§ 43 NDSG
Confidential reporting of violations
(1)The controller shall ensure that confidential reports of violations of data protection provisions occurring within his or her area of responsibility can be submitted to him or her.
(2)1The employees of a public body within the meaning of § 23(1) and (2) may, without prejudice to their right pursuant to paragraph 1, in all matters of data protection at any time contact the authority headed by the Land Commissioner for Data Protection. 2Compliance with the official channels shall not be required where the employee has drawn attention to a violation of data protection provisions or to the risk that a person is being unlawfully impaired in his or her right to informational self-determination and the matter has not been remedied within a reasonable period.