questions Can HR operate the reporting office? Yes, if independence is maintained and there are no conflicts of interest. For reports concerning HR itself, representation is required. Many companies combine an internal office with an external ombudsperson for such cases. Do anonymous reports have to be processed? The law does not mandate the acceptance of anonymous reports but recommends it. In practice, the option for anonymous reporting significantly increases its usage. We recommend allowing them. ## Let's talk about Complaint and Whistleblower Management In a thirty-minute first call we clarify where your biggest lever is and whether we are the right partner for it. [Book a first call](/en/kontakt)[Our consulting](/en/so-funktionierts) ## Further reading [Co-determination and ComplianceHR Software and Works CouncilsEvery HR system is subject to co-determination, even without an intention to monitor. How to successfully introduce it with the Works Council: early information, framework works agreement, data protection concept, AI clauses.](/en/hr-beratung/mitbestimmung-und-compliance/betriebsrat)[Mobility and LeaversAbsences and Integration ManagementParental leave, care leave, long-term illness and company integration management as processes: automatically identify deadlines, document legally compliant, shape return to work.](/en/hr-beratung/mobilitaet-und-austritt/abwesenheiten-bem)[HR Data and SystemsHR Service Desk and Employee Enquiries400 emails per month and no analysis: How an HR Service Desk with ticketing, a knowledge base, self-service, and an AI assistant removes routine from the HR department and makes response times measurable.](/en/hr-beratung/hr-daten-und-systeme/hr-servicedesk)[KnowledgeHR Regulatory RadarWhat applies, what is coming, what to do now.](/en/hr-beratung/regulatorik-radar)[KnowledgeHR GlossaryKey HR terms, briefly explained.](/en/hr-beratung/glossar) Back to the field [Co-determination and Compliance](/en/hr-beratung/mitbestimmung-und-compliance) ## Sources * [Hinweisgeberschutzgesetz (HinSchG)](https://www.gesetze-im-internet.de/hinschg/) * [§ 13 AGG, Right to Complain](https://www.gesetze-im-internet.de/agg/__13.html) Rt Written by [Redaktion techport.ai](/ueber-uns), HR-Beratung Mehr als 15 Jahre Erfahrung in HR-Prozessen und HR-Systemen, Einführung von HR-Software in mittelständischen Unternehmen, Verhandlung von Betriebsvereinbarungen zu IT-Systemen. This page reflects the position as at the date shown and does not constitute legal advice. For specific questions we work together with your legal advisers. [More about us](/en/ueber-uns) More from techport.ai [ Software Custom process software for mid-sized companies. ](/en/loesungen)[ IT consulting Strategy, architecture, operations and security. ](/en/it-beratung)[ IT maturity check Ten minutes to a clear position. ](/en/it-beratung/reifegrad-check)[ HR maturity check 24 statements, a result per field. ](/en/hr-beratung/reifegrad-check)[ Funding BAFA grant plus more than 50 programmes for delivery. ](/en/foerderung)[ Process in practice How workflows become reliable software. ](/en/sop-praxis)[ Data and AI Analysis, forecasts and assistance systems. ](/en/daten-ki)[ About us The people behind techport.ai. ](/en/ueber-uns)