The reporting office nobody wants used

Since July 2023, the German Whistleblower Protection Act (HinSchG) requires companies with 50 or more employees to run an internal reporting office. In many organizations this became an email inbox, set up, documented and combined with the quiet hope that nothing ever arrives. That is humanly understandable and still wrong twice over: it risks a fine, and it defeats the purpose of the reporting office.

The reporting office is an early-warning system, not a letterbox

Whoever reports internally takes a personal risk. They only do it if two things are credible: that their identity stays protected, and that the report leads somewhere. An inbox can show neither. And the alternative has long existed: the external reporting path to the authorities is open to anyone whom their own organization does not convince. Every report that arrives internally instead of externally is the chance to fix a problem before an authority, a court or the press does.

What the law concretely requires

The HinSchG turns the reporting office into a process with deadlines: confirmation of receipt to the reporting person within seven days, feedback on measures taken within three months, plus confidentiality and documentation duties. The crux sits in a detail: even anonymous reporters need a return channel through which confirmation, questions and feedback can flow without giving up anonymity. At the latest here, the inbox fails.

How isidaten runs the reporting office

The whistleblower system in isidaten provides a public, GDPR-compliant reporting portal for confidential or anonymous reports. Anonymous reporters receive an access code, deliberately free of confusable characters, that lets them continue the dialogue without revealing themselves. Behind it sits case management with clear statuses from intake to closure; the 7-day and 3-month deadlines are tracked per case, and anything overdue becomes visible before it becomes a violation. Every step is documented, so the reporting office does not merely exist but demonstrably works.

More is shown on the whistleblower system module page. And if you want to move your reporting office from an inbox to a working procedure, talk to us.