Case handling

Case handling describes the entire processing workflow that an internal or external reporting channel goes through for every incoming report under the German Whistleblower Protection Act (HinSchG). It begins when a report is received via one of the statutory reporting channels (oral, written, or, on request, an in-person meeting) and ends with the documented closure of the procedure. Section 17 HinSchG sets out the procedure for internal reporting channels and thereby provides the framework for legally compliant case handling.

The workflow is structured by binding deadlines: within seven days of receipt, the reporting channel must acknowledge receipt of the report to the whistleblower (Section 17(1) no. 1 HinSchG). It then checks whether the reported breach falls within the material scope, consults the whistleblower where necessary, and assesses the validity of the report. On this basis it takes appropriate follow-up measures, such as an internal investigation, referral to a competent authority, or closure of the procedure for lack of evidence. No later than three months after the acknowledgement, the whistleblower must receive feedback on the follow-up measures planned or already taken and the reasons for them (Section 17(2) HinSchG).

Throughout case handling the confidentiality requirement applies (Section 8 HinSchG): the identity of the whistleblower, the person concerned and any other named persons must be protected, and only the competent, expert and independent staff entrusted with processing may access the case. Every step is subject to the documentation obligation (Section 11 HinSchG); records must generally be retained for three years after the procedure is closed. Careful, timely and confidential case handling is therefore not only a compliance duty but also the foundation of trust in the whistleblowing system.