When people hear the term “whistleblowing,” many initially think of classified documents, major revelations, and people standing in underground parking garages wearing sunglasses. In everyday corporate life, whistleblower protection usually begins in a much less dramatic way: with a suspicious invoice, a bypassed security procedure, or the concern that coming forward might result in professional repercussions.
The Whistleblower Protection Act is intended to ensure that such information can be reported securely and handled appropriately. Therefore, companies subject to the law need more than just an email address. They need a reporting office that operates confidentially, meets deadlines, evaluates reports, and can initiate appropriate follow-up actions.
A P.O. box with the word “confidential” in its name is not yet an independent reporting center. For now, it’s just a P.O. box with aspirations.
Under the Whistleblower Protection Act, private employers with generally at least 50 employees must establish and operate an internal reporting office. For certain companies in regulated industries, particularly the financial and insurance sectors, this requirement may apply regardless of the number of employees.
Companies with 50 to 249 employees may operate a joint reporting office. Joint structures are also possible within a corporate group, provided that the legal requirements are met in each individual company.
It is not enough simply to have a technical reporting mechanism in place somewhere. The reporting office must actually be operational. It requires clear responsibilities, authority, and sufficient expertise. It must be able to investigate incoming reports and take the necessary follow-up actions.
Whistleblowing within a company requires a reliable channel of communication. Reports must be able to be submitted either in writing or verbally. If requested by the whistleblower, a face-to-face meeting must also be arranged within a reasonable time.
The reporting channel must be designed so that only authorized and supporting personnel have access to the information received. The confidentiality requirement protects not only the identity of the person making the report, but also the individuals who are the subject of the report and any other persons named therein.
A company is not technically required to allow anonymous reports. However, the law stipulates that anonymous reports should be processed. In practice, an anonymous or pseudonymous feedback channel can significantly contribute to acceptance. Without being able to ask follow-up questions, one must assess a potentially important report based on its first three sentences. This is not an ideal starting point for an investigation.
Upon receipt of a report, a formal procedure begins. The internal reporting office must generally acknowledge receipt within seven days at the latest. It then reviews, among other things:
No later than three months after the acknowledgment of receipt, the whistleblower must receive feedback regarding planned or already taken measures. In doing so, ongoing investigations and the rights of the accused or otherwise named individuals must not be compromised.
Therefore, providing feedback does not mean that every test result must be disclosed. However, remaining silent is not a valid course of action either.
In general, whistleblowers may choose whether to use an internal reporting channel or the appropriate external reporting office. A central external reporting office for the federal government has been established at the Federal Office of Justice; however, specific areas fall under the jurisdiction of other agencies, such as the Federal Financial Supervisory Authority (BaFin) or the Federal Cartel Office.
Companies may encourage internal reporting if a violation can be effectively addressed internally and there is no risk of retaliation. However, they may not restrict or hinder external reporting channels.
For companies, this translates into a fairly simple principle: The more trustworthy the internal reporting office is, the more likely it is to be used. Trust cannot be written into the rules of procedure and then checked off as complete. It is built through accessible points of contact, transparent processes, and credible protection against retaliation.
The Whistleblower Protection Act expressly permits a third party to be entrusted with the duties of the internal reporting office. This can be particularly useful for small and medium-sized enterprises that lack the necessary expertise, personnel capacity, or organizational independence internally.
An external ombudsperson can receive reports, maintain contact with the whistleblower, assess the facts from legal and organizational perspectives, and coordinate the next steps. At the same time, this helps reduce conflicts of interest. For example, a report against management should not end up in the management’s personal inbox.
However, contracting an external firm does not transfer all responsibility. The company remains obligated to take appropriate measures to remedy any identified violations. Professional handling can be outsourced, but corporate responsibility cannot be delegated.
The Whistleblower Help Desk offers companies the opportunity to engage an external ombudsperson and to professionally organize the receipt, review, and structured handling of reports.
Reports may contain a wide range of personal data: names, allegations related to employment, the content of communications, health information, or details about possible criminal offenses. This affects not only whistleblowers, but also accused individuals, witnesses, and other parties involved.
The Whistleblower Protection Act allows reporting centers to process the necessary data. However, this does not eliminate the requirements of the GDPR. In particular, companies must clarify:
Records of a report must generally be deleted three years after the conclusion of the proceedings. Longer retention is permissible only if it is necessary and proportionate to comply with legal requirements.
When using an external reporting channel, data protection, confidentiality, technical security, and the respective responsibilities should therefore be clearly defined in a contract. A whistleblower system handles information that no one would want to accidentally find in a general project folder.
Whistleblowers may not be disadvantaged as a result of a protected report. This prohibition also includes threats of and attempts at retaliation. Examples of such retaliation include termination, transfer, denial of promotion, intimidation, or a negative performance evaluation in response to the report.
If a report leads to adverse employment action and the whistleblower claims a connection between the two, the burden of proof is reversed by law. In that case, the other party must demonstrate that the action was based on sufficiently justified grounds or was not related to the report.
This doesn't just apply to the reporting office. Executives and human resources departments must also know how to respond to a report and document their decisions. Whistleblower protection is therefore an integral part of the company's organization—not just a side project for the compliance department.
An effective whistleblower system should cover at least the following points:
It should also be clarified which situations fall outside the scope of the law and where other complaints should be forwarded. Not every instance of dissatisfaction falls under the Whistleblower Protection Act. Nevertheless, it may still be an issue that someone should address.
Any entity that fails to establish and operate an internal reporting channel despite being required to do so risks a fine of up to 20,000 euros. Fines of up to 50,000 euros may be imposed for obstructing a report, engaging in retaliation, or certain breaches of confidentiality. In addition, claims for damages and other consequences under labor, data protection, or criminal law may apply.
The more important economic consideration often comes into play earlier: A well-handled internal report can help limit damage before a problem escalates into a criminal investigation, a data breach, or a public scandal.
A whistleblower system, therefore, does more than just protect whistleblowers. It gives the company the opportunity to learn about problems while there is still time to address them.
An effective whistleblower system consists of a secure reporting channel, independent handling, and a robust follow-up process. If any one of these components is missing, a report may still be received. Whether this results in a meaningful response, however, is largely left to chance.
An external ombudsman can be a pragmatic solution, especially for small and medium-sized businesses. This approach combines confidentiality, expertise, and clear deadlines without requiring the creation of a dedicated internal position.
The Whistleblower Help Desk assists companies in engaging an external ombudsperson and implementing the requirements of the Whistleblower Protection Act in practice.