Whistleblowing

The status of whistleblowers in Germany, as in other EU member states, is primarily governed by European law. The relevant legislation is Directive (EU) 2019/1937 of the European Parliament and of the Council on the protection of persons reporting infringements of Union law (EU Whistleblower-Directive).

The German legislature has incorporated the EU-Whistleblower-Directive into German law by enacting the Whistleblower Protection Act (“Hinweisgeberschutzgesetz”) which – largely – entered into force on July 2, 2023.

If the Whistleblower Protection Act (hereinafter referred to as “HinSchG”) should meet specific concerns under European law, this will be pointed out separately in the following.

The only sector-agnostic legislation dealing with the protection of whistleblowers in India are:

• the Whistle Blowers Protection Act 2014 (Whistle Blower Protection Act), which enables any person (ie, a whistleblower) to report an act of corruption, wilful misuse of power or discretion, or a criminal offence by a public servant.  This includes all public servants, including ministers, members of parliament, the lower judiciary, regulatory authorities, and central and state government employees. A specified competent authority appointed under this legislation will conduct a discreet inquiry into the complaint and conceal the identity of the complainant and public servant; and
   
• the Companies Act 2013 (Companies Act), which mandates the incorporation of a whistleblower policy, but primarily only by listed companies.

To date, there are no specific laws dealing with the protection of whistleblowers applicable to private, unlisted companies or unincorporated entities and their employees. Employers are free to formulate and adopt a whistleblower policy to encourage employees (or any other person for that matter) to report matters without the risk of subsequent victimisation, discrimination or disadvantage, economic or otherwise. Accordingly, for private establishments, the whistleblowing regime remains largely discretionary and policy-driven. 

In addition to the laws listed above, while there are various disclosure obligations imposed on persons and entities (such as banks and listed companies) enabling early detection of fraud and wrongdoing, India has not yet adopted laws to improve the protection of whistleblowers across sectors or levels in the economy and establish adequate secure channels or mechanisms to enable whistleblowers to report without fear of disclosure, retaliation or victimisation.

The status of whistleblowers is governed by the Whistleblowing Act. The provisions of the Whistleblowing Act comply with European standards since legal requirements arising out of the EU Whistleblower Directive (EU WBD) are implemented therein.

In principle, companies that regularly employ 50 or more employees are obliged to set up an internal reporting system (section 12 (1), (2) HinSchG). For companies with between 50 and 249 employees, this obligation will only apply from 17 December 2023 (section 42 HinSchG).

For certain employers, particularly in the financial and insurance sectors or for data provision companies, the obligation to set up an internal reporting office applies irrespective of the number of employees as of the entry into force of the Act (section 12 (3) HinSchG).   

As per the Companies Act, the following types of companies are required to establish a vigil mechanism and adopt a “whistleblower policy” for directors, employees, stakeholders and any other individuals (such as auditors) to report concerns about unethical behaviour, actual or suspected fraud or violation of the company’s code of conduct or ethics policy:

• listed companies;
• companies that accept deposits from the public; and
• companies that have borrowed money from banks and public financial institutions totalling more than 500 million Indian rupees.

The requirement for listed companies to adopt a whistleblower policy also arises from the Securities and Exchange Board of India (Listing Obligations and Disclosure Requirements) Regulations 2015.

The abovementioned companies will be hereinafter referred to collectively as “Covered Companies”.

The vigil mechanism or whistleblower policy must provide adequate safeguards against the victimisation of persons who use it. The Companies Act also requires auditors to report an offence of fraud in the company by its officers or employees if they identify or note such instances during the performance of their duties.

Companies with 50 or more employees must establish an internal whistleblowing policy and an internal reporting channel. Companies with less than 50 employees can establish an internal whistleblowing policy and reporting channels at their own discretion or implement a group reporting channel.

Companies with 50-249 employees may develop a joint internal whistleblowing system and reporting channels. This applies to private entities registered and operating in Latvia. This does not extend to entities operating abroad, including group entities (eg, two companies operating in Latvia can establish one joint reporting channel).

Companies, operating in the finance sector, the area of prevention of money laundering, terrorism and proliferation financing, and the areas of transport security or environmental protection must also establish an internal whistleblowing system if they have less than 50 employees.

According to the explanatory memorandum of the Whistleblower Protection Act, it is legally permissible to implement an independent and confidential internal reporting office as a "third party" within the meaning of article 8(5) of the EU Whistleblower Directive at another group company (eg, parent company, sister company or subsidiary), which may also work for several independent companies in the group (section 14 (1) HinSchG). However, the European Commission has already announced in two statements during the legislative process that a group-wide whistleblower system does not meet the requirements of the EU Whistleblower Directive. The question of the compatibility of the regulation with EU law will only arise in practice at a later stage, provided that this question needs to be clarified in court. 

The Whistleblower Protection Act in line with the EU Directive further provides that several private employers with between 50 and 249 employees employed on a regular basis may commonly implement and operate an internal reporting office to receive notifications. However, the legal obligation to take action to remedy the violation and the corresponding duty to report back to the person making the report has to remain with the individual employer.   

Yes, this may be done. Various organisations in India have adopted a whistleblowing policy at the group level and set up a common hotline channel or speak-up portal to receive complaints of unlawful or unethical conduct and other wrongdoing within group companies.

There are no provisions in the Whistleblowing Act that would allow for the setting up of a whistleblowing procedure at a group level.

Based on the guidelines prepared by the State Chancellery (the contact point for whistleblowing in Latvia) and EU WBD, one single group whistleblowing procedure is only allowed if the local entity is not required to have an internal reporting channel (if they have less than 50 employees in Latvia) or if the company has a local internal reporting channel and a group whistleblowing procedure is established in addition to it.

If both whistleblowing procedures exist, employees are allowed to use either procedure. A group procedure on its own is not allowed if the local entity has 50 or more employees.

If there are no whistleblowing procedures in the company (ie, an internal reporting system is not implemented and operated), this constitutes an administrative offence punishable by a fine. This fine may amount to up to 20,000 EUR (section 40 (2) No. 2, (5) HinSchG).

At this point, it should be noted that there is a high incentive for employers to implement an internal reporting channel, since the external reporting channel is available to the whistleblower in any case. Consequently, if an internal reporting office were not implemented or operated, the whistleblower would be forced to report directly to the external reporting office. As a result, the employer would not be able to make internal corrections without the reported information leaving the company.

As per the Companies Act, for failure to adopt and implement a whistleblowing procedure, a Covered Company and every officer of that company who is responsible for such non-compliance may be punished with a fine of up to 10,000 rupees and, if non-compliance continues, a further fine of up to 1,000 rupees a day.

No, there are no sanctions provided in the law if there is no internal whistleblowing procedure or internal reporting channel. The absence of an internal whistleblowing procedure will likely promote the use of other reporting channels, such as:

• directly approaching the competent public authority that supervises the field or area where the breach occurred,
• approaching the State Chancellery as the contact point for whistleblowing,
• reporting publicly, if the requirements provided in the law are met.

To avoid risks associated with the use of external reporting channels, which may result in investigations and sanctions by public authorities, it is advisable to have an internal reporting channel and whistleblowing policy.

Although the implementation of a whistleblower system is based on a legal obligation, the works council only has to be involved under certain circumstances.

At first, the employer is, in principle, already obliged to inform the works council in good time and comprehensively about everything it requires to carry out its duties. This information requirement should enable the works council to review whether co-determination or participation rights exist or whether other tasks have to be carried out according to the German Works Constitution Act (BetrVG).

For instance, instructions concerning the orderly conduct of employees are subject to co-determination. These instructions are intended to ensure an undisturbed work process or to organise the way employees live and work together in the company.  If, in the course of the implementation of a whistleblower system, the already existing contractual obligations are extended or regulations regarding the specific reporting procedure are introduced (eg, in the form of a reporting obligation on the part of employees), the organisational behaviour would be affected and the works council must therefore be involved (section 87 (1) No. 1 BetrVG).

Furthermore, in the context of setting up an internal reporting channel, the Whistleblower Protection Act only stipulates that whistleblowers must be given the option of submitting a report to the whistleblowing system in text form or verbally. This could, of course, also be provided via digital channels - eg, via software- or web-based solutions. Should the introduction and use of such technical equipment in the relevant case allow the employer to monitor the behavior or performance of employees (eg, those who deal with the complaint), further co-determination rights of the works council according to section 87 (1) No. 6 BetrVG can be triggered.   

While Covered Companies may factor the suggestions of the unions, associations of officers or employees before framing a whistleblowing policy, employee representative bodies are not involved in the implementation of the vigil mechanism. The whistleblowing mechanism will be overseen by a Covered Company through its Audit Committee or Board of Directors, as may be relevant.

The Whistleblowing Act does not require the involvement of employee representative bodies in implementing the whistleblowing procedure. The involvement of employee representative bodies in the whistleblowing procedures is more consultative.

The Whistleblowing Act provides that trade unions and their associations, as employee representatives bodies: can provide support, including counselling, to whistleblowers to promote whistleblowing and whistleblower protection; provide support, including counselling, to its members concerning whistleblowing; and can apply to a public authority (body) or a court on behalf of a whistleblower who is a member of the trade union.

The Labour Act provides that employee representative bodies have the right to receive information from the employer and consult with the employer concerning the implementation of measures that affect or may affect the employment relationship. Therefore, it is advisable to inform or consult with employee representative bodies (if any) about the implementation of whistleblowing procedures to avoid the risk of administrative liability.

The Whistleblower Protection Act does not oblige the company itself to publish any information regarding the internal reporting office or the internal reporting channel implemented. However, the internally implemented reporting office must have clear and easily accessible information available on the external reporting procedure and relevant reporting procedures of European Union institutions, bodies or agencies (section 13 (2) HinSchG).

The current explanatory memorandum to the Whistleblower Protection Act also contains the more detailed, but not legally binding, reference that the information can be made available via a public website, company intranet or a bulletin board that is accessible to all employees. In this context, it is recommended that the company also refers to the internally implemented reporting office or the internal reporting channel in the same way. This helps to counteract the risk that potential whistleblowers will report primarily via the external reporting channel.

Furthermore, the German Supply Chain Due Diligence Act (LkSG) also provides for the implementation of complaint mechanisms so that the regulatory requirements of companies can also be met through a uniform reporting system. Within its scope of application, the LkSG also provides for the publication of procedural rules for such a reporting system in text form as well as for annual reporting obligations on what measures the company has taken as a result of complaints.

Details of the whistleblowing policy and the mechanism thereof will have to be disclosed by the Covered Company on its website as well as in the Board of Directors’ annual report filed with the competent regulatory authority.

The Whistleblowing Act does not allow companies to use publicity measures regarding a commenced, pending or finished whistleblowing case. The employer must ensure the confidentiality of information, not only to protect the interests of the whistleblower but also to protect the identity of the perpetrator.

Publicity measures are applied in cases of whistleblowing in public institutions. In such cases, the whistleblower can include in its report whether he or she consents to the results of the investigation being published, if a breach is established.

In principle, the Whistleblower Protection Act intentionally does not specify which persons or organisational units are best qualified to carry out the tasks of the internal reporting office or to manage the corresponding reporting channel. However, the internal reporting office may not be subject to any conflicts of interest and it also must be independent. The EU Whistleblower-Directive mentions, for instance, the head of the compliance department or the legal or data protection officer as possible internal reporting offices.

If, in addition to the (internal) persons responsible for receiving and processing internal reports, other (external) persons have to be involved in a supporting activity, this supporting activity is legally only permissible to the extent that is necessary for the supporting activity. This applies, for example, to IT service providers that provide technical support for reporting channels.

It is also legally permissible to appoint a third party to carry out the tasks of an internal reporting office, including the reporting channel (section 14 (1) HinSchG). Third parties may include lawyers, external consultants, trade union representatives or employee representatives.

However, engaging a third party does not relieve the employer of the obligation to take appropriate action to remedy a possible violation. In particular, for follow-up actions to check the validity of a report, there must be cooperation between the commissioned third party and the employer.

While the reporting channel may be outsourced, in respect of Covered Companies, the mechanism should be overseen by the Audit Committee or Board of Directors, as applicable.

The Whistleblowing Act allows employers to use third-party services for whistleblowing procedures. Therefore, the management of a reporting channel can be organised by outsourcing management service providers. On the other hand, such outsourcing cannot be used to implement group whistleblowing procedures (eg, to use a reporting channel established at a group level or in a related company).

The internal reporting office implemented by the employer is, initially, authorised to process personal data insofar as this is necessary for the fulfilment of its task under the Whistleblower Protection Act (10 HinSchG). The wide-ranging processing authority allows the personal data contained in the reports to be both received and analysed by the reporting office. In addition, new personal data may be recorded and further processed during the implementation of the follow-up measures.

The employer's obligation to protect the data collected in the course of the whistleblowing procedure is then directly based on the European General Data Protection Regulation (GDPR) and the German Federal Data Protection Act. This means, for instance, that data processing has to be limited to the extent necessary to fulfil the tasks of the internal and external reporting channel – data minimisation principle, (article 5 (1) lit. c) GDPR).

Finally, the processing of personal data is complemented by the confidentiality requirements of internal (and external) offices, (section 8 HinSchG).

As per the Whistle Blower Protection Act, notwithstanding any law in force, the competent authority will be required to conceal the identity of the complainant and the documents or information furnished by him for enquiry, unless so decided otherwise by the competent authority itself or it becomes necessary to reveal or produce the same under an order of a competent court. Any person who negligently or with a mala fide intention reveals the identity of a complainant will be punished with imprisonment for up to three years and also a fine of up to 50,000 rupees.

The Indian Companies Act does not impose any obligations on employers regarding data protection and the confidentiality of the complainant, witnesses, the inquiry process or the outcome of a whistleblower complaint, which is a crucial part of whistleblower protection. This will be subject to any such policy adopted by the company.

Under article 11 of the Whistleblowing Act, after a person’s application has been recognised as a whistleblower’s report, the personal data of the whistleblower must be pseudonymised. It is prohibited to disclose information that reveals the identity of a whistleblower without his or her consent, except for in cases where the personal data of the whistleblower and whistleblower’s report are required by persons who are reviewing the whistleblower’s report or examining an infringement case that is based on the whistleblower’s report, or if it is necessary for the protection of the whistleblower, his or her relatives, or related persons. The whistleblower must be informed about the disclosure of his or her identity, unless such disclosure would harm the infringement case based on the whistleblower’s report. Any person who has received a whistleblower’s report or performs any activities related to it must ensure adequate protection of the whistleblower’s personal data.

Furthermore, under the Whistleblowing Act, it is prohibited to disclose information that reveals the identity of a natural person or a legal person that has been reported on by the whistleblower. This information may only be provided to persons who require it for the review of the report, for examining an infringement case based on the whistleblower’s report, or for the protection of the whistleblower, his or her relatives, or related persons.

Other obligations on the protection of personal data related to the whistleblower procedure arise from the EU General Data Protection Regulation.

The reporting channels must be designed in such a way that only the persons responsible for receiving and processing the reports as well as the persons assisting them in fulfilling these tasks have access to the incoming reports. It must, therefore, be ensured that no unauthorised persons have access to the identity of the person making the report or to the report itself. This has implications for the technical design of the internal reporting channel.

Also, the persons entrusted with running the internal reporting office must indeed be independent in the exercise of their activities and the company must ensure that such persons have the necessary expertise. Therefore, smaller or medium-sized companies should especially assess whether it will be more efficient to assign an experienced external ombudsperson to receive and initially process incoming reports. However, the ombudsperson who takes the call in this case is a witness bound to tell the truth, even if this is, for example, a company lawyer.

According to the German Whistleblower Protection Act, the internal whistleblowing reporting office is not obliged by law to accept or process anonymous reports; however, they “shall” be processed.  Companies should therefore assess carefully whether they provide systems that enable anonymous reports, as this may increase the number of abusive reports and make enquiries impossible. On the other hand, some ISO standards require the receipt of anonymous reports. Therefore, should a company seek certification according to these ISO standards, the whistleblower procedure to be set up must allow for the processing of anonymous reports.

Key aspects that should be borne in mind while formulating a whistleblower policy or procedure are:

• a special or distinct committee or channel must be created for receiving and handling disclosures, giving the whistleblowing mechanism a fair, neutral and independent institutional framework;
• the reporting mechanism should be systematic, simple and straightforward to facilitate an early and easy disclosure of any wrongdoing. The procedure for disclosure must be easily comprehensible and should be accessible by all employees or individuals associated with the organisation;
• the policy should provide adequate assurances and comfort regarding confidentiality of the identity of the whistleblower, continuity of association with the organisation, and the steps that the organisation will take to ensure that the whistleblower is not victimised, discriminated against or adversely impacted in any manner pursuant to the disclosure (including facilitating legal assistance at the organisation’s cost, if necessary);
• the policy should ensure that no action will be taken against whistleblowers who make disclosures in good faith and even allow for anonymous reporting; and
• identification of what matters may be reported under the policy, the persons against whom such matters can be reported, the process that should be followed by the organisation, remedial measures, details of persons with whom reported information will be shared, and an overview of the mechanism for protecting whistleblowers and persons cooperating with an investigation, etc.  

The whistleblowing procedure should be established to avoid potential conflicts of interest. Usually, there are one or several employees responsible for the review of whistleblowing reports, or a combination of internal and third-party whistleblowing is used. Companies should avoid situations where, for example, responsible persons might encounter a conflict of interest upon review of whistleblowing reports (ie, if there is no alternative reporting channel and employees would have to report to the perpetrator, who is also the responsible person in the company). In any case, responsible persons who review or analyse whistleblowing reports should be someone with a good reputation and trust in the company.

The principle of data minimisation and confidentiality should be observed throughout the whole procedure.

The Whistleblower Protection Act´s  material scope of application goes beyond European legal requirements. It extends the material scope of application to all violations that are subject to punishment (section 2 (1) No. 1 HinSchG). Additionally, violations subject to fines are included insofar as the violated regulation serves to protect life, body, health or the rights of employees or their representative bodies (section 2 (1) No. 2 HinSchG). The last alternative covers not only regulations that directly serve occupational health and safety or health protection, but also related notification and documentation requirements, for example under the Minimum Wage Act. Thus, as a result, section 2 (2) No. 2 HinSchG covers the majority of administrative offences in the context of employment.

Finally, the Whistleblower Protection Act also provides for a list of infringements that predominantly correspond to the relevant areas of law according to the recitals of the EU Whistleblower Directive.

As per the Whistle Blower Protection Act, a whistleblower may make a complaint or disclosure relating to:

• the committing of or an attempt to commit an offence under the Prevention of Corruption Act 1988 by a public servant;
• wilful misuse of power or wilful misuse of discretion by which demonstrable loss is caused to the government or demonstrable wrongful gain accrues to the public servant or any third party; and
• the committing of or an attempt to commit a criminal offence by a public servant.

The Companies Act only states that stakeholders of a company may report “genuine concerns” under the vigil mechanism. While the definition of “concerns” has not been provided for under the Companies Act, it would be a prudent assumption that it covers instances of suspected fraud and non-compliance with applicable laws, rules and procedures or any other wrongdoing that would adversely affect the organisation or stakeholders at large (financially or otherwise).

The Whistleblowing Act allows the reporting of any violations related to the public interest, while specific attention is drawn to the following areas in the law:

• inaction, negligence, abuse of office or other unlawful acts of public officials;
• corruption, violations of the rules on financing political organisations (parties) and their associations and restrictions on pre-election campaigning;
• embezzlement of public funds or property;
• tax evasion;
• public health threats;
• threat to food safety;
• threat to building or construction safety;
• threat to environmental safety, including actions affecting climate change;
• radiation protection and nuclear safety;
• threat to occupational safety;
• threat to public order;
• violation of human rights;
• infringements in the field of public procurement and public-private partnerships;
• infringements in the financial and capital market sector, including fraud and other illegal activities affecting the financial interests of the European Union;
• money laundering and the prevention of the financing of terrorism and proliferation;
• infringements of competition law and business support rules;
• infringements in the field of the provision of goods and services, including safety and compliance;
• infringements in the field of transport safety;
• infringements in the field of the internal market;
• infringements in the field of animal welfare;
• consumer protection; and
• protection of privacy and personal data and security of network and information systems.

The Whistleblower Protection Act itself does not distinguish between different sectors regarding the internal reporting process. However, it contains an enumerative list of regulations from other statutes that take precedence over the Whistleblower Protection Act for the reporting of information on violations; these regulations are therefore lex specialis compared to the Whistleblower Protection Act (section 4 (1) HinSchG). Priority special provisions are, among others, regulated by the Money Laundering Act, the Banking Act, the Insurance Supervision Act and the Stock Exchange Act.    

The Whistle Blowers Act of 2014 targets public servants and is intended to prevent corruption, misappropriation of assets and misuse of power in the public sector. Further, provided a whistleblower makes full and true disclosure of all material facts, the settlement commissions established under the Income Tax Act 1961 and the Goods and Services Tax Act 2016 have the power to grant them immunity from those statutory penalties. Similarly, the Competition Commission of India established under the Competition Act 2002 possesses the power to award a reduced penalty to an informant who is a part of an anticompetitive cartel and makes a full, true and vital disclosure.  The Securities Exchange Board of India also rewards whistleblowers who are themselves guilty of violating securities law by granting anonymity and a pardon for their complete cooperation. Lastly, the Reserve Bank of India (RBI) prescribes for whistleblowing mechanisms to be adopted by various banks and financial institutions.

Latvian law does not provide for special whistleblowing procedures. Whistleblowing is subject to special procedures only in cases where such special procedures are established specifically in law.

A whistleblower is a natural person who, in the context of his or her professional activity or in the preliminary stages of professional activity, has obtained information about violations and reports or discloses it to the – internal or external – reporting offices provided for under the Whistleblower Protection Act (section 1 (1) HinSchG).

The Whistleblower Protection Act also applies to the protection of persons who are subject to a report or disclosure, as well as other persons who are affected by a report or disclosure, (section 1 (2) HinSchG).

As per the Whistle Blower Protection Act, a whistleblower is referred to as a “complainant” and it is defined as any person who makes a complaint relating to:

• the committing of or an attempt to commit an offence by a public servant under the Prevention of Corruption Act 1988;
• wilful misuse of power or wilful misuse of discretion by which demonstrable loss is caused to the government or demonstrable wrongful gain accrues to the public servant or any third party; or
• the committing of or an attempt to commit  a criminal offence by a public servant.

The Companies Act does not define “whistleblower” but it is generally understood to be a person who has first-hand information of fraud or other kinds of misbehaviour or unethical activity or wrongdoing within an organisation and discloses the same in the overall interest of the organisation and all its stakeholders.

The Whistleblowing Act defines a whistleblower as a natural person who provides information about an alleged infringement that may harm the public interest, if this person believes the information to be true and the information was obtained in the course of or during the performance of his or her duties or the establishment of a legal relationship related to the performance of his or her duties, and to whom adverse consequences could arise from the provision of this information.

Whistleblowers may be employees, but also, for instance, self-employed persons, volunteers, members of corporate bodies or employees of suppliers. In addition to persons who obtain knowledge in advance, such as in a job interview or during pre-contractual negotiations, the scope of protection also includes those for whom the employment or service relationship has been terminated. As a result, the status of a whistleblower is not dependent on formal criteria such as type of employment.

There are no limitations or qualifications on who can be a whistleblower. Any person with knowledge of a breach or wrongdoing may report it and qualify as a whistleblower.

Only natural persons, if they comply with the definition of whistleblower as provided in the Whistleblowing Act (please see question 12).

To be qualified as a whistleblower, the person providing the information must have obtained the information in the context of his or her professional activity or in the preliminary stages of professional activity. Information about violations falls within the substantive scope of the Act only if it relates to the employing entity or another entity with which the whistleblower is or has been in professional contact.

Not applicable.

Yes, certain preconditions need to be met:

• a person must submit a whistleblower’s report;
• the whistleblower's report must contain information regarding a possible infringement detrimental to the public interest;
• the information provided in the report must be obtained during the performance of work duties, or during the process of establishment of work relationship, including traineeship or other types of legal relations related to professional activity;
• the whistleblower’s report cannot be anonymous.

Finally, this whistleblower’s report has to be recognised as such, otherwise the person would lose whistleblower status.

The Whistleblower Protection Act does not state that the employer must set up reporting channels in such a way that anonymous reports are admissible (section 16 (1) HinSchG). Also, external reporting offices do not have to process anonymous reports (section 27 (1) HinSchG). According to the Whistleblower Protection Act, however, anonymous reports “shall” be processed by the internal and external reporting offices. Against this background, employers are entirely free to choose whether to provide systems that allow for the submission and processing of anonymous reports or not.

As per the Whistle Blower Protection Act, a complaint is only acted upon by the competent authority if the complainant discloses their identity in the complaint. Complainants providing false identities or anonymous complaints are not recognised.

However, there is no embargo under the Companies Act against anonymous reporting concerning the activities of companies. The Audit Committee or Board of Directors may independently assess the contents of the anonymous complaint and take necessary action or attempt to reach out to the whistleblower for further information and cooperation. Leading business organisations in India allow anonymous complaints and have put in place processes to safeguard the identity of whistleblowers, and ensure the confidentiality of the investigation process.

The Whistleblowing Act does not provide such an option, but the company may accept anonymous alerts at its own discretion. However, it should be borne in mind that whistleblower protection is not possible in these cases. If the whistleblower is subsequently identified, he or she is covered by statutory protection, including against adverse consequences.

In principle, the whistleblowers do not have to be direct witnesses to a violation. However, they must have obtained information about violations in connection with or before their professional activities. Violation information is defined as a reasonable suspicion or knowledge of actual or potential breaches and attempts to conceal such breaches that have occurred or are very likely to occur (section 3 (3) HinSchG). However, only whistleblowers acting in good faith are protected from any discriminatory measures as a result of their report.

There is no such requirement prescribed under applicable laws and the information provided by whistleblowers may be independently assessed and acted upon, notwithstanding the fact that the whistleblower was not a first-hand witness to the reported act.

The Whistleblowing Act is silent on this issue; theoretically, it is not prohibited to whistle-blow about a violation to which the person has not been a direct witness, but in any case information about these violations has to be obtained during the performance of work duties or during an internship.

The whistleblower procedure requires – in its broad outlines – that the personal and material scope of the Whistleblower Protection Act is applicable. Assuming this, the whistleblower must have obtained information about violations in connection with his or her professional activities or in advance of professional activities. In a further step, the whistleblower must report or disclose these violations to the internal and external reporting bodies responsible. The Reporting Office will issue an acknowledgement of receipt to the person making the report within seven days. Within three months of the acknowledgement of receipt, feedback will be provided to the whistleblower on planned and already taken follow-up measures and their reasoning. This information will be documented in compliance with the principle of confidentiality. This documentation will be deleted two years after the conclusion of the proceedings.

For Covered Companies, the terms and conditions, as well as the whistleblowing procedure, will be subject to the policy adopted by them. As regards the procedure under the Whistle Blower Protection Act, upon receipt of a complaint the competent authority should conceal the identity of the complainant, or the public servant in the first instance, and make a discreet inquiry, as may be appropriate , to ascertain whether there is any basis for proceeding further to investigate the disclosure. If the competent authority, either as a result of the discreet inquiry, or on the basis of the disclosure itself without any inquiry, believes that the disclosure needs to be investigated, it shall seek comments, explanation or reports from the Head of the Department of the organisation or authority, board or corporation, or office concerned. Pursuant to this, if the competent authority believes that such comments or explanations or report reveals either willful misuse of power or willful misuse of discretion or substantiates allegations of corruption, it shall recommend that the public authority take appropriate measures against the public servant, which may range from corrective action to initiation of criminal proceedings against the public servant.

There are no terms provided in the law for the submission of a whistleblower’s report. Nevertheless, the Whistleblowing Act contains a list of information that should be provided in whistleblowers’ reports. These may include a description of the violation and if information about the violation was provided before, as well as reporting channels for whistleblowers’ reports and the procedure for how whistleblowers’ reports should be reviewed.

There is no legally binding hierarchy between internal and external reporting channels. Therefore, the whistleblower has, in principle, the right to choose whether to report the violations externally or internally. However, in cases where effective internal action can be taken against violations, whistleblowers are to give preference to reporting to an internal reporting office. If an internally reported violation is not remedied, the whistleblower making the report is free to contact an external reporting office (section 7 (1) HinSchG).

This would be subject to the policy and reporting channels prescribed under the whistleblowing policy.

No, there is no hierarchy between the different reporting channels, but there are specific pre-conditions when whistleblowing may be done publicly: mainly, in cases when a whistleblower’s report has not been reviewed or there are reasons to believe that all other reporting channels would not be effective.

Once the reporting process at the internal reporting office is completed, the internal reporting office can take various follow-up actions. In addition to internal investigations, the process can also be handed over to a competent authority for further investigation (section 18 No. 4 HinSchG).

There is no blanket requirement for an employer to inform external authorities upon receipt of disclosure from a whistleblower. However, depending on the nature of the disclosure, its gravity and impact, employers may be required to report the same to certain authorities, including but not limited to the Securities Exchange Board of India, RBI or relevant stock exchanges (in the case of listed companies) or even the Serious Fraud Investigation Office.

No. The only exception is if during the investigation of a whistleblower’s report it was discovered that a crime had been committed, then the company must inform the respective state authorities about this fact.

As a principle, the disclosure of inaccurate information about violations is prohibited under the Whistleblower Protection Act (section 32 (2) HinSchG). A whistleblower may, however, not be sanctioned if the facts, after being verified, are merely not confirmed or do not constitute a violation in the final analysis. If the information disclosed was incorrect, the following legal consequences will apply:

On the one hand, the whistleblower must compensate for any damage resulting from intentional or grossly negligent reporting or disclosure of incorrect information (section 38 HinSchG). The whistleblower's liability for damages is based on the fact that a false report or disclosure has far-reaching consequences for the person affected or accused. The effects may no longer be completely reversible. According to the Whistleblower Protection Act, claims for damages resulting from merely negligent incorrect reporting should not arise. Besides, only whistleblowers acting in good faith are protected from further repercussions.

On the other hand, the whistleblower acts improperly if he intentionally discloses incorrect information in violation of section 32 (2) of the Whistleblower Protection Act (section 40 (1) HinSchG). This administrative offence may be punished with a fine of up to 20,000 EUR (section 40 (5) HinSchG).

There are no sanctions prescribed under the Companies Act if the facts, once verified, are not confirmed or do not constitute an infringement.

However, as per the Whistle Blower Protection Act, only persons who make any disclosure with a mala fide intention or knowing that it was incorrect or false or misleading, shall be punishable with imprisonment for up to two years and a fine of up to 30,000 rupees.

An administrative fine may be imposed for knowingly making false statements using a whistleblowing mechanism or making them publicly. The amount of the fine ranges from 30 EUR up to 700 EUR.

Retaliation against the whistleblower is prohibited under the Whistleblower Protection Act. This also applies to threats and attempts at retaliation (section 36 (1) HinSchG). In addition, it is prohibited to interfere or attempt to interfere with reports or communications between a whistleblower and the reporting office (section 7 (2) HinSchG).

If the whistleblower was nevertheless obstructed, the following legal consequences will apply: if a retaliation occurs, the person causing the violation must compensate the whistleblower for the resulting damage. However, this does not entitle the whistleblower to an employment relationship, a vocational training relationship, any other contractual relationship, or career advancement.

In addition, taking an illegal reprisal or interfering with the communications between the whistleblower and the reporting office constitutes an administrative offence, which can be punished with a fine of up to 50,000 EUR (section 40 (2) No. 3, (5) HinSchG).

Protection is only offered to whistleblowers under the Whistle Blower Protection Act after they report fraudulent activity or non-compliance, and not before. Accordingly, there is a lacuna in the Whistle Blower Protection Act (as well as the Companies Act) as far as they fail to prescribe sanctions to those who obstruct an individual from reporting fraudulent activity or non-compliance.

An administrative fine will be imposed if the whistleblower, his or her relative or a related person suffers adverse consequences. Also, there is an administrative liability for obstructing the whistleblowing proceedings. The amount of the fines may range from 15 EUR to 700 EUR for natural persons – and between 35 EUR and 10,000 EUR for legal persons.

To obtain protection, the whistleblower generally has to contact the responsible internal or external reporting offices. Disclosure of information about violations directly to the public is subject to strict conditions. This is only permissible, for example, if there is a risk of irreversible damage or in cases where the external reporting agency has not taken the required measures (section 32 (1) HinSchG).

The whistleblower providing the information must further act in good faith (ie, must have reasonable cause to believe, at the time of the report or disclosure that the information disclosed is true, and the information relates to violations that fall within the material scope of the Whistleblower Protection Act (section 33 (1) No. 2 and 3 HinSchG).

As per the Whistle Blower Protection Act, if any person believes they are being victimised because they filed a complaint, made disclosures or rendered assistance in an inquiry under the Act, they may apply to the competent authority designated under the Whistle Blower Protection Act and seek protection.

The authority may take such action, as appropriate, and give suitable directions to the concerned public servant or the public authority (including the jurisdictional police to protect such person from being victimised or to avoid such victimisation. However, it is important to note that the Whistle Blower Protection Act does not clarify or lay down any standards or definitions for “victimisation”, and the same is subject to the assessment of the competent authority.

The process to be followed by whistleblowers in respect of Covered Companies or other establishments is subject to the policy adopted by such establishments.

The whistleblower must lodge a non-anonymous whistleblower’s report. If the report is not recognised as the whistleblower’s report at a later date, the protection is forfeited.

The most fundamental part of the protection is the prohibition of retaliation against the whistleblower. Therefore, the reporting or disclosing of information may not result in unjustified disadvantages such as disciplinary measures, dismissal or other discrimination against the person providing the information. In Addition, the Whistleblower Protection Act still contains a reversal of the burden of proof if the whistleblower suffers a disadvantage in connection with their professional activities. However, it is presumed that the disadvantage is a reprisal for the tip-off only if the whistleblower also asserts this themself. It should be noted, however, that the reversal of the burden of proof in favour of the whistleblower will only apply in labour court disputes and not in fining proceedings.

Furthermore, the Whistleblower Protection Act contains an exclusion of responsibility. Thus, a whistleblower cannot be made legally responsible for obtaining or accessing information that he or she has reported or disclosed, unless the obtaining or accessing of the information and the procurement or access as such constitutes an independent criminal offence (section 35 (1) HinSchG). In addition, a whistleblower does not violate any disclosure restrictions and may not be held legally responsible for the disclosure of information made in a report or disclosure if he or she had reasonable cause to believe that the disclosure of the information was necessary to detect a violation.

While the Whistle Blower Protection Act does not define the specific scope of protection that may be provided to the complainant, the competent authority has a wide range of powers to take such action, as it deems fit, depending on the facts and circumstances of each case, and may give suitable directions to the concerned public servant or the public authority (including the jurisdictional police) to protect the whistleblower or witnesses.

However, the competent authority is not empowered to impose civil or criminal sanctions against perpetrators for any sort of physical harassment or attacks on whistleblowers.

The following protection is provided according to the law:

• protection of identity;
• protection against adverse effects resulting from whistleblowing; and
• exemption from legal liability.

At first, the person providing the information may not be subject to legal liability for obtaining or accessing information that he or she has reported or disclosed. This does not apply if the procurement or access as such constitutes an independent criminal offence (section 35 (1) HinSchG).

In addition, whistleblowers are protected by a comprehensive prohibition of retaliation. Therefore, any adverse consequences caused by disclosure are prohibited. These include, for example, dismissal, disciplinary measures or salary reductions (section 36 (1) HinSchG). Measures that violate the prohibition are void under section 134 of the Civil Code. The prohibition of retaliation is rounded off by a reversal of the burden of proof. According to this, it is presumed that a disadvantage that occurs after a disclosure is retaliation. As a consequence, the person who has disadvantaged the whistleblower has to prove that it is factually justified and was not based on the report or the disclosure if the whistleblower also asserts the disadvantage himself (section 36 (2) HinSchG).

In addition, the whistleblower is entitled to damages in the event of a violation (section 37(1) HinSchG).

The Whistle Blower Protection Act and Companies Act do not prescribe any support measures for the status of whistleblowers.

The following support measures are provided:

• legal aid provided by the state;
• exemption from the payment of court costs in civil proceedings and the payment of a state fee in administrative proceedings before a court;
• interim relief in civil proceedings and administrative proceedings before the courts;
• appropriate compensation for damages for loss or personal injury, including moral injury;
• advice on the protection of their rights; and
• exemption from the obligation to comply with the out-of-court procedure in administrative proceedings.

If a whistleblower abusively reports a violation, this may initially give rise to criminal liability. Possible criminal offences are pretending to have committed a criminal offence (section 145d of the Criminal Code), false suspicion (section 164 of the Criminal Code) or offences of honour (section 185 et seq of the Criminal Code).

The whistleblower providing the abusive information also must compensate for any damage resulting from intentional or grossly negligent reporting or disclosure of incorrect information (section 38 HinSchG). Furthermore, there may be competing claims for damages, for example under section 823 (2) of the Civil Code in conjunction with a protective law.

Moreover, the whistleblower commits an administrative offence if he or she intentionally discloses inaccurate information. This may be punished with a fine of up to 20,000 EUR (section 40 (1), (6) HinSchG).

In principle, the whistleblower is free to decide whether he or she reports a violation through the internal or the external reporting channel (section 7 (1) HinSchG). However, if a violation is disclosed to the public directly (ie, without first using internal or external reporting channels and without there being an exceptional circumstance for this), the whistleblower is generally not subject to the protection of sections 35 to 37 of the Whistleblower Protection Act. Only in narrow exceptions is the whistleblower still protected, for example, if there is a danger of irreversible damage or comparable circumstances may represent an immediate or obvious threat to the public interest.

Apart from the risk of retaliation and adverse action in terms of withholding or denial of benefits, termination of the engagement, etc, historically, whistleblowers in India have also faced the risk of death and physical injury, especially in matters that involve public institutions related to scams and frauds. It may not be possible to identify and list all the risks that a whistleblower may be subjected to, as it will depend on the nature of the activity reported by him, the persons involved in such activity, the gravity, magnitude and impact of the disclosure and the position of the whistleblower within the organisation.

There is a risk of administrative liability for a knowingly false whistleblower’s report. Also, if there is non-compliance with the procedure, a whistleblower’s report may not be recognised officially, resulting in a risk that protection and supportive measures would not apply to the would-be whistleblower.