Fit for the internal reporting office in accordance with the Whistleblower Protection Act

The confidentiality requirement protects the identity of the whistleblower as well as that of all other individuals named in a report, and is therefore the key prerequisite for employees to be willing to report misconduct in the first place. If confidentiality is breached—even unintentionally—it can lead not only to a loss of trust and reputational damage, but also to significant legal consequences. The “ training ” explains what the confidentiality requirement specifically entails, what exceptions the law permits, and how confidentiality can be ensured from a technical, organizational, and communicative perspective. Particular attention is paid to the intersections with data protection law, which regularly lead to uncertainties in practice.

The HinSchG prohibits any form of retaliation against individuals who have filed a report in good faith—including termination, written warnings, transfers, denial of promotion, and even subtle forms of discrimination in day-to-day work. Particularly significant: The law reverses the burden of proof. If a company takes an adverse action against a whistleblower, it must prove that the action is not related to the report. The “ training ” explains how you, as the person responsible for the reporting office, can recognize retaliation early on, take preventive measures, and understand the potential liability for damages in the event of a violation. Understanding these connections not only helps minimize legal risks but also allows you to actively contribute to a culture of protection within your company.

Every report received through the internal reporting channel typically contains personal data—both regarding the person making the report and the individuals against whom the report is directed. As a result, the entire case handling process is subject to the strict requirements of the GDPR. In practice, this regularly raises difficult questions: May the accused person be informed about the report? How long may reports be stored? What are the obligations regarding data erasure? The “ training ” systematically addresses the data protection requirements for handling reports and shows how the GDPR and the German Whistleblower Protection Act (HinSchG) can be reconciled in daily practice—without compromising either of their protective purposes.

An internal reporting channel that no one knows about or trusts does not fulfill its legal purpose. The biggest challenge is to create a corporate culture in which reporting misconduct is seen as a responsible action—and not as a betrayal of colleagues. The “ training ” (Report: The Path to a Culture of Reporting) shows how to raise internal awareness of the reporting channel, what disclosure obligations the law imposes on employers toward employees, and how compliance communication must be structured to build genuine trust. Those who actively shape this cultural shift transform the reporting channel from a legal obligation into a valuable early-warning system—thereby strengthening the integrity of the entire company in the long term.