--- title: "Whistleblower System Setup" description: "Implementation guide for whistleblower protection systems under HinSchG and EU Directive 2019/1937." image: "https://compound.law/assets/images/og-image-en.webp" source: "https://compound.law/en-DE/skills/compliance-whistleblower/" language: "en" --- Compliance DEEU # Whistleblower System Setup Implementation guide for whistleblower protection systems under HinSchG and EU Directive 2019/1937. — views — Downloads By Dr. Markus Dreißigacker 📄 What's Included SKILL.md ├─ Overview ├─ Systematic Review ├─ Risk Assessment ├─ Special Scenarios └─ Limitations of This Skill On this page ## Overview This skill guides the implementation and review of internal whistleblower reporting systems under the German **Hinweisgeberschutzgesetz (HinSchG)**, which transposes **EU Directive 2019/1937**. The HinSchG, effective since 2 July 2023, requires companies to establish internal reporting channels for employees and other persons to report violations of specified laws. Key provisions include **§ 12** (obligation to establish internal reporting channels), **§ 16** (requirements for the internal channel), **§ 15** (designation of responsible persons), **§ 8** (confidentiality), **§ 36** (prohibition of reprisals), and **§ 40** (fines for non-compliance). Use this skill when setting up a new whistleblower system, auditing an existing one for compliance, or advising on the handling of a specific report. The HinSchG applies to a broad scope of reportable violations including EU law infringements, criminal offenses (Straftaten), certain administrative violations (Ordnungswidrigkeiten), and sector-specific rules. Companies that fail to establish a compliant reporting channel face fines of up to EUR 20,000 (§ 40 Abs. 1 HinSchG), while obstruction of reporting or retaliation against whistleblowers can result in fines up to EUR 50,000 (§ 40 Abs. 2, 6 HinSchG). Beyond fines, failure to comply creates significant reputational risk and may result in whistleblowers reporting directly to external authorities or the media. The whistleblower system processes personal data of reporting persons and accused individuals, triggering a [Data Processing Agreement](https://compound.law/en-DE/skills/data-processing-agreement/) obligation for any external platform provider. Where an employee whistleblower subsequently faces adverse action, the termination must be reviewed under the [Employment Termination Review](https://compound.law/en-DE/skills/employment-termination/) skill — the HinSchG burden-of-proof reversal makes procedural compliance critical. For data subject access requests arising from whistleblower case files, see the [GDPR Data Access Request](https://compound.law/en-DE/skills/gdpr-data-request/) skill for the applicable exceptions and deferred disclosure rules. *** ## Systematic Review ### Step 1: Obligation Scope and Applicability (§ 12 HinSchG) Determine whether the company is required to establish an internal reporting channel, and if so, under which deadline. - **Employee threshold (§ 12 Abs. 1 HinSchG):** Companies with **50 or more employees** must establish an internal reporting channel. The count includes all persons employed regardless of contract type — full-time, part-time, mini-jobbers (geringfugig Beschaftigte), temporary agency workers (Leiharbeitnehmer), and seconded staff. Trainees (Auszubildende) are also counted. The threshold is assessed based on the regular workforce, not a snapshot on any particular day. - **Compliance deadlines:** Companies with **250+ employees** since 2 July 2023; companies with **50-249 employees** since 17 December 2023. Both deadlines have passed. Companies that have not yet implemented a compliant channel are in violation and subject to fines. - **Regulated sectors (§ 12 Abs. 3 HinSchG):** Financial services companies (credit institutions, insurance undertakings, investment firms, payment service providers) must comply **regardless of employee count**. This captures even small fintech companies and insurance brokers with fewer than 50 employees. - **Public-sector entities:** Municipalities, government agencies, and other public bodies with 50+ employees are equally obligated (§ 12 Abs. 1 HinSchG). - **Shared resources (§ 14 Abs. 2 HinSchG):** Companies with 50-249 employees may share reporting channel resources — including the responsible person and the technical infrastructure — with other companies. This enables cost-efficient solutions for SME groups or companies in the same business park. Companies with 250+ employees may not share channels. - **Group structures:** Each legal entity with 50+ employees must maintain its own reporting channel. A parent company’s channel does not automatically satisfy the obligation for subsidiaries, although the infrastructure (e.g., a shared digital platform) may be used, provided each entity has its own responsible person and processing is kept separate. **Flag as risk:** - Company exceeds the 50-employee threshold but has not established a channel - Employee count does not include temporary agency workers, mini-jobbers, or seconded staff - Compliance deadline already passed without implementation, creating ongoing fine exposure - Financial services company below 50 employees assumes it is exempt - Group using a single channel for all subsidiaries without entity-specific processing ### Step 2: Internal Reporting Channel Setup (§ 16 HinSchG) The channel must allow reports through multiple formats and protect the confidentiality of the reporting person’s identity. - **Report formats (§ 16 Abs. 3 HinSchG):** The channel must accept reports in three formats: **(a) written** — dedicated email address, web-based reporting platform, or physical postal mailbox; **(b) oral** — telephone hotline, voice messaging system, or dedicated line; and **(c) in person** — a physical meeting upon request of the reporting person. All three formats must be available; a system that only accepts written reports is non-compliant. - **Confidentiality by design (§ 16 Abs. 2 HinSchG):** The system must be designed to protect the identity of the reporting person, any persons named in the report, and any third parties. This requires: end-to-end encryption for digital platforms, access restrictions (only the designated responsible persons may access reports), secure storage, and separation from general HR or compliance case management systems. - **Accessibility (§ 16 Abs. 1 HinSchG):** The channel must be accessible to all employees. Additionally, where appropriate, access should be extended to temporary workers, shareholders, board members, volunteers, suppliers, contractors, and former employees. Best practice: make the channel accessible via the company’s website (not behind a login wall) so that external parties can submit reports. - **Language:** The channel should be available in the languages spoken by the workforce. For international companies with German operations, German plus English is typically the minimum. - **Outsourcing (§ 14 Abs. 1 HinSchG):** The operation of the channel may be outsourced to a third party — typically an external ombudsperson (often a lawyer) or a specialized platform provider. Outsourcing does not relieve the company of its compliance obligations; the company must ensure the external provider meets all HinSchG requirements. - **Anonymous reporting (§ 16 Abs. 1 S. 5 HinSchG):** The HinSchG does not require companies to accept anonymous reports, but it provides that internal channels **should** enable anonymous reporting (“sollen auch anonyme Meldungen ermoglichen”). In practice, enabling anonymous reporting significantly increases reporting volume and aligns with best-practice compliance standards. The external reporting channel operated by the Federal Office of Justice (BfJ) does accept anonymous reports. **Flag as risk:** - Channel only accepts written reports, not oral or in-person - No confidentiality safeguards in the system design — reports accessible to persons outside the responsible team - Channel not accessible to non-employee reporters (suppliers, contractors, former employees) where required - No anonymous reporting capability despite the statutory “should” recommendation - Outsourced channel provider lacks the expertise or independence required by § 15 HinSchG ### Step 3: Designation of Responsible Persons (§ 15 HinSchG) The company must designate qualified, independent persons to receive reports, assess them, and take follow-up action. - **Designation (§ 15 Abs. 1 HinSchG):** One or more natural persons or an organizational unit (e.g., a compliance department) must be designated as responsible for operating the channel and following up on reports. - **Independence and freedom from conflicts of interest:** Responsible persons must be free from instructions that could interfere with their impartial handling of reports. The responsible person should not report to the person most likely to be the subject of reports. Structural safeguards include: reporting line directly to the supervisory board or an independent compliance officer, separation from HR functions that handle employment disputes, and documented protocols for recusal when the responsible person has a personal interest. - **Expertise (Fachkunde, § 15 Abs. 2 HinSchG):** The HinSchG requires professional competence (Fachkunde) in handling reports and in the applicable legal framework. This includes: knowledge of the material scope of the HinSchG (which violations are reportable), procedural requirements (timelines, documentation), confidentiality obligations, and anti-retaliation protections. Regular training is essential — at least annually. - **External ombudsperson:** Using a lawyer as an external ombudsperson is a common and effective solution, particularly for SMEs. The attorney-client privilege (**§ 203 StGB**) provides an additional layer of confidentiality beyond the HinSchG requirements. However, the company remains ultimately responsible for compliance. - **Special dismissal protection (§ 15 Abs. 3 HinSchG):** Internal responsible persons enjoy special protection against dismissal during their designation and for a reasonable period thereafter, similar to works council members. This protects the integrity of the reporting function. **Flag as risk:** - Responsible person reports directly to the person most likely to be the subject of reports (e.g., CEO with no supervisory board oversight) - No documented training or qualification of responsible persons - Conflict of interest not addressed (e.g., HR head responsible for the channel while also handling employment disputes involving potential whistleblowers) - External ombudsperson lacks specialization in compliance or whistleblower protection law - No deputy designated for absences (vacation, illness), leaving reports unprocessed ### Step 4: Processing Timelines and Follow-Up (§ 17 HinSchG) Strict timelines govern the handling of reports. Non-compliance with timelines is itself a violation that may trigger fines and may cause the whistleblower to escalate to external channels. - **Acknowledgment of receipt (§ 17 Abs. 1 S. 2 HinSchG):** The responsible person must acknowledge receipt of the report to the whistleblower **within seven days**. The acknowledgment should confirm that the report has been received and is being assessed, without revealing details of any investigation. - **Scope assessment (§§ 2, 3 HinSchG):** Determine whether the reported information falls within the material scope of the HinSchG. The law covers: **(a)** violations of EU legal acts in specified areas (public procurement, financial services, product safety, transport safety, environmental protection, food safety, public health, consumer protection, data protection, competition), **(b)** criminal offenses under German law, **(c)** certain administrative violations (Ordnungswidrigkeiten) where the violated provision protects life, limb, or health, or protects the rights of employees or their representative bodies, and **(d)** sector-specific regulations for financial services. If the report falls outside the material scope, the responsible person must document this assessment and inform the whistleblower. - **Follow-up measures (§ 18 HinSchG):** The responsible person must take appropriate follow-up action, which may include: internal investigation (document review, witness interviews), referral to a competent external authority, or closure of the case due to lack of substantiation. The choice of measure must be proportionate and documented. - **Feedback to the whistleblower (§ 17 Abs. 2 HinSchG):** Within **three months** of the acknowledgment of receipt, the whistleblower must receive feedback on the follow-up measures taken or planned. The feedback need not disclose the full outcome of an investigation but must provide meaningful information about what actions were taken. - **Documentation:** Every step must be documented to establish procedural compliance. Documentation should include: date of report, content summary, scope assessment, follow-up measures taken, timelines met, and feedback provided. Reports and documentation must be retained for three years after the conclusion of the procedure (§ 11 Abs. 5 HinSchG). **Flag as risk:** - No acknowledgment sent within seven days - No documented assessment of whether the report falls within HinSchG scope - Three-month feedback deadline missed without documented justification - Follow-up steps not documented, making procedural compliance unverifiable - Documentation retained for longer than three years without justification, creating data minimization concerns ### Step 5: Confidentiality Protections (§ 8 HinSchG) Confidentiality of the whistleblower’s identity is a cornerstone of the HinSchG. Breach of confidentiality is an administrative offense subject to fines. - **Access restriction (§ 8 Abs. 1 HinSchG):** The identity of the reporting person may only be disclosed to the designated responsible persons and to persons who need to know for the purpose of receiving and following up on the report. General disclosure to management, HR, or legal departments is prohibited unless those individuals are part of the designated team. - **Disclosure to the accused person:** The identity of the whistleblower may **not** be disclosed to the person accused in the report, except where: (a) disclosure is necessary for criminal or disciplinary proceedings, (b) the whistleblower has given express consent, or (c) disclosure is required by law (e.g., court order). Even where disclosure is legally required, the whistleblower should be informed in advance where possible. - **Disclosure to third parties (§ 9 HinSchG):** Beyond the accused person, disclosure to any third party is only permitted if it is indispensable for follow-up measures and is proportionate. The whistleblower’s consent should be obtained where feasible. - **Technical safeguards:** Implement access controls (role-based access, two-factor authentication), need-to-know principles, encrypted storage for report files, audit logs of who accessed which reports, and physical security for paper-based reports. The reporting platform should be separated from general IT systems accessible to a wider group. - **Fine for breach (§ 40 Abs. 4 HinSchG):** Violation of confidentiality obligations is a fine-carrying administrative offense (Ordnungswidrigkeit). The fine can be imposed on the individual who breaches confidentiality and, vicariously, on the company (§ 30 OWiG). **Flag as risk:** - Report files accessible to persons outside the designated responsible team - Identity of the whistleblower disclosed to the accused person without legal basis - No technical access controls on the reporting platform — reports stored in shared folders or general compliance databases - Paper reports stored in an unlocked or shared filing location - No audit log of who accessed which reports ### Step 6: Anti-Retaliation Safeguards (§ 36 HinSchG) The prohibition of reprisals is the most significant protection under the HinSchG. It includes a **reversed burden of proof** that shifts the litigation risk to the employer. - **Prohibited reprisals (§ 36 Abs. 1 HinSchG):** The HinSchG provides a non-exhaustive list: termination, suspension, demotion, denial of promotion, transfer, reduction of pay, change of working hours, withholding of training, negative performance reviews, imposition of disciplinary measures, coercion, intimidation, harassment, ostracism, discrimination, and blacklisting. - **Burden of proof reversal (§ 36 Abs. 2 HinSchG):** If a whistleblower suffers any disadvantage following a report, it is **presumed** to be a reprisal. The employer must then prove that the action was based on duly justified grounds entirely unrelated to the report. This is a high standard — temporal proximity alone between the report and the adverse action creates a strong presumption. The employer must produce documentary evidence of the independent justification (e.g., pre-existing performance improvement plan, business restructuring decided before the report). - **Damages and compensation (§ 37 HinSchG):** Whistleblowers who suffer reprisals are entitled to full compensation for all material and immaterial damages. This includes lost wages, lost career opportunities, and compensation for emotional distress. - **Protection scope:** The anti-retaliation protection extends not only to the whistleblower but also to persons who assist the whistleblower and to persons connected to the whistleblower (§ 34 HinSchG) — including colleagues, family members, and legal advisors. - **Management training:** All managers, supervisors, HR personnel, and compliance officers must be trained on anti-retaliation obligations. Training should cover: what constitutes a reprisal, the burden of proof reversal, the documentation requirements for any personnel action affecting a known whistleblower, and the personal liability risk for individuals who commit reprisals. **Flag as risk:** - No anti-retaliation policy communicated to management and HR - Personnel action taken against a whistleblower without documented justification unrelated to the report - No training provided to managers on HinSchG obligations - Whistleblower’s identity known to their direct supervisor who subsequently initiates adverse action - Company relies on informal assurances rather than documented policies and procedures *** ## Risk Assessment ### Common Compliance Gaps | Gap | Fine Exposure | Recommended Action | | ------------------------------------ | --------------------------------------------------------------------- | -------------------------------------------------- | | No internal reporting channel | EUR 20,000 (§ 40 Abs. 1) | Establish channel immediately | | Channel accepts only written reports | Non-compliance with § 16 Abs. 3 | Add oral and in-person options | | No responsible person designated | Non-compliance with § 15 | Designate and train a responsible person | | No anonymous reporting | Best-practice gap (not a fine, but increases external reporting risk) | Enable anonymous submissions | | Acknowledgment not within 7 days | Procedural violation | Automate acknowledgment in the platform | | Feedback not within 3 months | Procedural violation | Set calendar reminders and workflow triggers | | Confidentiality breach | EUR fine (§ 40 Abs. 4) + damages (§ 37) | Implement technical access controls and audit logs | | Retaliation against whistleblower | EUR 50,000 (§ 40 Abs. 6) + damages (§ 37) | Train management, document all personnel actions | *** ## Special Scenarios ### Interaction with Data Protection (GDPR / BDSG) Whistleblower systems process personal data of the whistleblower, the accused person, and witnesses. This triggers GDPR obligations: - **Lawful basis:** Typically Art. 6 Abs. 1 lit. c GDPR (legal obligation) for companies subject to § 12 HinSchG. For companies below the threshold that voluntarily establish a channel, Art. 6 Abs. 1 lit. f (legitimate interest) may apply. - **Data protection impact assessment (Art. 35 GDPR):** A DPIA is likely required given the sensitive nature of whistleblower data and the potential for adverse effects on the accused person. - **Information obligations (Art. 13, 14 GDPR):** The whistleblower must be informed about data processing. For the accused person, information under Art. 14 may be deferred if it would jeopardize the investigation (Art. 14 Abs. 5 lit. b GDPR), but must be provided as soon as the risk subsides. - **Retention limits (§ 11 Abs. 5 HinSchG):** Report documentation must be deleted three years after the conclusion of the procedure unless longer retention is necessary for ongoing proceedings. - **Works council (Betriebsrat):** Introduction of a whistleblower system may trigger co-determination rights under **§ 87 Abs. 1 Nr. 1 BetrVG** (workplace rules) and **§ 87 Abs. 1 Nr. 6 BetrVG** (technical monitoring facilities). Consult the works council before implementation. ### Cross-Border Reporting Structures Multinational groups face the challenge of reconciling the HinSchG with whistleblower laws in other EU member states (each transposing Directive 2019/1937 differently) and in non-EU jurisdictions: - **One channel per entity:** The HinSchG requires each obligated German entity to have its own channel, even within a multinational group. A global ethics hotline can serve as the infrastructure, but processing must be handled at the entity level. - **Language requirements:** The German channel must be available in German. For international workforces, additional languages are best practice. - **Data transfers:** If reports are processed by a central compliance team outside Germany, data transfer mechanisms (Art. 44-49 GDPR) must be in place. SCCs or BCRs may be required. ### Handling Reports Against Senior Management Reports against C-level executives, board members, or the responsible person themselves require special procedures: - **Recusal:** The responsible person must recuse themselves if the report concerns them or a person to whom they report directly. A deputy or external ombudsperson should handle such reports. - **Escalation to supervisory board:** In companies with a supervisory board (Aufsichtsrat), reports against managing directors should be escalated to the supervisory board chair or a designated supervisory board committee. - **External reporting:** The whistleblower always retains the right to report directly to the external authority (BfJ) under § 7 Abs. 1 HinSchG, without any obligation to use the internal channel first. *** ## Limitations of This Skill This skill provides a structured implementation and review framework. In the following cases, engaging a lawyer is necessary: - **Handling of specific reports** involving potential criminal conduct, regulatory violations, or complex factual investigations - **Internal investigations** triggered by whistleblower reports, including witness interviews, document preservation, and privilege management - **Retaliation claims** by whistleblowers, particularly where the burden of proof reversal creates significant employer exposure - **Cross-border whistleblower programs** requiring coordination between HinSchG, EU Directive 2019/1937 implementations in other member states, and non-EU whistleblower regimes (e.g., SOX, Dodd-Frank) - **Works council negotiations** on the introduction and design of the whistleblower system - **Sector-specific requirements** for financial services institutions subject to additional BaFin guidance Compound is happy to assist with the design, implementation, and review of whistleblower systems that comply with HinSchG requirements. — Views — Downloads ![Dr. Markus Dreißigacker](https://compound.law/assets/images/team/markusdreissigacker.webp) Dr. Markus Dreißigacker Category Compliance Jurisdiction DE, EU Updated March 2026 Tags whistleblowerhinschgcompliancereporting-channel #### Need Help? Check out our guide on how to install and use these skills in your preferred AI agent. [Read the guide →](https://compound.law/en-DE/learn/what-is-a-skill/) ## More Skills [AI Regulation](https://compound.law/en-DE/skills/ai-act-compliance/) [EU](https://compound.law/en-DE/skills/ai-act-compliance/) ### [AI Act Compliance Check](https://compound.law/en-DE/skills/ai-act-compliance/) [Assessment framework for EU AI Act compliance. Risk classification, documentation requirements, and conformity assessment paths.](https://compound.law/en-DE/skills/ai-act-compliance/) [![Julian Jantze](https://compound.law/assets/images/team/julianjantze.webp)](https://compound.law/en-DE/skills/ai-act-compliance/) [Julian Jantze](https://compound.law/en-DE/skills/ai-act-compliance/) [— —](https://compound.law/en-DE/skills/ai-act-compliance/) [ai-actcompliancerisk-assessment](https://compound.law/en-DE/skills/ai-act-compliance/) [Contract Law](https://compound.law/en-DE/skills/commercial-lease/) [DE](https://compound.law/en-DE/skills/commercial-lease/) ### [Commercial Lease Review](https://compound.law/en-DE/skills/commercial-lease/) [Review checklist for commercial lease agreements under German law. Covers rent adjustments, maintenance obligations, and termination rights.](https://compound.law/en-DE/skills/commercial-lease/) [![Dr. Markus Dreißigacker](https://compound.law/assets/images/team/markusdreissigacker.webp)](https://compound.law/en-DE/skills/commercial-lease/) [Dr. Markus Dreißigacker](https://compound.law/en-DE/skills/commercial-lease/) [— —](https://compound.law/en-DE/skills/commercial-lease/) [commercial-leasereal-estatecontract-law](https://compound.law/en-DE/skills/commercial-lease/) [Data Protection](https://compound.law/en-DE/skills/data-processing-agreement/) [DEEU](https://compound.law/en-DE/skills/data-processing-agreement/) ### [Data Processing Agreement](https://compound.law/en-DE/skills/data-processing-agreement/) [Review framework for GDPR-compliant data processing agreements. Covers Art. 28 requirements, sub-processor management, and cross-border transfers.](https://compound.law/en-DE/skills/data-processing-agreement/) [![Julian Jantze](https://compound.law/assets/images/team/julianjantze.webp)](https://compound.law/en-DE/skills/data-processing-agreement/) [Julian Jantze](https://compound.law/en-DE/skills/data-processing-agreement/) [— —](https://compound.law/en-DE/skills/data-processing-agreement/) [dpagdprdata-processing](https://compound.law/en-DE/skills/data-processing-agreement/) [Data Protection](https://compound.law/en-DE/skills/data-protection-impact-assessment/) [DEEU](https://compound.law/en-DE/skills/data-protection-impact-assessment/) ### [Data Protection Impact Assessment (DPIA) under Art. 35 GDPR](https://compound.law/en-DE/skills/data-protection-impact-assessment/) [When a DPIA is mandatory under Art. 35 GDPR, how to conduct and document one — with a structured assessment framework for Germany.](https://compound.law/en-DE/skills/data-protection-impact-assessment/) [![Julian Jantze](https://compound.law/assets/images/team/julianjantze.webp)](https://compound.law/en-DE/skills/data-protection-impact-assessment/) [Julian Jantze](https://compound.law/en-DE/skills/data-protection-impact-assessment/) [— —](https://compound.law/en-DE/skills/data-protection-impact-assessment/) [dpiadsfaart-35](https://compound.law/en-DE/skills/data-protection-impact-assessment/) ## Contribute ### Have expertise to share? We're building a hub where legal experts can build and distribute their workflows. Be among the first contributors. [Submit Your Skill →](mailto:contact@compound.law) ## Structured data ```json [ { "@context": "https://schema.org", "@type": [ "Organization", "LegalService" ], "@id": "https://compound.law/#organization", "name": "Compound Law", "alternateName": "Compound Law — AI Law Firm", "url": "https://compound.law/", "logo": { "@type": "ImageObject", "url": "https://compound.law/press/logos/PNG/Compound_Law_Icon.png", "width": 1024, "height": 1024 }, "image": "https://compound.law/assets/images/og-image.webp", "description": "The AI-native law firm in Berlin for start-ups, mid-sized companies and corporates: commercial and contract law, data protection, the EU AI Act, trademarks, corporate law, and restructuring and insolvency. A lawyer reviews every result, billed at a flat fee.", "foundingDate": "2026", "founder": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] } ], "employee": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] }, { "@type": "Person", "name": "Marc Schuba", "jobTitle": "Founding Partner, Rechtsanwalt (German attorney)", "url": "https://compound.law/en-DE/lawyers/marc-schuba/", "sameAs": [ "https://www.linkedin.com/in/marcschuba/" ], "knowsAbout": [ "IP and IT law", "SaaS and IT contracts, IT outsourcing", "Software and open-source licensing", "Data protection law (GDPR)", "AI law and the EU AI Act" ] }, { "@type": "Person", "name": "Dr. Markus Dreißigacker", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/markus-dreissigacker/", "sameAs": [ "https://www.linkedin.com/in/markusdreissigacker" ], "knowsAbout": [ "M&A (Due diligence, post-merger integration, IPO readiness)", "Corporate Law (Governance, board work, restructuring)", "Commercial Law (Customer contracts, supplier agreements, NDAs)", "IP (Trademark management, IP transfer agreements)", "Compliance & ESG (Global compliance programs, human rights, sustainability)", "Data Protection (GDPR strategy, DPO experience, privacy programs)" ] }, { "@type": "Person", "name": "Philipp Brandt", "jobTitle": "Partner, Rechtsanwalt (German attorney), Specialist Lawyer for Intellectual Property Law", "url": "https://compound.law/en-DE/lawyers/philipp-brandt/", "sameAs": [ "https://www.linkedin.com/in/philipp-brandt-81b446a/" ], "knowsAbout": [ "Restructuring and insolvency law (crisis advice for management, protective shield and insolvency plan proceedings, insolvency administration)", "Intellectual property (trademarks, unfair competition, copyright, trade secrets, licence agreements)", "Data protection law (data breaches, regulatory fine proceedings, access and damages claims)", "Distribution and commercial law (distribution agreements, acquisition and sale of industrial plants)" ] } ], "address": { "@type": "PostalAddress", "addressLocality": "Berlin", "addressCountry": "DE" }, "areaServed": [ "Germany", "Austria", "Switzerland", "European Union", "United Kingdom", "United States", "Singapore" ], "availableLanguage": [ "de", "en" ], "serviceType": [ "AI law firm", "AI-native legal services", "legal counsel for start-ups and growth companies", "legal counsel for mid-sized companies and corporates", "Commercial Law", "Corporate Law", "Employment Law", "Regulatory & Compliance", "Intellectual Property", "Insolvency & Restructuring" ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "Compound Law services", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Commercial Contracts", "description": "Battle-tested contracts for your sales process", "serviceType": [ "enterprise contracts", "MSA", "DPA", "sales contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "International Employment", "description": "Compliant hiring across borders", "serviceType": [ "international employment", "hiring abroad", "employment contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "VSOP/ESOP Setup", "description": "Employee participation that actually works", "serviceType": [ "VSOP", "ESOP", "employee stock options", "equity incentives" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Funding Round Support", "description": "Clean legal for your next raise", "serviceType": [ "funding round", "term sheet", "SHA", "due diligence", "cap table" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Corporate Housekeeping", "description": "Get your legal house in order", "serviceType": [ "corporate governance", "board resolutions", "shareholder register" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Data Protection & Privacy", "description": "GDPR compliance that doesn't slow you down", "serviceType": [ "GDPR", "data protection", "privacy", "DPA", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI Act Compliance", "description": "Navigate EU AI regulation", "serviceType": [ "AI Act", "AI compliance", "AI governance", "EU AI regulation" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "IP & Competition", "description": "Protect and enforce what you've built", "serviceType": [ "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Fractional General Counsel", "description": "In-house legal without the full-time cost", "serviceType": [ "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "FinTech Compliance", "description": "Navigate financial regulation", "serviceType": [ "fintech compliance", "BaFin", "banking regulation", "AML", "KYC" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Legal Retainer", "description": "Predictable legal support when you need it", "serviceType": [ "legal retainer", "legal subscription", "ongoing legal support" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "M&A Preparation", "description": "Get ready for acquisition interest", "serviceType": [ "M&A preparation", "acquisition", "due diligence", "exit" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Restructuring & Insolvency", "description": "From the first liquidity check to the restructuring itself", "serviceType": [ "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } } ] }, "contactPoint": { "@type": "ContactPoint", "contactType": "sales", "email": "contact@compound.law", "availableLanguage": [ "English", "German" ], "areaServed": [ "DE", "AT", "CH", "EU", "GB", "US", "SG" ] }, "email": "contact@compound.law", "sameAs": [ "https://www.linkedin.com/company/compoundlawfirm", "https://x.com/CompoundLawFirm" ], "knowsAbout": [ "Commercial Contracts", "enterprise contracts", "MSA", "DPA", "sales contracts", "International Employment", "international employment", "hiring abroad", "employment contracts", "VSOP/ESOP Setup", "VSOP", "ESOP", "employee stock options", "equity incentives", "Funding Round Support", "funding round", "term sheet", "SHA", "due diligence", "cap table", "Corporate Housekeeping", "corporate governance", "board resolutions", "shareholder register", "Data Protection & Privacy", "GDPR", "data protection", "privacy", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR", "AI Act Compliance", "AI Act", "AI compliance", "AI governance", "EU AI regulation", "IP & Competition", "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance", "Fractional General Counsel", "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer", "FinTech Compliance", "fintech compliance", "BaFin", "banking regulation", "AML", "KYC", "Legal Retainer", "legal subscription", "ongoing legal support", "M&A Preparation", "M&A preparation", "acquisition", "exit", "Restructuring & Insolvency", "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ] }, { "@context": "https://schema.org", "@type": "Article", "headline": "Whistleblower System Setup", "description": "Implementation guide for whistleblower protection systems under HinSchG and EU Directive 2019/1937.", "image": "https://compound.law/assets/images/og-image-en.webp", "datePublished": "2026-03-29T00:00:00.000Z", "dateModified": "2026-03-29T00:00:00.000Z", "author": { "@type": "Person", "name": "Dr. Markus Dreißigacker", "image": "https://compound.law/assets/images/team/markusdreissigacker.webp" }, "publisher": { "@type": "Organization", "@id": "https://compound.law/#organization", "name": "Compound Law" }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://compound.law/en-DE/skills/compliance-whistleblower/" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://compound.law/en-DE/" }, { "@type": "ListItem", "position": 2, "name": "Skills", "item": "https://compound.law/en-DE/skills/" }, { "@type": "ListItem", "position": 3, "name": "Whistleblower System Setup", "item": "https://compound.law/en-DE/skills/compliance-whistleblower/" } ] } ] ```