Status Notification
The mandatory feedback that organisations must provide to a whistleblower within three months of acknowledging their report, informing them of any follow-up measures taken.
A status notification (Sachstandsmitteilung) is the statutory follow-up communication that the responsible person managing an internal reporting channel must send to the whistleblower within three months of acknowledging receipt of the report. Under § 17 of the German Whistleblower Protection Act (HinSchG), the notification must inform the reporter about the measures that have been taken or are planned in response to their report, to the extent permitted by law and the legitimate interests of the persons concerned.
The status notification is an important element of the reporter's procedural rights. It ensures that whistleblowers are not left in the dark about the outcome of their report and provides transparency about how the organisation handles compliance matters. The notification need not disclose confidential details of the investigation or the identities of persons involved, but it must provide a meaningful update rather than a generic acknowledgement.
In practice, a status notification might state that the report has been reviewed and found to be outside scope, that an internal investigation has been launched, that the matter has been referred to an external authority, or that the investigation has been concluded and corrective measures have been implemented. Organisations should document all status notifications carefully to demonstrate compliance with the HinSchG's procedural requirements.
Legal Basis
§ 17 Hinweisgeberschutzgesetz (HinSchG); Art. 11 EU Directive 2019/1937
Practical Example
An employee reports a suspected breach of data protection rules through the company's whistleblower system on 1 March. The compliance officer acknowledges receipt on 5 March (within the seven-day deadline). By 5 June – three months later – the compliance officer sends a status notification through the secure case management platform, informing the reporter that an internal investigation confirmed the breach, that the relevant process has been corrected, and that the data protection officer has been notified. The reporter is satisfied and the organisation has met its statutory obligations.