Everything about the new Whistleblower / Whistleblower Protection Act

Whistleblower law

The Bundesrat and Bundestag have passed the new Whistleblower Protection Act. From July 2, 2023, new employer obligations will apply to protect people who provide information about wrongdoing in companies. The English term whistleblower is often used when violations of the law are made public in a way that attracts media attention. However, the new law aims to find ways of allowing companies to deal with grievances internally, so that they are not published or - even better - do not violate the law. This article explains what this means in detail.


For whom the Whistleblower Protection Act is relevant

The Whistleblower Protection Act is important for all companies.

Many articles deal with deadlines for setting up whistleblowers, but that's not the main point: starting July 2, 2023, there will be special protections for whistleblowers, regardless of industry or company size. However, larger companies and certain industries are likely to be more affected.

However, the law is not intended to be used for complaining. It restricts in great detail who may report what. This is to ensure that reports are limited to relevant topics. As an entrepreneur, you can view the reporting channels as an early warning system that allows you to identify grievances at an early stage. So it also has advantages for you if you use it correctly.

When you

  • work in the financial or insurance sector, you must have an internal reporting office in place as of July 2, 2023.
  • 50 to 249 female employees (excluding the financial and insurance sectors), you must have an internal reporting office in place as of December 17, 2023.
  • have at least 250 female employees, you must have an internal reporting office in place as of July 2, 2023.

Fines of up to €50,000 may be imposed for violations of the law as of December 1, 2023.

Anyone who can give clues

Whistleblower can become any natural person who has a professional connection with the company. You must consider this description as openly as possible. It may include these groups:

  • Employees
  • former employee
  • Applicants
  • Interns, freelancers, temporary workers
  • Suppliers and their employees
  • Customers and their employees
  • Shareholders, Members of Supervisory Boards
  • ...

What can be reported

The Whistleblower Protection Act does not, of course, affect the atmosphere in the team, but it does affect a great many cases of violations of laws and regulations. §2 in the text of the law provides a detailed list.

In general, all violations that may result in a penalty or fine, endanger life, limb or health, or affect employee rights can be reported. Conversely, this means that reports of wrongdoing that may be morally reprehensible are not necessarily covered by the law.

It is also important to note that even a reasonable suspicion of such a violation or knowledge of its cover-up will permit a tip-off.

How to give hints

First and foremost, companies must provide internal reporting channels that whistleblowers should use as a first point of contact.

It must be possible to give hints in the following ways:

  • verbally (example: a telephone number specifically set up for notices)
  • in text form (example: a corresponding software or an e-mail address specially set up for notices) - Attention: The law specifically speaks of "text form". In contrast to "written form", this term is generally understood by lawyers to refer to digital recording. A complaint letterbox will probably not meet the requirement, but future case law will have to show that.
  • In person at the request of the person providing the information (this includes video conferencing).

If there is no internal reporting office or whistleblowers suspect that their tips are not being handled properly (for example, too late, without necessary consequences, or if they themselves are prosecuted for the tip), they can use the central external reporting office of the federal government: The Federal Office of Justice. You certainly want to avoid that.

Digital whistleblower system in 3 minutes

With our whistleblower system, you meet the requirements of the Money Laundering, Supply Chain & Whistleblower Protection Act. You'll also protect yourself from compliance breaches, white-collar crime and financial damage. Set up in no time.

What requirements must my reporting office meet?

The reporting office can be operated by one or more persons who are designated for this purpose. These can be, for example, your data protection officers, compliance managers or employees from the legal department.

The employees of the reporting office do not have to be employed exclusively for the reporting office, but they must also not have any conflicts of interest - this makes managing directors or human resources managers unsuitable for this position.

They must also be trained accordingly to be able to perform their duties. Unfortunately, the law does not provide any detailed specifications in this regard.

When notices are received, receipt must be acknowledged within 7 days. Thereafter, information must be provided within 3 months about follow-up actions planned and taken and the reasons for them.

In addition, the reporting office must document all reports for 3 years in such a way that they can serve as evidence, and then delete them.

Do tips need to be handled confidentially and anonymously?

All tips must be processed confidentially. This means that the identities

  • of the whistleblower,
  • of all persons affected by the notification and
  • of all persons who support the whistleblower

be protected. Whistleblowers must not be prosecuted for whistleblowing.

In contrast, however, the tips do not have to be recorded anonymously. This means that you can give whistleblowers the opportunity to submit tips anonymously, but you are not required to do so. Keep in mind that sensitive issues could be brought to external attention more quickly if there is no way to submit the whistleblower anonymously and internally.

Can I outsource my reporting office?

Yes, you can hire a law firm to act as an ombudsperson.

In addition, if you have fewer than 250 employees, you can set up a reporting office together with other companies to save costs.

How do I best implement this now?

The smaller your company, the fewer leads you should expect, so in this case it's probably easiest to set up a lead email address and designate two neutral people (for deputizing) to handle it. Keep in mind that you will need to train them appropriately so that they can do their job accordingly.

As the number of employees increases, it is advisable to switch to software that facilitates the recording, documentation and processing of tips and also enables anonymous reporting channels. This is even available in a package with a law firm that serves as an ombudsperson and provides support.

It is worth calculating whether the monthly costs for such a service are not even lower than the internal effort that can arise from training, implementation, support, processing and documentation.

Digital whistleblower system in 3 minutes

With our whistleblower system, you meet the requirements of the Money Laundering, Supply Chain & Whistleblower Protection Act. You'll also protect yourself from compliance breaches, white-collar crime and financial damage. Set up in no time.


We would like to point out that the contents of our website (including any legal contributions) are for non-binding informational purposes only and do not constitute legal advice in the strict sense. The content of this information cannot and is not intended to replace individual and binding legal advice that addresses your specific situation. In this respect, all information provided is without guarantee of accuracy, completeness and timeliness.

You want to learn more?

Book a call with one of our product experts and learn how Sawayo can make your job easier - or just get started for free.