Member News

CMS | Implementation of the EU Whistleblower Directive – What the new German Whistleblower Protection Act means for almost all employers

Many companies have already introduced internal whistleblowing policies. The EU Whistleblower Directive (EU Directive 2019/1937) will be soon transposed into German law by the Whistleblower Protection Act [Hinweisgeberschutzgesetz]. The German government has just presented a corresponding draft bill. The legal implications of the Whistleblower Protection Act are profound:

Mandatory introduction of whistleblowing hotline

The Whistleblower Protection Act obliges all companies with 50 or more employees (including freelancers) and companies with an annual turnover of 10 million euros or more to set up an internal “whistleblowing hotline” for employees, customers, suppliers and other third parties. Companies can either set up decide to set up an internal organisational unit or -what we recommend- entrust a third party with the establishment and operation of a reporting office.

Whistleblowers’ right of choice and their protection against reprisals

Whistleblowers will be free to choose whether to contact an internal or an external reporting office to be set up by the government. In addition, they will be comprehensively protected against reprisals, e.g. regarding dismissals or non-promotions in connection with the reporting of violations. In this respect, the draft law provides for a reversal of the burden of proof: for example, if a whistleblower reports a violation in good faith and is subsequently being dismissed, the company must prove that the dismissal is not related to the report in order to avoid claims for damages.

Threatening sanctions

The violation of several obligations under the Whistleblower Protection Act constitutes an administrative offence. The parties involved are faced with fines of up to EUR 100,000, e.g. if reports are prevented or reprisals are taken against whistleblowers acting in good faith. Fortunately, there are no sanctions for failing to set up an internal reporting office. However, in order to avoid whistleblowers turning directly to external reporting bodies or to the public, it is nevertheless in the interest of the company to create an internal whistleblowing facility in order to receive reports in a protected, non-public setting. In order to minimize liability risks, it is recommendable to be prepared.

Act now and implement key to-dos:

  1. Establishment of an internal whistleblowing system or corresponding modification of an existing reporting system: The internal whistleblowing system required must meet certain minimum requirements, as well as the establishment of a procedure for internal reporting. Furthermore, it is advisable to carefully document the procedure due to the reversed burden of proof.
  2. Bear in mind the co-determination rights of the works council: When setting up an internal whistleblowing system or changing an existing one, it should be noted that negotiations with the works council will be necessary.
  3. Create interface between the internal reporting office and HR department: In light of the reversal of the burden of proof, it is essential that the HR department has comprehensive documentation that enables it to prove that disciplinary measures are not related to whistleblowing. The exchange of information HR department and those responsible in the internal reporting office is essential for this. An additional challenge ill certainly be to simultaneously comply with the applicable data protection regulations (GDPR, German Federal Data Protection Act).


  • Dr. Gerlind Wisskirchen, Partner | gerlind.wisskirchen[at]

Compliments of CMS Hasche Sigle – a member of the EACCNY.