Compliance

At a glance

• HR compliance combines statutory duties with internal rules such as a Code of Conduct and works agreements (Betriebsvereinbarungen)
• Core fields: working time (ArbZG), employee data protection (DSGVO, BDSG), anti-discrimination (AGG), minimum wage and pay (MiLoG), social security
• Whistleblowing: an internal reporting channel is mandatory from 50 employees (§ 12 HinSchG)
• Monitoring and reporting systems trigger works council co-determination (§ 87 BetrVG)
• Breaches can lead to fines, damages, and personal liability of management
• Responsibility sits with company leadership; HR runs the processes and documentation

Statutory duties versus internal rules

The two levels are often conflated, although they work differently.

Statutory duties apply whether or not the company knows about them or has written anything down. They cannot be contracted out of, and breaching them triggers fines, damages, or liability. Examples: time recording and maximum working hours under the ArbZG, the record of processing activities under the GDPR, the internal reporting channel from 50 employees under § 12 HinSchG, measures against discrimination under § 12 AGG.

Internal rules are set by the company itself. A Code of Conduct, policies, and works agreements are instruments, not obligations. They give shape to statutory requirements, extend them voluntarily, and create the basis for employment measures such as a warning or dismissal.

The practical difference: a statutory duty has to be met. An internal rule has to be enforced, otherwise it does more harm than good.

Building blocks of an HR compliance system

• Identify statutory duties and meet them in a way you can evidence
• Set internal rules where expectations go beyond the law or where interpretation is needed
• Reporting routes: an internal reporting channel under HinSchG plus clear escalation
• Control and documentation: time recording, data protection records, training
• Response: investigate reports, take action, and stop violations

FAQ

Who is liable when compliance rules are broken?

Primarily the company, through fines and damages. Managing directors and board members can be personally liable if they breach supervisory duties (§ 130 OWiG). HR does not carry ultimate responsibility but is central to processes and evidence.

What is the works council's role?

Co-determination applies to technical systems that monitor conduct or performance (§ 87 BetrVG), such as time tracking or a digital whistleblowing system. Works agreements (Betriebsvereinbarungen) are a key compliance instrument.

Does a company have to have a Code of Conduct?

German employment law contains no general obligation to have one. Individual rules do require arrangements that a Code of Conduct typically covers, such as measures against discrimination under § 12 AGG. On top of that come practical demands from supply chain rules, customer audits, or certifications such as ISO 27001.

Either way a Code of Conduct is worth having, because it creates the basis for employment measures. If you want to sanction behaviour, you have to have said beforehand what is expected.

Does a Code of Conduct replace statutory structures?

No. The internal reporting channel, data protection processes, and working time records remain mandatory regardless of what the Code of Conduct says.

How do compliance and data protection connect?

Employee data protection (Beschäftigtendatenschutz, DSGVO and BDSG) is a core field. Internal investigations and the handling of reports must respect data minimisation, purpose limitation, and data subject rights, otherwise a new compliance breach arises.

Last updated: August 2026

This article provides general information and is not a substitute for legal advice in individual cases.