Select a whistleblowing system: Software requirements & checklist

Executive Summary

Companies with 50 or more employees have been obliged to operate a whistleblower system since December 2023. Violations can result in fines of up to 50,000 euros. Software that complies with the HinSchG must combine verbal and written reporting channels, encrypted data storage, a granular rights concept, an anonymous two-way dialog and automated monitoring of the 7-day and 3-month deadlines.

In addition, functions such as audit-proof documentation, metadata removal when uploading files, multilingualism and multi-client capability are decisive for practical suitability. There are three options for the organizational form: own reporting office, joint reporting office for SMEs or outsourcing to an external service provider. However, the responsibility for remediation always remains with the company. The included 10-point checklist serves as a decision-making aid. The Hintbox is a solution that combines all of these requirements in one platform.

What legal requirements must whistleblower software fulfill?

The HinSchG sets out clear minimum requirements for any whistleblowing system. These are non-negotiable.

Mandatory reporting channels: verbally, in writing, in person

Internal reporting channels must allow reporting both verbally and in text form. Verbal reports must be possible by telephone or another form of voice transmission.

Confidentiality and access protection

The confidentiality requirement under Section 8 HinSchG is the central principle. It protects the identity of:

• of the person making the reference,
• the persons who are the subject of the notification,
• all other persons named.

Only persons who are responsible for receipt and processing may have access.

Anonymity: target specification, not mandatory

The internal reporting office "should" also process anonymous incoming reports. However, there is no obligation to provide anonymous reporting channels.

Documentation with reservation of consent

All reports must be documented in a permanently retrievable manner. In the case of telephone reports, an audio recording or a verbatim record may only be made with the consent of the person making the report.

If there is no consent, a content log must be created. The person providing the information must also be given the opportunity to check, correct and electronically confirm the record. The documentation is deleted three years after the end of the procedure.

Binding deadlines

The software must automatically monitor two hard deadlines:

• Confirmation of receipt: after 7 days at the latest
• Feedback: after 3 months at the latest, extendable to 6 months in complex cases

Protection against reprisals and reversal of the burden of proof

The disadvantaged person must then prove that the measure was based on sufficiently justified reasons or was not related to the report. The protection does not apply to false reports due to intent or gross negligence.

Why the choice of whistleblower system determines fines

The HinSchG has applied to companies with 250 or more employees since July 2, 2023. Smaller companies with 50 to 249 employees had to follow suit by December 17, 2023. Public bodies are also affected. Towns and municipalities with more than 10,000 inhabitants are also subject to the obligation.

Anyone who ignores the requirements risks fines of up to €10,000, €20,000 or €50,000. In addition, there is reputational damage and civil claims.

Which software functions are indispensable?

The legal obligations result in specific functional requirements for the whistleblower software. If you cut corners here, you not only risk fines, but also lose the trust of your own workforce.

Secure communication and encryption

Confidentiality is not an abstract wish in the HinSchG, but a technical requirement. External reporting offices must use secure communication channels and encrypt data in accordance with current data protection standards. The same applies to internal systems; anything else would be negligent given the sensitivity of the reports.

When making your selection, look for a GDPR-compliant hosting location within the EU and relevant security certifications. They are a reliable indication that the provider not only claims information security, but also implements it in a verified manner.

Granular roles and rights concept

The law expressly requires that only authorized persons may access reports. In reality, this means much more than a simple login: it requires a well thought-out authorization system that allows each processor exactly the view and actions that he or she needs for the respective role.

Good software maps this via roles and client-capable structures. Compliance officers see all cases, specialist departments only those relevant to them and external ombudspersons only those assigned to them. In the event of conflicts of interest, individual cases can be specifically excluded from the field of vision of certain processors.

In addition, there is the legal obligation to provide audit-proof, complete documentation of all processing steps. Who changed what in a case and when must remain traceable, not least because the burden of proof quickly lies with the company in the event of a dispute.

Two-way dialog without revealing identity

According to the HinSchG, the reporting office must maintain contact with the person making the report, for example in order to ask questions or communicate interim statuses. This is also necessary if the report was received anonymously. A simple e-mail address is not sufficient here, as it would immediately remove the anonymity.

This creates GDPR-compliant two-way communication without revealing identity. It is not only legally clean, but also psychologically effective: whistleblowers feel they are being taken seriously because they realize that their report is actually being processed.

File upload with metadata protection

Evidence is what makes a report reliable. Screenshots, emails, contracts or photos should therefore be easy to attach. But this is precisely where an often overlooked danger lurks: files often contain information in their metadata that can be traced back to the sender, such as author name, device ID, GPS coordinates or processing history.

Professional whistleblower software automatically recognizes this metadata and removes it during the upload. This preserves the content of the file without compromising the anonymity of the whistleblower. In addition, the system should perform a virus scan to prevent malware from reaching the company via the reporting channel.

These protection mechanisms work in the background. Whistleblowers do not have to worry about the technical details themselves, which is an important factor as very few people have specialist IT knowledge.

Workflow and deadline management

Confirmation of receipt after 7 days, feedback after 3 months. These deadlines are non-negotiable. Anyone who fails to meet them not only risks fines, but also gives whistleblowers a reason to place their report externally with the authorities or, in the worst case, publicly.

The software should therefore automatically monitor both deadlines and send timely reminders to the responsible processors. Ideally, there should be escalation levels: If a deadline is not met, the system automatically informs a superior. In this way, delays can be avoided, even if the processor is on vacation or sick.

Protocol workflow with consent

In the case of verbal reports, the law makes a subtle but important distinction: An audio recording or a verbatim record may only be made with the consent of the person making the report. Without consent, a content log must be created instead.

Good software records this consent digitally and documents it together with the protocol. The person providing the information must then be given the opportunity to check, correct and electronically confirm the record. This ensures that the statement was recorded as it was intended.

This process sounds formal, but it protects both sides: the person making the report from misinterpretation and the company from later disputes about the exact content of the report.

Multilingualism

For corporations, international companies and businesses with foreign suppliers, multilingualism is not a nice-to-have, but a practical must. Anyone who has to submit a report in a foreign language will only do so if they can express themselves confidently in that language.

The law itself does not specify any requirements here, but standard market solutions often offer support for 30 or more languages. Some providers supplement this with AI-based translations that automatically translate incoming reports into the working language of the reporting office without the need for external translators and without jeopardizing confidentiality.

Optional AI functions

Modern solutions go beyond what is required by law and use artificial intelligence to speed up case processing. These functions are not mandatory, but they do provide noticeable relief in day-to-day compliance work:

• Automatic categorization and prioritization: Incoming messages are assigned to a topic area based on their content and sorted according to urgency.
• AI-supported anonymization of personal data: Real names and sensitive information are automatically masked before being passed on to specialist departments.
• Executive summaries for the management: Summarized reports with KPIs and trend analyses for top management are created from several cases.

Especially in larger organizations with many reports per year, these functions can make the difference between an overburdened compliance department and a smoothly running process.

Own reporting office, joint reporting office or external service provider?

The HinSchG allows three organizational forms for the internal reporting office. The choice has far-reaching consequences, not only for the choice of software, but also for personnel requirements, costs and acceptance within the company. Which variant is suitable depends on the size of the company, the sector and the available resources.

Own internal reporting office

In the classic variant, the internal reporting office is located within the company. An individual employee, an entire work unit or an externally commissioned third party can be entrusted with the task. Compliance, legal or HR departments often take on this role, sometimes also the data protection officer as a secondary activity.

In practice, this often means a lot of training. Anyone who fills the role internally should plan for regular further training, both on the HinSchG itself and on conducting discussions, data protection and psychological aspects of whistleblowing. This option is usually standard for companies with 250 or more employees, as a joint reporting office is not permitted there.

Joint Reporting Office for SMEs

The law provides for explicit relief for smaller companies: Several private employers with between 50 and 249 employees may set up and operate a joint registration office. This can be done within a group of companies or across companies, for example if several SMEs from the same sector join forces.

The advantage is obvious: the costs for personnel, training and software can be shared. At the same time, more case experience is gathered in one place, which increases the processing quality. Important to know: The obligation to take remedial action and report back to the whistleblower remains with the individual company. Each member of the joint reporting office therefore remains responsible for the measures taken in their own company.

Outsourcing to third parties

The third option is complete outsourcing to an external service provider, such as a specialized ombudsperson, a law firm or a professional compliance service provider. This option is particularly suitable if there is neither capacity nor expertise available internally or if the company deliberately wants to choose an external, neutral body for reasons of trust.

External service providers usually have several advantages: specialized experience with whistleblower cases, legal confidentiality obligations and a physical distance that can strengthen the trust of the workforce. Particularly in sensitive cases, such as allegations against the company's own management, this distance is often crucial for a report to be made at all.

Checklist: Selecting a whistleblowing system in 10 points

HinSchG-compliant whistleblower software must fulfill ten key requirements. This list summarizes the most important requirements from the previous sections and serves as a practical decision-making aid when comparing providers.

1. Provide verbal and written reporting channels so that whistleblowers can choose the form that suits them best.
2. Enable telephone notification or voice transmission, optionally via hotline, voicemail or voice message.
3. Offer a personal meeting on request, which may also take place via video conference.
4. Encrypted data storage in accordance with current data protection standards, ideally with GDPR-compliant hosting in the EU
5. Granular roles and rights concept with multi-client capability for groups or joint reporting offices.
6. Anonymous two-way dialog via pseudonymous mailboxes with access code, even if not mandatory by law, hardly dispensable in practice.
7. Automated deadline monitoring for 7-day and 3-month deadlines with reminder and escalation functions.
8. Audit-proof documentation with automatic deletion three years after completion of the process.
9. Protocol workflow with electronic confirmation by the whistleblower, including consent to recording.
10. Multilingualism and optional AI functions such as automatic categorization, anonymization and executive summaries for management.

Anyone who fulfills all ten points not only has a legally compliant solution, but also a tool that noticeably relieves compliance officers in their day-to-day work.

Conclusion

Selecting a whistleblower system means bringing together legal obligation and practiced confidentiality. Verbal and written reporting channels, strict access protection, encrypted storage and automated deadline monitoring are the non-negotiable key points.

If you work through the ten checklist points properly, you are on the safe side legally - and create the basis for a compliance culture that builds trust instead of producing mistrust.