The HSchG interface is manageable as a deal risk.
The HSchG interface is manageable as a deal risk. The finding should be aligned with data room, purchase price and SPA.
Due diligence
Whistleblowing systems in an acquisition: internal reports and compliance risk under Austrian law
Whistleblowing systems in an acquisition: review internal reports, Austrian HSchG, data protection, disclosure, warranties and indemnities.
Your law firm
BRANDAUER Rechtsanwälte
Salzburg law firm for corporate, company and transaction law
Every transaction is handled by a coordinated team of lawyers, legal staff and specialists. In company acquisition matters we look at structure, contract, tax and liability together.
18 August 2026 · Mag. Bernhard Brandauer, Rechtsanwalt
A whistleblowing system is not merely a compliance detail in an acquisition. Open internal reports, ongoing investigations and data protection questions can directly affect purchase price, warranties and indemnities.
This is not a general guide to the Austrian HSchG. It focuses only on the M&A interface: reporting channel, data room, disclosure, investigation and handover after closing.
Deal review
Does this point need specific contract protection before signing?
The questions classify risk, data room and SPA effect.
Already know you want to get in touch? Go straight to the enquiry form.
Is there a whistleblowing system, open reports or internal investigations?
Open reports may be data sensitive and economically material.
All paths at a glance
Overview of all answers.
Disclosure and data protection must be refined before signing.
Disclosure and data protection must be refined before signing. Before signing, documents, responsibilities and legal consequences should be refined.
Unclear internal reports are a material compliance risk.
Unclear internal reports are a material compliance risk. Without clarification, purchase price, liability and integration risks arise.
The point does not currently drive the deal.
Still document the assumption in the data room and check whether a short warranty is sufficient.
Limit data room and data protection correctly
Limit data room and data protection correctly
Open reports often contain personal data, allegations and confidential internal assessments. Buyers need risk information, but not every raw report belongs unprotected in the data room. Coordination with data protection due diligence is therefore essential. This connects to data protection due diligence and compliance red flags.
Connect warranties and indemnities to the finding
Connect warranties and indemnities to the finding
If a report points to fraud, discrimination, procurement, data protection or corporate liability, a generic compliance warranty is often too weak. The contract needs clear disclosure, responsibility for investigations and, where needed, an indemnity.
Review matrix
Connect finding, risk and contract effect
The overview shows how the deal finding is translated into transaction documents.
| Point | Review | Contract effect |
|---|---|---|
| Reporting channel Existence, responsibility, documentation | Warranty and handover | |
| Open report Facts, status, data protection | Disclosure or indemnity | |
| Investigation Evidence and rights | Covenant until closing | |
| Follow-up Handover to buyer team | Post-closing obligation |
The concrete solution depends on structure, sector, data room and bargaining position.
Practice point: The focus is not the whistleblower identity but the transaction relevant risk finding. Data room and SPA must separate both clearly.
FAQ
Common questions on whistleblowing systems in an acquisition: internal reports and compliance risk under austrian law.
May the seller disclose open reports fully? +
Not automatically. Data protection, confidentiality and investigation status must be reviewed.
Is the Austrian HSchG always price relevant? +
No, but open reports or missing systems may be economically material.
How is this handled after closing? +
The contract should regulate handover, responsibility and further investigation steps.
Further reading
Related topics
Compliance red flags
Related detail for this review point.
Corporate liability
Related detail for this review point.
Pending proceedings
Related detail for this review point.
Data protection due diligence
Related detail for this review point.
SPA warranty catalogue
Related detail for this review point.
Topics
WhistleblowingAustrian HSchGComplianceDue DiligenceBusiness acquisition
Structuring a deal, reviewing a contract, securing the risks?
When buying a company, structure, review and contract decide. Call us directly or send an email, callback within one business day.
Contact
A direct line to the firm.
Address
BRANDAUER Rechtsanwälte GmbH Giselakai 51 5020 Salzburg
Phone
+43 662 6280000