Understand what the EU Whistleblower Directive requires
The EU Whistleblower Directive (EU) 2019/1937, in Germany also known as the Whistleblower Protection Act (Hinweisgeberschutzgesetz), protects people who report breaches in connection with their professional activity. A whistleblower is a person who reports such a breach. A case is a single report. The directive protects whistleblowers from retaliation. The whistleblower feature in Kenjo helps you implement these requirements.
Note: This section explains the basics and isn't legal advice. It gives an interpretation of certain aspects of the directive. Consult legal counsel for your specific case.
Check whether your company is affected
If your company reaches the size set by law, you must set up an internal reporting office. An internal reporting office is the unit in your company that receives and handles reports from whistleblowers. The law defines from which size and from when the obligation applies. Public bodies such as municipalities, authorities, and public organizations are also obliged. Check the exact limits for your company with legal counsel.
Understand which reporting channels exist
The whistleblower chooses where to report:
Internal reporting channels: Employees such as the legal department, external lawyers, or ombudspersons are responsible.
External reporting offices at the Federal Ministry of Justice.
Other reporting offices at the competent authorities.
Meet the requirements for the reporting channel
A reporting channel must meet these requirements:
At the whistleblower's request, a personal exchange is possible instead of written or oral communication.
All people who have professional contact with the company (employees, business partners, employees of business partners) may report.
You must inform people about the reporting option, for example with a link on the company website.
Confidentiality and data security must be protected.
Understand what can be reported
You can report, for example, criminal law and certain administrative offenses, money laundering and terrorism financing, product safety, consumer protection, data protection and personal data, and network and information security.
Meet the deadlines
The law sets deadlines for handling cases. You find the exact deadlines in the law. The responsible people are the employees who handle a case.
Obligation | What you have to do |
Confirmation of receipt | The responsible people confirm receipt of the case to the whistleblower within the legal deadline. |
Feedback | The whistleblower receives feedback on their case within the legal deadline. |
Documentation | All reports and follow-up actions are documented in line with the GDPR. |
If you turn on the automation Send a first response automatically, Kenjo confirms receipt of a case automatically.
Observe further obligations
Besides the reporting channel, further obligations apply:
Reversal of the burden of proof: In the case of a dismissal, you must prove that it isn't related to a reported concern.
The works council has a right of co-determination in dismissals.
Set up an internal whistleblower policy.
Avoid penalties
Violations can result in fines. These include a missing internal reporting channel, obstructing reports, retaliation against whistleblowers, and breaching the confidentiality of the whistleblower's identity.
Implement the requirements
This is how you implement the requirements:
Set up an internal reporting office, for example with the whistleblower feature in Kenjo.
Define the group of authorized people.
Define processes for receiving, handling, and following up on reports.
Inform your employees about the whistleblower system and link the portal on your website.
Frequently asked questions
Does my company have to set up an internal reporting office?
If your company reaches the size set by law, yes. Public bodies are also obliged. The law defines the exact limit, so check it with legal counsel.
Can I set up an internal reporting channel with Kenjo?
Yes. With the whistleblower feature, you give your employees a portal for reports and handle the cases in the whistleblower area in Kenjo.
Does Kenjo confirm receipt of a case automatically?
Yes, if you turn on the automation Send a first response automatically. If you leave it off, the responsible people confirm receipt themselves.
Can business partners also report a case?
Yes. All people who have professional contact with your company may report. The portal doesn't require a Kenjo account.