🇦🇹 Austria compliance

Hinweisgebersystem für Österreich

In Österreich setzt HinweisgeberInnenschutzgesetz die EU-Hinweisgeber-Richtlinie 2019/1937 in nationales Recht um. Unternehmen mit 50+ Mitarbeitenden müssen ein vertrauliches internes Hinweisgebersystem betreiben, Meldungen innerhalb von 7 Tagen bestätigen und innerhalb von 3 Monaten substantiell beantworten. Bußgelder bei Nichteinhaltung erreichen bis zu €20,000.

Confidly is a GDPR-compliant whistleblowing channel built for companies in Austria (Österreich) operating under HinweisgeberInnenschutzgesetz (HSchG). The intake form is auto-configured with the categories and disclosures HSchG requires. Reporters can attach audio or video oral statements to a web submission; a native phone-hotline or voicemail channel is on roadmap. The mandatory 7-day acknowledgement and 3-month feedback updates are automated. Set up in 15 minutes. Hosted in the EU. Used by compliance teams from 50 to 5,000 employees.

What HSchG requires you to do

HinweisgeberInnenschutzgesetz transposes the EU Whistleblower Directive 2019/1937 into Austria national law. The core obligations for companies above the threshold (50+ employees):

• Maintain a confidential internal reporting channel
• Acknowledge every report within 7 days
• Provide feedback to the reporter within 3 months
• Designate a person or unit to handle reports
• Protect the reporter from retaliation
• Keep records for the case duration + the audit window

In Austria, enforcement sits with Bundesamt zur Korruptionsprävention. Maximum fines for non-compliance reach €20,000.

Estimate your exposure under HSchG with the fines calculator.

How Confidly covers HSchG

• Country-specific intake template for HSchG: the form is auto-configured with the categories, disclosures and fields the Austria transposition requires. No manual setup per channel.
• Anonymous intake available where Austria law permits. Reporters get a server-issued case code and their own 6-digit secret. No email, no IP, no identifier stored.
• Oral-statement attachments on every plan: reporters upload audio or video oral statements directly into the web form, with EXIF/metadata stripping. A staffed phone hotline or AI-transcribed voicemail channel is on roadmap, in support of the oral-reporting requirement that HSchG carries from EU Directive 2019/1937 Art. 16.
• Form pre-translated into DE, EN. AI translates incoming reports to your working language on the admin side.
• Auto reporter status updates at 7 days (acknowledgement) and 3 months (status), in the reporter's language. HSchG feedback obligation satisfied by default.
• AI investigation copilot (Pro): AI summarises, classifies severity, drafts neutral replies, and clusters multi-reporter patterns to surface systemic issues.
• Append-only audit log required for Bundesamt zur Korruptionsprävention audits. Every action recorded with actor, timestamp and metadata.
• EU data residency: all data stored in EU data centres. Per-channel residency on Enterprise (data for Austria entities stays in Austria). No third-country transfers.
• Native HRIS sync (Pro): Personio, BambooHR. Auto-revoke channel access on offboarding; flag when a named-in-report person leaves the company.

What does Confidly cost in Austria?

Three plans, EUR-priced (VAT reverse-charged for EU B2B). Pick a tier by company size; everything else is included.

Frequently asked questions: HSchG

Ist ein Hinweisgebersystem Pflicht?

Yes. For companies with 50+ employees in Austria, an internal whistleblowing channel is legally mandatory under HinweisgeberInnenschutzgesetz (HSchG). The law has been in force long enough that Bundesamt zur Korruptionsprävention now actively investigates non-compliance, with maximum administrative fines of €20,000.

Wer kann Hinweisgeber sein?

Under HSchG, the channel must accept reports from current and former employees, applicants, suppliers, contractors, shareholders, and members of administrative or supervisory bodies. Any person who acquired the information in a work-related context is protected. Confidly's reporter UI requires no email, no IP capture, and no account, so anyone in scope can submit.

Welche Anforderungen gibt es an ein Hinweisgebersystem?

Core requirements under HSchG: (a) the channel must be confidential and accessible to all relevant persons; (b) acknowledgement of every report within 7 days; (c) substantive feedback to the reporter within 3 months; (d) protection from retaliation; (e) an audit-ready record of every action. Confidly implements all five out of the box.

Wie funktioniert ein Hinweisgebersystem?

A whistleblowing channel works in three steps: (1) the reporter submits a confidential report through a public-facing form, receiving a server-issued case code plus their own 6-digit secret to follow up. (2) The designated case handler triages the report inside the admin dashboard, acknowledging within 7 days as required by HSchG. (3) Investigation, communication, and resolution are tracked in an append-only audit log that satisfies Bundesamt zur Korruptionsprävention inspections.

Kann man in Österreich eine anonyme Anzeige machen?

Yes. Anonymous reporting is supported by Confidly in Austria. The reporter UI never asks for an email, never stores an IP, and uses a server-issued case code plus reporter-only 6-digit secret so the reporter can submit and follow up without revealing identity. HSchG permits anonymous reporting where Austria national law allows.

Is a whistleblowing channel mandatory in Austria?

Yes. HinweisgeberInnenschutzgesetz (HSchG), the Austria transposition of EU Directive 2019/1937, requires companies with 50+ employees to operate a confidential internal whistleblowing channel. The law has been in force since 25 February 2023.

What are the fines for non-compliance with HSchG?

Maximum administrative fines under HSchG reach €20,000. Enforcement is carried out by Bundesamt zur Korruptionsprävention. Fines apply both for failing to establish a channel and for retaliation against reporters.

Does HSchG require anonymous reporting?

HSchG permits anonymous reporting where Austria national law allows. Confidly's reporter UI issues a server-side case code and reporter-only secret (no email, IP address, or browser identifier is stored), so reporters can submit and follow up entirely anonymously.