When does a whistleblower system have to be implemented?
According to EU law, Directive (EU) 2019/1937 ("Whistleblower Directive") should have been transposed into German law by 17 December 2021.The delayed implementation could lead in part to the direct application of the EU Directive, particularly for companies from the public sector.

Private companies in Germany, have been able to wait for the transposition of the directive into German law - but now there is an urgent need for action! The obligation to introduce a corresponding whistleblower system exists for companies in Germany with more than 249 employees shall apply from 02.07.2023.
Only companies in Germany with 50 to 249 employees will not have to implement a corresponding whistleblowing system until 17 December 2023.
Which companies in Germany are affected?
The obligation to implement a notification system applies in principle to all private and public companies in Germany with at least 50 employees as a rule. For certain companies the obligation is arranged irrespective of their number of employees. In principle, only medium-sized companies with a workforce of 50 to 249 employees are subject to simplified regulations. These companies may establish and operate a joint office for the collection of notifications and for the other measures required by the Act. However, they remain obliged to report the violation and to provide feedback to the whistleblower. For affiliated companies, a simplification is provided to the extent that an independent and trustworthy body can also be established as a "third party" in the case of an affiliated company, which can also work for several independent companies in the group. Internal reportings must then also be possible in the working language of the respective commissioning subsidiary. The commissioning of a central reporting office at a group company must not create any additional hurdles for persons providing information.
What types of whistleblowing systems are allowed?
In principle, there are two equally important reporting channels available to whistleblowers. These are, on the one hand, internal and, on the other hand, external reporting channels. However, the whistleblower should prefer to report to an internal reporting office in cases where effective internal action can be taken against the violation and the whistleblower does not fear reprisals.
Internal reporting channels
There is margin for the precise design of the internal reporting channel. The internal reporting office can be set up by entrusting the tasks of the internal reporting office to a person employed by the respective employer, a work unit consisting of several employed persons or a third party. In particular, a lawyer can also be entrusted with the tasks of the internal reporting office as an external ombudsperson. In each case, the person in charge requires sufficient competence to be able to carry out the necessary legal assessment of the reports.
The tasks of the internal reporting office include the operation of the reporting channels, the implementation of the procedure and the preparation of appropriate follow-up measures.
The reporting channels must allow messages in written or oral form.
An obligation to set up reporting offices that also allow anonymous reporting, as initially suggested no longer exists under the law that has now been passed. The law "merely" provides that the internal reporting office should also process anonymous reports. However, companies are free to enable anonymous contact and anonymous communication between the person submitting the report and the internal reporting office. This also applies in particular to those, who have already set up such channels.
If a whistleblower report is received by the company, the confidentiality of the identity of the whistleblower, the persons who are the subject of the report and other persons named in the report must be ensured. Exceptions to this obligation of confidentiality are only permitted in very narrowly defined cases.
Against the backdrop of the legal requirements, the most suitable whistleblowing system is an electronic reporting system. In addition, a physical meeting within an appropriate time frame must be made possible at the request of the person giving the notice. The possibility for persons providing information to have a personal conversation is particularly important when a third party is entrusted with the tasks of an internal reporting office. However, with the consent of the person giving the information, the meeting can also be provided by way of video and audio transmission.
The internal notification channel must at least be available to the employees and loaned workers of the company. The reporting system may also be made accessible voluntarily to those persons who are in contact with the respective company in the course of their occupational activity. These are, for example, members of the company's executive bodies and shareholders, employees, self-employed persons or former employees.
External reporting channels
In addition to maintaining an internal reporting system, companies must also provide their employees with comprehensible and easily accessible information on the possibilities of making external reports to certain authorities. It also applies to these external reporting offices that they should process anonymous reports, but do not have to set up a corresponding channel for this purpose. At the same time it is stipulated that it is the task of the external reporting offices to provide information about the possibility of internal reporting.
In principle, the whistleblower can decide whether to report violations internally or externally to an authority. However, as described above, internal reporting bodies are to be given preference. Employers should continue to create incentives for whistleblowers to first contact the respective internal reporting office before reporting to an external reporting office and provide clear and easily accessible information for employees on the use of the internal reporting procedure. At the same time, they are obliged to provide information on external reporting procedures.
Which reports enjoy whistleblower protection?
The Whistleblower Protection Act goes beyond the provisions of the EU Directive in its scope of application. Accordingly, whistleblowers are protected when reporting violations that are punishable by criminal law or (with certain restrictions) punishable by a fine (Administrative Offenses Act). The report must contain information on violations at the employer where the whistleblower is or was employed or at another office with which the whistleblower is or was in contact due to his or her professional activity.
In addition, the material scope of application extends to other violations of legal regulations of the Federal Government and the Federal States as well as directly applicable legal acts of the EU and the European Atomic Energy Community le. This includes the following areas in particular:
- fight against money laundering and terrorism,
- product safety and conformity,
- transport security, including railway security, maritime transport and air transport security,
- environmental protection,
- radiation protection and nuclear safety,
- food and feed safety, animal health and animal welfare,
- public health,
- consumer protection,
- privacy and personal data protection and security of network and information systems,
- certain violations of the Act on Restrictions of Competition.
Whistleblower reporting - and then?
The whistleblower must receive confirmation of receipt of the report within seven days by the internal reporting office. The received report is then checked by the internal reporting office. Subsequently, appropriate follow-up measures must be taken. For example, the procedure can also be referred to a working unit responsible for internal investigations at the company for the purpose of further investigations. In addition, the explanations clarify that in order to carry out internal investigations - under the condition of confidentiality - information can also be passed on to work units at the company.
The internal reporting office must send a response to the person making the report within three months of confirming receipt of the report. The feedback shall include the notification of planned and already taken follow-up measures as well as the reasons for these.
The incoming notifications must be documented. If necessary, the documentation should be presented to the whistleblower for verification purposes.
The law does not specify to what extent employers should create incentives to use internal reporting procedures first. Since the whistleblower should prefer the internal reporting channels if there is no fear of reprisals and it can be expected that effective action will be taken against the violation, this can be seen as an explicit appeal by the legislator for corresponding professional internal structures. Only if whistleblowers can trust that authorities will take the information seriously, follow it up carefully and clarify punishable offences or irregularities, as well as sanction offences, will they prefer these internal reporting structures as envisaged.
Protective effect for the whistleblower
Whistleblowers only enjoy legal protection if there was a reasonable belief that the information about violations reported was true at the time the report was made, that it falls within the scope of the law and that it has been submitted through the internal or external reporting channels provided for. Subject to these preconditions, the law prohibits any form of reprisals, discrepancies or complaints. The whistleblowers do not have to fear any consequences under employment law in the event of a proper notification. In the case of a labor law process, a reversal of the burden of proof in favour of the whistleblower is provided for. Accordingly, the employer must prove that there was no connection with the reporting of the notice by the employee. In the event of a violation of the prohibition of reprisals, the employee shall be entitled to compensation for financial losses.
Violations are sanctioned with severe fines of between 10,000 and 50,000 euros. For the non-establishment of a corresponding internal reporting office, the fines are only imposed with a transitional period of six months and thus from the sixth month after promulgation. The fines can affect both the persons responsible and the respective companies. Note that in certain cases the fine against the company can increase tenfold!
Urgent need for action!
Companies in Germany must now act. This means that in particular larger companies (249 employees or more) must immediately implement a whistleblower system that meets the requirements of the Whistleblower Protection Act in order to avoid fines. However, even small companies in Germany must adapt to the new regulations, as whistleblowing systems have not existed there on a regular basis to date and this legal obligation will affect them as early as the end of 2023. If such systems already exist, they often at least do not meet the legal requirements and now have to be adopted. In this respect, it is advisable to deal with the implementation of such a system, including the legal framework requirements, as soon as possible and to entrust people with the upcoming tasks.
To ensure that employees do not turn to external reporting offices, the employees must be informed comprehensively about the use of the internal whistleblower system at an early stage. In addition, a company-internal whistleblower guideline should be implemented or embedded in a Code of Conduct.
In order to allow sufficient time for the technical implementation and the implementation of other legal requirements, e. g. co-determination rights of the works council or requirements under data protection law, the measures should definitely be started now at the latest.