Overview
This article explains the key requirements of the German Whistleblower Protection Act (HinSchG) and how to provide a reporting channel with the Tacto whistleblower / complaints system.
Relevant for companies with generally at least 50 employees. To use the Tacto function, the Supplier Portal must be enabled for your Workspace.
Related articles: Differences between LkSG and HinSchG and LkSG complaints procedure.
Note: This article summarizes the legal requirements and does not replace legal advice.
Protected persons
The HinSchG transposes the EU Whistleblower Directive into German law. It protects persons who have obtained information about violations in connection with their professional activities, or before taking up such activities, and report it (Section 1 HinSchG), for example:
Employees, including former employees, applicants, interns and temporary workers
Self-employed persons, service providers, contractors, Suppliers and their employees
Shareholders and members of management bodies
Persons who are the subject of a report or are affected by it are also protected. Retaliation against reporting persons is prohibited.
Covered violations
The material scope (Section 2 HinSchG) includes in particular:
Violations that are subject to criminal penalties
Violations subject to fines, insofar as the violated provision protects life, limb or health or the rights of employees or their representative bodies
Violations of federal, state and EU legislation in certain areas, e.g. money laundering, product safety, environmental protection, data protection, tax and competition law
Obligated companies
Employers with generally at least 50 employees must set up and operate an internal reporting office (Section 12 HinSchG). The transition periods have expired, and the obligation applies in full.
Certain companies, e.g. in the financial sector, are obligated regardless of their size.
Companies with 50 to 249 employees can operate a joint reporting office (Section 14 (2) HinSchG). Follow-up measures and feedback remain with the individual company.
You can also commission a third party with the tasks of the reporting office. The obligation to remedy violations remains with you (Section 14 (1) HinSchG).
If there is no internal reporting office, a fine of up to EUR 20,000 may be imposed. Obstructing reports, taking retaliatory measures or breaching confidentiality can lead to fines of up to EUR 50,000 (Section 40 HinSchG).
Requirements for the internal reporting office
The reporting channel must be open at least to employees and temporary workers. It can additionally be opened to other persons in professional contact with your company (Section 16 (1) HinSchG).
Reports must be possible orally and in text form; on request, a personal meeting must be offered (Section 16 (3) HinSchG).
Only the responsible persons may access reports; the identity of the reporting person must be kept confidential (Sections 8, 16 (2) HinSchG).
Anonymous reports should be processed. There is no obligation to technically enable anonymous reports.
Receipt of a report must be acknowledged within 7 days at the latest, and feedback on follow-up measures must be given within 3 months (Section 17 HinSchG).
Documentation and retention
All incoming reports must be documented in a permanently retrievable manner while maintaining confidentiality (Section 11 HinSchG). Confidentiality does not mean anonymity.
The documentation is deleted three years after the procedure has been completed. It may be retained longer as long as this is necessary and proportionate to meet legal requirements.
Implementation in Tacto: whistleblower / complaints system
The Whistleblower / complaints system is part of the Supplier Portal. It is a public page at your portal address (suffix /complaints) and sits outside the Tacto App. Reporting persons do not need an account.
On the page Complaint procedure of [your company], reporting persons find an introduction, the rules of procedure under Section 8 LkSG with the contact details of your responsible person, and the File a Complaint button.
In the form, they select a category (required), describe the situation (required) and can optionally add the location, the parties involved, further information and supporting documents.
In the standard configuration, 11 categories are available, e.g. Human Rights Violations, Environmental Violations and Code of Conduct Violations. Your categories may differ.
Providing an email address is optional, so reports can also be submitted anonymously.
After clicking Send complaint, the reporting person sees a confirmation page. There is no automatic confirmation email and no case number.
Incoming reports are sent by email to the address stored during setup. The Tacto App has no inbox for reports, and reports are not automatically linked to Suppliers or to your risk analysis.
Note: Your responsible person handles the acknowledgement of receipt, the feedback and all further processing, e.g. by email, provided the reporting person has entered an email address.
The form covers reports in text form. Provide the option for oral reports additionally required under Section 16 (3) HinSchG, e.g. via the phone number of the responsible person.
How to set up the whistleblower / complaints system
1. Have the Supplier Portal enabled
The whistleblower / complaints system requires the Supplier Portal. If it is not enabled for your Workspace, the settings show the message Supplier Portal not enabled. In this case, contact your Tacto Key Account Manager.
2. Appoint a responsible person
Appoint the person who receives and handles reports, with the following details:
Name
Email address
Position
Phone number
Address
These details are stored during setup together with your Tacto contact and are shown in the rules of procedure.
The responsible person must be able to act independently and have the necessary expertise; other duties must not lead to conflicts of interest (Section 15 HinSchG).
3. Enable the whistleblower / complaints system
Open Settings → Workspace → Supplier Portal.
Turn on the Whistleblower / complaints system switch. It is disabled by default.
Check the page via Preview portal → Open and add the suffix /complaints.
Without permission to configure the portal, you only see the status Enabled or Disabled instead of the switch.
4. Make access known
Copy your portal address under Portal address with Copy address and add /complaints. Publish the link, for example:
Clearly visible on your public company website and on your intranet
In documents you regularly exchange with direct Suppliers, e.g. in Supplier Requests
In case of increased risks as a preventive measure, e.g. in trainings and information material for Suppliers