Three-month deadline
The three-month deadline requires the internal reporting office to provide the whistleblower with feedback on the follow-up measures planned or already taken, and the reasons for them, no later than three months after the acknowledgement of receipt.
The three-month deadline is a key procedural requirement of the German Whistleblower Protection Act (Hinweisgeberschutzgesetz, HinSchG) and defines the period within which the reporting office must provide feedback to the whistleblower. Under Section 17 (2) HinSchG, the deadline runs from the confirmation that the report has been received (the acknowledgement of receipt issued within the seven-day deadline). If no acknowledgement of receipt was sent, the deadline begins at the latest seven days after the report was received. The feedback covers the follow-up measures planned and already taken, together with the reasons for them.
The deadline serves to protect and inform the whistleblower: it should allow them to see that their report is being taken seriously and is being processed, without jeopardising internal investigations. Feedback may therefore only be given to the extent that it does not impair internal enquiries or investigations and does not affect the rights of the persons named in the report (Section 17 (2) sentence 2 HinSchG). In practice, feedback may also simply state that the procedure is still ongoing and which steps have been taken so far.
The three-month deadline must be distinguished from the seven-day deadline for the acknowledgement of receipt and must be met independently of it. A breach of the feedback obligation can be treated as an obstruction or a violation of the reporting office's operating duties and may result in fines under Section 40 HinSchG. Employers should therefore document and monitor deadlines systematically, for example through a case management system with automatic reminders, to ensure timely feedback.
Legal Basis
Section 17 (2) HinSchG; Section 40 HinSchG; Art. 11 (2) EU Whistleblower Directive (Directive (EU) 2019/1937)
Practical Example
At a mid-sized company, a report about possible corruption in procurement is received on 3 March. The internal reporting office sends the acknowledgement of receipt on 7 March, which starts the three-month deadline. The compliance officer sets a reminder in the case management system for 5 June. Since the internal investigation is still ongoing in early June, she informs the whistleblower in good time that the matter is being examined, that external counsel has been engaged, and that the case is expected to close within four weeks - without disclosing investigation details, so as not to jeopardise the ongoing enquiry.