Let your reporting channel be not a box but a working system.
Setting up and operating internal reporting channels that preserve confidentiality and genuinely work, in line with LkSG and EU Whistleblower Directive expectations — and the legal management of incoming reports.
Why now?
Two separate regulatory waves lead to the same door: German customers subject to LkSG expect an accessible grievance mechanism from their suppliers; the EU Whistleblower Directive and the member-state laws transposing it into national law (HinSchG in Germany) make internal reporting channels mandatory for group companies and subsidiaries in the EU. Türkiye-based groups encounter this expectation both in customer audits and in their German subsidiaries.
The four conditions of a working channel
Accessibility
channels that employees and, where needed, supply-chain stakeholders can reach without language or technology barriers.
Confidentiality
protection of the reporter's identity and KVKK/GDPR-compliant data processing — the channel's design must be set up together with a data protection programme.
Prohibition of retaliation
ensuring, through policy and practice, that no sanction will be imposed on the person who files a report.
Producing outcomes
evaluating reports within a defined timeframe, connecting them to an internal investigation where necessary, and providing feedback.
What happens when a report comes in?
The system's real test comes with the first serious report: triage of the allegation, a confidential preliminary assessment, the decision to investigate, the preservation of evidence, and — if the allegation is confirmed — sanctions and corrective action. At every link in this chain, employment law, KVKK, and criminal law intersect; a mishandled report exposes the company to greater risks than the report itself. Our investigation guide is the roadmap for this stage.
The regulatory map
The legal map for designing a channel has three parts. In the EU the Whistleblower Directive (2019/1937), and in Germany the HinSchG, require companies with fifty or more employees to run an internal reporting channel, to respond within set deadlines and to prohibit retaliation — and Turkish groups with a German subsidiary meet that threshold at subsidiary level. LkSG §8 separately requires a grievance procedure open to supply-chain stakeholders. Turkish law has no dedicated whistleblowing statute; the channel is built within the limits of the KVKK (6698), the Labour Law (4857) and the Criminal Code, and protection of the person reporting rests on employment case law. A single channel can be designed to satisfy all three regimes at once; maintaining separate systems is an unnecessary cost.
From rehearsal to report
At the end of the set-up the system is rehearsed with a test report: triage, confidentiality, deadlines and feedback are all run through the real flow. A channel that works on paper but has no owner in practice is evidence against you in an audit.
What you get: the channel architecture decision, a policy and procedure set, a triage guide, record templates and the format for the annual statistical report. The supply-chain dimension joins up with the LkSG / CSDDD programme, and the corporate framework with our ESG focus area.
We are by your side for the Grievance Mechanism & Whistleblowing
We design the channel independently of the technology (from a telephone line to a platform), prepare the policy and process documents in two languages, train the review committee, and — if you wish — take on the initial legal triage of incoming reports as an external centre. The record-keeping system that proves the mechanism “genuinely works” in LkSG audits is part of the setup.
Other Applications of This Service
Compliance — our other specialised solutions in this area.
Matter Connections
The focus areas, practice areas, desks and legislation connected with this sub-service.
Our Matters in This Service
The anonymised examples of our work that relate to this service.
Uninterrupted legal counsel for a multinational supplier
Retainer-based support across day-to-day commercial operations, contract management and compliance processes.
Review the matter →ESG & ComplianceSupply chain due diligence (LkSG) compliance programme
Risk assessment and compliance architecture for a Turkish supplier network under the German LkSG.
Review the matter →Market AccessEstablishing a distribution network in Türkiye
Designing a market entry strategy, distributorship agreements and competition compliance.
Review the matter →The Team Delivering This Service
With our multilingual team of lawyers, well-versed in Turkish and German law, we are by your side.
Mehmet Köksal
Founder and Managing PartnerIstanbul · Berlin · KyreniaProfile →
Kübra Köksal-Yılmaz
PartnerBerlin · İstanbulProfile →
Gül Efem
Of CounselİstanbulProfile →
Sven Köksal
Legal EngineerBerlin · İstanbulProfile →
Gökçe Yıldırım
Of CounselİstanbulProfile →Related Publications
Fresh perspectives and guides from the Knowledge Centre.
The data of the reporter, the person reported on, and witnesses must be processed with purpose limitation, access restrictions, and retention periods. A KVKK/GDPR assessment of the channel is a mandatory step of the setup.
Bad-faith reports can be made subject to sanctions; however, the threshold must be kept high — otherwise use of the channel is deterred. In the policy, we draw a clear line between an honest but mistaken report and a bad-faith one.
There is no general obligation under Turkish law yet; however, German customers’ LkSG expectations, member state laws applying to your EU subsidiaries, and group policies make one mandatory in practice.
In most systems, yes — allowing anonymous reports builds trust and is expected in LkSG practice. What is critical is a platform setup that can keep communication going even with anonymous reports.
Grievance Mechanism & Whistleblowing — get the right legal support.
Let us identify the right solution together, drawing on our experience in Türkiye and the DACH region.