An ESG auditor or a major business partner asks you for data from your whistleblowing system. You need the document by Friday. The register is in the system. And you are not allowed to send it to anyone — not even your own ESG department.
This is a situation faced by a growing number of companies undergoing sustainability assessments, business partner audits, or supply chain due diligence. The questionnaire requires proof that the reporting channel is operational. Refusing without offering an alternative lowers your score. Disclosing the register violates the law.
There is a third — and correct — option between these two bad answers. It is an aggregated report: a separate document prepared for the assessment that allows you to complete the relevant field in the questionnaire without breaching the confidentiality of the internal reports register.
In this article, I will show you where the confidentiality boundary lies, who in your company is an “unauthorized person” (the answer may surprise you), and which nine elements should be included in a document that an auditor will accept.
Key terms before we begin
Before we move on to the details, it is worth clarifying several terms used later in this article.
| Term | Meaning |
|---|---|
| Internal reports register | A document maintained by a legal entity under Article 29 of the Whistleblower Protection Act. It includes, among other things, the report number, the subject matter of the breach, details of the whistleblower and the person named in the report, the date of the report, and information about follow-up actions. Access is restricted to authorized persons. |
| Aggregated report | A separate document prepared ad hoc for an audit or questionnaire. It contains statistical data (e.g. the number of reports received during a given period) from which no individual can be identified. It is not an extract from the system. |
| Breaches committee | The body responsible for reviewing reports — internal, external (e.g. a law firm), or hybrid. Its members are the only persons authorized to process data from the register. |
| Unauthorized person | Anyone who has not been formally authorized to access the reports register. This also applies to company employees — the ESG department, HR (unless serving on the committee), administration, and, in many models, the management board as well. |
| ESRS G1 | The European Sustainability Reporting Standard concerning business conduct. With regard to whistleblowing, it requires a description of how reporting channels operate and an assessment of employee trust — it does not mandate a numerical metric. |
Why you cannot disclose the reports register
What the Whistleblower Protection Act says
The Whistleblower Protection Act of 14 June 2024 (Journal of Laws of 2024, item 928), effective from 25 September 2024, clearly regulates three matters concerning the register:
- Obligation to maintain a register — Article 29(1)(1) imposes this obligation on the legal entity that is the data controller.
- Restricted access — Article 29(6) permits access to the register only to persons authorized by the legal entity.
- Retention period — Article 29(5) sets it at 3 years after the end of the calendar year in which the follow-up actions or related proceedings were concluded.
The register contains sensitive data: the report number, the subject matter of the breach, identifying details of the whistleblower and the person named in the report, the whistleblower’s contact address (if provided), the date of the report, and information about the follow-up actions taken.
Penalties for breaching confidentiality
Article 56 of the Act provides for criminal liability for unlawfully disclosing the identity of a whistleblower, a facilitator, or a person connected with the whistleblower: a fine, restriction of liberty, or imprisonment for up to 1 year (source: parliamentary text).
At the same time, this may constitute a personal data breach — triggering proceedings before the President of the Personal Data Protection Office and a potential administrative fine under Article 83 of the GDPR.
Disclosing the register to an auditor or business partner without a legal basis may therefore constitute both an offense under Article 56 and a GDPR violation. The consequences are not hypothetical.
Who in your company is an “unauthorized person”
This is something that surprises many business owners. With regard to the internal reports register, unauthorized persons include:
- The ESG / sustainability department
- HR — except for members of the breaches committee
- Administration and office management
- The management board — if its members have not been formally authorized
- An external auditor or business partner
The only authorized persons are members of the breaches committee — whether internal, external, or hybrid — who have been formally authorized by the legal entity.
This means that a sustainability specialist who sends an email saying “we need a report showing the number of reports received” cannot be given an extract from the register or a screenshot from the system. This remains the case even if the specialist is acting on the employer’s instructions and in its interests.
Similar rules can be found in other legal regimes. The Anti-Money Laundering Act (Article 80) follows the same model: the General Inspector of Financial Information designates persons authorized to receive reports, while communication methods must ensure the “confidentiality, integrity, and availability of information, including protection against access by unauthorized persons”. A limited group of authorized persons is the standard, not the exception.
Contact us — we will check whether your access rights map for the reports register is correct.
Aggregated report — what it is and why it works
The boundary between confidential and aggregated data
There is one clear boundary:
| Item | Protected? | Can it be disclosed to the auditor? |
|---|---|---|
| Content of the report | Yes | No |
| Data identifying the whistleblower | Yes | No |
| Data concerning the person named in the report | Yes | No |
| Description of the facts of the case | Yes | No |
| Number of reports during the period | No | Yes |
| Generic description of the outcome | No | Yes |
| Information about follow-up actions (without personal data) | No | Yes |
The number of reports received during a given period is itself aggregated data — it does not allow any individual to be identified. It may be disclosed externally. But not in the form of an extract from the system. The appropriate format is a separate document: an aggregated report prepared ad hoc.
Caution when the number of reports is low — risk of re-identification
Recital 26 of the GDPR states that data protection rules do not apply to anonymous information — information that does not allow an individual to be identified by any means reasonably likely to be used (source: EUR-Lex, GDPR).
If one report was received during the reporting period and the organization is small, the recipient of the report may potentially be able to link that number to a specific person. The President of the Personal Data Protection Office points out that aggregation and the removal of identifiers alone do not necessarily ensure effective anonymization.
Before providing the report, check:
- Whether a result of “1″, combined with the period and organizational scope, makes it possible to identify the whistleblower
- Whether the recipient (a rating platform or business partner) has additional knowledge that would allow the data to be linked to a particular person
- Whether comparing successive reports (e.g. “0″ in one period and “1″ in the next) narrows down the group of possible individuals
If there is a real risk of re-identification, consider combining categories, using ranges (e.g. “0–5 reports”), or extending the reporting period.
Nine elements of an aggregated report
Below is the structure of a document that allows you to complete the relevant field in an ESG questionnaire, business partner audit, or supply chain due diligence process — without breaching the confidentiality of the register.
| No. | Report element | What to include | Why it matters |
|---|---|---|---|
| 1 | Date and place of preparation | E.g. “Warsaw, 15 September 2026″ | The document is prepared “as of” a specific date — it is not an extract from the system |
| 2 | Full company name | Name from the National Court Register, optionally with the logo | The auditor requires the assessed entity to be identified |
| 3 | Reference to the procedure | Name of the internal reporting procedure | Proof that a formal procedure exists |
| 4 | Procedure implementation date | E.g. “implemented on 1 October 2024″ | Proof that the system was operational before the reporting period |
| 5 | Period covered by the report | From the date of the previous report to the date of preparation | Eliminates gaps — the auditor checks continuity |
| 6 | Number of reports | A specific value (e.g. “1″ or “0″) | Aggregated data — does not breach confidentiality |
| 7 | Generic description of the outcome | E.g. “rejected for failing to meet the requirements of the procedure” | Without describing the facts or including personal data |
| 8 | Follow-up actions (without personal data) | E.g. “an attempt was made to contact the reporting person, but no response was received” | Proof that the system not only receives but also processes reports |
| 9 | Signature of the breaches committee | Signed on behalf of the committee, not the employer | The committee maintains the register — this is its document |
Three points to agree with the auditor before preparing the document
Before preparing the report, clarify the following with the auditor:
- Whose letterhead to use — whether the document should be issued on the company’s or the committee’s (law firm’s) letterhead
- Signature — whether the signature of one committee member is sufficient or whether all members must sign
- Form of signature — handwritten, electronic, or trusted profile
These three questions eliminate the risk that the document will not be accepted for formal reasons and will have to be prepared again under deadline pressure.
How to report zero reports
A result of “0″ is not a problem — provided it is presented properly. A blank field or missing document raises doubts. A clear “zero” accompanied by context does not.
Article 47(1) of the Whistleblower Protection Act requires public authorities to submit annual statistical reports on external reports, including the number of reports received (source: parliamentary text). Although this obligation applies to public authorities rather than private companies, it sets a standard: a result of “0″ should be reported as a specific statistical value rather than omitted.
In an aggregated report showing a result of “0″, it is also worth:
- Specifying the reporting period and organizational scope
- Confirming that the reporting channels were available throughout the entire period (e.g. the online form was operational and the telephone line was active)
- Attaching evidence that the channel was operational — availability logs, form tests, and employee communications
- Demonstrating awareness-raising and training activities (e.g. training on the procedure or an internal announcement)
- Stating that “0″ means no reports were registered, not that no breaches occurred
The auditor is looking for continuity. A gap between reporting periods signals that the system was not operational or was not being managed. Therefore, each successive report should cover the period beginning on the date of the previous report — without any gaps.
What an ESG auditor really wants to see
ESRS G1 requirements — a description, not a number
Contrary to popular belief, ESRS G1-1 paragraph 10(d) does not mandate a numerical metric for reports. The standard requires disclosure of whether and how the undertaking assesses that employees:
- Are aware of the reporting channels
- Trust these channels
- Can use them to raise concerns and have those concerns addressed
An aggregated report stating the number of reports is therefore supporting evidence, not mandatory evidence. The key evidence includes:
- A description of the reporting channels (written, oral, telephone, and in-person meetings)
- Rules protecting against retaliation
- Confirmation of training and internal communications
- Results of awareness and trust assessments (e.g. employee surveys)
- Aggregated data on reports and follow-up actions
An evidence package that convinces auditors
An aggregated report may not be sufficient on its own. A more persuasive package includes:
| Package element | Format | Prepared by |
|---|---|---|
| Internal reporting procedure | Internal document | Compliance / legal counsel |
| Description of channels and protection rules | Excerpt from the procedure or a separate document | Compliance / legal counsel |
| Aggregated report | Ad hoc document prepared as of a specific date | Breaches committee |
| Confirmation of training | List of participants, agenda, date | HR / compliance |
| Trust survey results | Survey report | HR / ESG |
Remember: the same evidence package works for a business partner questionnaire, a bank audit, and a rating platform assessment. You prepare the aggregated report template once and reuse it in every reporting cycle.
Five mistakes companies make most often
Mistake 1: the ESG department exports data from the system itself
Wanting to act quickly, a sustainability specialist exports a list of reports from the system and sends it to the auditor. This breaches the confidentiality of the register — potentially constituting an offense under Article 56 of the Act and a GDPR violation requiring an entry in the personal data breach register (Article 33(5) of the GDPR) and potentially notification to the President of the Personal Data Protection Office.
Mistake 2: refusing without offering an alternative
The company refuses to provide the data without proposing an aggregated report. The questionnaire field remains blank. The score falls. The business partner’s procurement department asks why there is no evidence that the reporting channel is operational.
Mistake 3: a gap between reporting periods
The first report covers the period up to April 2025. The second begins in January 2026. There is an eight-month gap between them. The auditor interprets this as a period during which the system was not operational.
Mistake 4: the document does not include the company name or reporting period
A report that does not identify the entity or specify the reporting period will not be accepted as evidence. The work has to be done twice, with the questionnaire deadline looming.
Mistake 5: no established request process
The request comes from the ESG department, which is not authorized either to commission work from the committee or to receive data from the register. The matter comes to a standstill. Decide in advance who on the company’s side is responsible for confirming the request to prepare the report.
Checklist: what to implement in your organization
| No. | Action | Priority | Category |
|---|---|---|---|
| 1 | Prepare a standard aggregated report template containing the nine elements and save it in the compliance repository | High | Documentation |
| 2 | Create an access rights map for the register: list all authorized persons (committee members) by name and confirm in writing that the ESG department, HR staff who are not on the committee, administration, and the management board do not have access to the content of reports | High | Audit |
| 3 | Add a rule to the procedure stating that every external request for data about reports must be referred to the breaches committee, not the ESG department | High | Process change |
| 4 | Maintain a dated report version log — each successive period should begin on the date of the previous report, with no gaps | High | Documentation |
| 5 | Train the ESG, HR, and administration departments on one rule: the number of reports may be disclosed, but their content and personal data may not | Medium | Training |
| 6 | Organize the request process: determine who confirms the instruction for an adviser to prepare the report | Medium | Process change |
| 7 | Review the reporting procedure to determine whether it addresses aggregated reporting for external assessments — if it does not, add it | Low | Legal review |
You can build the access rights map for the reports register using the model of a personal data processing authorization register, which most companies already maintain under the GDPR. The structure is the same: authorization number, full name, scope, date granted, date revoked, and signature. You are extending an existing document rather than creating a new one from scratch.
How we can help
We support companies that have implemented an internal reporting procedure and need assistance with ESG audits, business partner questionnaires, and supply chain due diligence.
We offer three support options — depending on your organization’s current stage:
| Option | What it includes | Who it is for |
|---|---|---|
| Procedure review and report template | Review of the reporting procedure, preparation of an aggregated report template, and determination of the reporting period | Companies with an implemented procedure undergoing an ESG audit for the first time |
| Template + access rights map + training | As above + preparation of an access rights map for the register + training for the ESG, HR, and administration departments | Companies with an external committee or a complex organizational structure |
| Full-service protection | The law firm acts as the breaches committee, maintains the register, and handles recurring aggregated reporting | Companies that want to outsource the entire process and have a document ready whenever a request is received |
Regardless of the option selected, the aggregated report is prepared by the breaches committee, not the ESG department. Your team does not handle data from the register. The document is ready the day after it is requested.
Organize your procedure before the next questionnaire arrives
An ESG auditor, a business partner, or a bank — they all ask the same question: is your reporting channel operational? Answering it does not require disclosing the register. It requires one document containing nine elements, prepared by the appropriate body and in compliance with the Act.
Prepare the template once. Establish an access rights map. Implement a request process. Whenever another request arrives, the document can be prepared within one day.
If you want to check whether your reporting procedure will pass your next audit, contact us. We will review it and identify what needs to be corrected.
Frequently asked questions
Can I simply email the auditor the number of reports without preparing a formal document?
Technically, the number of reports alone is aggregated data, and disclosing it does not breach the confidentiality of the register. The issue lies with the auditor — a document without the company name, the reporting period, and the signature of the breaches committee may not be accepted as evidence. Auditors and rating platforms require an identifiable document. It is better to prepare a short report containing the nine elements than to risk having to redo the work under deadline pressure.
What should I do if the auditor insists on seeing descriptions of the reports rather than statistics alone?
Refuse and explain the legal basis: Article 29(6) of the Whistleblower Protection Act restricts access to the register to authorized persons, while Article 56 provides for criminal liability for disclosing a whistleblower’s identity. Offer an expanded aggregated report — including a generic description of the outcome and follow-up actions without personal data. ESRS G1 does not mandate a numerical metric or descriptions of individual cases — it requires a description of how the channels operate and an assessment of employee trust.
Can my ESG department have “numbers only” access to the reporting system?
It depends on the system configuration and the scope of the authorization. If the system provides a view of aggregated statistics only, without access to the content of reports or personal data, this is formally permissible, provided that the ESG employee has been authorized to process data within that scope. In most organizations, the safer model is to request the report from the breaches committee — this eliminates the risk of accidental access to sensitive data.
How should we report a period in which no reports were received — does zero look suspicious?
No — provided that “zero” is presented as a specific statistical value rather than a blank field. Include confirmation that the channels were available throughout the period (e.g. logs or form tests), demonstrate awareness-raising and training activities, and state that “0″ means no reports were registered, not that no breaches occurred. The auditor is looking for continuity and evidence that the system is operational — not merely the number itself.
Will the same document be sufficient for a business partner questionnaire and a bank audit?
Yes — the aggregated report template is universal. It contains the same nine elements regardless of the recipient. Formal requirements may differ (letterhead or form of signature), so before preparing the document, it is worth asking the recipient three questions: whose letterhead should be used, whether one or all committee members must sign, and what form of signature is accepted.
What are the consequences if someone in the organization has already sent register data to an auditor?
Disclosing a whistleblower’s data to an unauthorized person may constitute an offense under Article 56 of the Whistleblower Protection Act (a fine, restriction of liberty, or imprisonment for up to 1 year). At the same time, it may constitute a personal data breach requiring an entry in the personal data breach register (Article 33(5) of the GDPR) and potentially notification to the President of the Personal Data Protection Office. Consult a lawyer to assess the scope of the breach and take appropriate remedial action.
