Your developer discovers that user data is being processed in breach of the GDPR. They search the intranet for a reporting procedure. They cannot find one. They write to the Commissioner for Human Rights. The next day, the story appears in the industry media. And you learn that you (personally) could face a fine for failing to have a procedure in place.
This is not a hypothetical scenario. The Whistleblower Protection Act has been in force since 25 September 2024. It requires employers to implement an internal reporting procedure, establish secure reporting channels and protect whistleblowers against retaliation. Criminal liability for failure to implement the procedure is personal: it applies not to the company as an entity, but to the specific person responsible for establishing the procedure.
In this article, you will learn who the Act applies to, what obligations it imposes, what penalties may apply for non-compliance and what you should do to address this issue in your company, step by step.
Key terms you need to know
Before we move on to the obligations, here is a brief glossary. The Act uses terms that are worth understanding from the outset.
| Term | Meaning |
|---|---|
| Whistleblower | An individual who reports a breach of law discovered in a work-related context, this may be an employee, a B2B contractor, an intern, a volunteer or even a former employee |
| Internal report | A report of a breach of law made under the employer’s internal procedure |
| External report | A report of a breach of law submitted to the Commissioner for Human Rights or another public authority, a whistleblower may submit it without first using the internal channel |
| Public disclosure | Making information about a breach available to the public (e.g. the media), as a rule, this requires a prior internal or external report |
| Retaliatory measures | Any negative consequences imposed on a whistleblower because of a report, dismissal, demotion, workplace bullying, being passed over for promotion or a change in responsibilities |
| Internal reporting procedure | A written document setting out the rules for receiving, verifying and investigating reports of breaches of law within an organisation |
Who the Whistleblower Protection Act applies to
The 50-person threshold: how to calculate it
The Act applies one threshold: at least 50 people performing paid work for a legal entity (Article 23 of the Act). The Polish Act does not provide for any additional division between companies with 50 to 249 employees and those with 250+ employees. This division came from EU Directive 2019/1937 and was only temporary; it was not transposed into national law.
The total of 50 people includes:
- Employees calculated on a full-time equivalent basis (not by headcount; two half-time employees equal one full-time position)
- People performing paid work on a basis other than an employment relationship (civil-law contracts, B2B), provided that they do not employ other people to perform that work
You must verify the threshold twice a year: based on the headcount as at 1 January and 1 July.
The Ministry of Family, Labour and Social Policy has confirmed in its official materials that the only numerical threshold is 50 people.
Exceptions: who must implement the procedure regardless of headcount
The obligation to implement a procedure regardless of the number of people applies to entities operating in the following areas:
- Financial services, products and markets
- Prevention of money laundering and terrorist financing (AML)
- Transport safety
- Environmental protection
Companies in these sectors have been required to have a procedure since 25 September 2024, with no option to benefit from a “soft” extension of the deadline.
Exemption: organisational units of municipalities and counties with fewer than 10,000 residents.
Entities below the 50-person threshold may implement a procedure voluntarily, in which case all the requirements of the Act apply to them.
Who can be a whistleblower: not just employees
Article 4 of the Act contains an open-ended list of people who may obtain whistleblower status. This group is much broader than “employees”:
| Category of person | Can they be a whistleblower? |
|---|---|
| Employee (employment contract) | Yes |
| Temporary worker | Yes |
| B2B contractor | Yes |
| Civil-law contractor | Yes |
| Intern | Yes |
| Volunteer | Yes |
| Trainee | Yes |
| Shareholder / partner | Yes |
| Member of a company body (management board, supervisory board) | Yes |
| Commercial proxy | Yes |
| Job applicant (person taking part in a recruitment process) | Yes |
| Former employee / contractor | Yes |
| Officer, soldier | Yes |
Protection applies from the moment a report is made, provided that the whistleblower acts in good faith.
For IT and SaaS companies that combine employment contracts with a B2B model, this has a specific implication: a contractor providing services under a civil-law contract has the same right to protection as an employee under an employment contract.
Contact us. We will check whether your company is subject to the Act and what obligations you need to meet.
What breaches of law are covered by the Act
The Act (Article 3(1)) protects reports concerning breaches of law in 17 areas:
| No. | Area | Example for a technology company |
|---|---|---|
| 1 | Public procurement | Manipulating a tender bid |
| 2 | Financial services, products and markets | Breaches of fintech regulations |
| 3 | AML | Lack of customer verification procedures |
| 4 | Product safety | Releasing software with security vulnerabilities |
| 5 | Transport safety | – |
| 6 | Environmental protection | – |
| 7 | Radiation protection and nuclear safety | – |
| 8 | Food and feed safety | – |
| 9 | Animal health and welfare | – |
| 10 | Public health | – |
| 11 | Consumer protection | Unfair practices towards platform users |
| 12 | Protection of privacy and personal data (GDPR) | Processing user data in breach of the GDPR |
| 13 | Security of networks and information systems | Ignoring cybersecurity incidents |
| 14 | Financial interests of the State Treasury / local government units / EU | Subsidy fraud |
| 15 | EU internal market | Breaches of competition rules |
| 16 | Corruption | Bribes in connection with contracts |
| 17 | Constitutional freedoms and human rights | Violations of civil rights by public authorities |
Categories 16 and 17 were added by the Polish legislature, they go beyond the minimum requirements of the EU Directive.
Employment law was deliberately excluded from the list during the parliamentary process. Breaches such as workplace bullying or discrimination are not generally covered by the external reporting system, unless they also fall within another category (e.g. protection of privacy, public health, constitutional rights and freedoms).
Article 3(2) allows for an optional extension of the internal procedure to cover breaches of internal regulations or ethical standards (including employment law), but the provisions on external reporting do not apply to such reports.
Deadlines: what came into force and when
| Date | What came into force |
|---|---|
| 25 September 2024 | The main provisions: whistleblower protection, the prohibition of retaliation, the obligation to establish an internal reporting procedure and the criminal provisions (Articles 54 to 58) |
| 25 December 2024 | External reports to the Commissioner for Human Rights and public authorities (Chapter 4), and the obligation to include information on the option of external reporting in the internal procedure |
| 1 January 2025 | The first date for verifying the 50-person threshold after the Act came into force, the position of the Ministry of Family, Labour and Social Policy identifies this date as the effective implementation deadline for entities reaching the 50-person threshold |
For entities in regulated sectors (finance, AML, transport, environment), the obligation arose as early as 25 September 2024, with no option to defer it.
There are no standard transitional provisions setting different implementation deadlines for different groups of entities.
Penalties: the consequences of failing to implement the procedure
Petty offence for failure to establish a procedure (Article 58 of the Act)
Failure to implement an internal reporting procedure, or establishing one in material breach of the Act’s requirements, constitutes a petty offence. Liability rests with the individual responsible for establishing the procedure, not the company as an entity.
Penalty: a fine of between 20 and 5000 zł (the range specified in Article 24 § 1 of the Petty Offences Code).
The amount may seem low, but it is not the only risk. A defective procedure creates exposure to much more serious consequences involving retaliation, damages and reputational harm.
Offences under Articles 54 to 57: more severe penalties
| Act | Penalty |
|---|---|
| Preventing or obstructing the submission of a report (Article 54) | A fine, restriction of liberty or imprisonment |
| Retaliatory measures against a whistleblower (Article 55) | A fine, restriction of liberty or imprisonment for up to 2 years (if persistent, up to 3 years) |
| Disclosing a whistleblower’s identity in breach of the law (Article 56) | A fine, restriction of liberty or imprisonment for up to 1 year |
| Knowingly reporting false information (Article 57) | A fine, restriction of liberty or imprisonment for up to 2 years |
Fines for criminal offences are imposed in daily rates (under the Criminal Code), and may potentially be many times higher than 5000 zł.
Whistleblower claims for damages
A whistleblower who has suffered retaliation may claim damages or compensation for non-material harm. Minimum damages: not less than the average monthly wage in the national economy in the previous year.
The burden of proof is reversed, the employer must prove that the measures taken were not retaliation for the report.
Any contractual provisions restricting a whistleblower’s rights are invalid. A confidentiality clause in a B2B contract cannot prevent someone from reporting a breach of law.
External reporting: when a whistleblower may bypass the internal channel
Article 30(1) of the Act expressly states that a whistleblower may make an external report without first making an internal report. There is no legal obligation to exhaust the internal channel first.
This means that if your company has no procedure or the whistleblower does not trust the internal channel, they can write directly to the Commissioner for Human Rights. And you lose control of the situation.
Situations in which a whistleblower will typically bypass the internal channel:
- A genuine risk of retaliation
- The breach concerns people in senior positions within the organisation
- No internal procedure or a visibly defective procedure
- Previous internal reports were ignored
- A threat to public health, the environment or public finances
Reporting channels to the Commissioner for Human Rights (from 25 December 2024):
- Dedicated online form: sygnalisci.brpo.gov.pl
- Post (ul. Puławska 99a, Warsaw, marked “Report of a breach of law”)
- Recorded telephone hotline
- In-person meeting by prior appointment
Note: the general ePUAP inbox of the Office of the Commissioner for Human Rights is not a channel that guarantees confidentiality.
Statistics from the Commissioner for Human Rights for the first few months of the system’s operation show growing interest: by 30 June 2025, 412 cases had been received, 144 of which were classified as external reports. The leading categories were the financial interests of the State Treasury, personal data protection, public procurement and environmental protection.
5 steps for implementing an internal reporting procedure
Step 1: audit the current situation and verify the threshold
Check whether your company exceeds the 50-person threshold (calculated on a full-time equivalent basis + B2B contractors and civil-law contractors who do not employ other people to perform that work). Verify whether you operate in a sector subject to the obligation regardless of size (finance, AML, transport, environment).
If you already have any procedure in place, compare it with the requirements of the Act. Partial implementation (e.g. an intranet form requiring users to log in with a company account, making anonymity impossible) may still result in a fine.
Step 2: draw up a written internal reporting procedure
The procedure must include at least:
| Element of the procedure | Deadline / requirement |
|---|---|
| Designation of the person or team receiving reports | An independent, trained person authorised to process personal data |
| Acknowledgement of receipt of a report | 7 days from the date the report is received |
| Feedback to the whistleblower | No more than 3 months from the acknowledgement of receipt (or from the expiry of the 7-day period if no acknowledgement was provided) |
| Information on the option of external reporting | Mandatory from 25 December 2024 |
| Description of follow-up measures | Verification of the report and the method of communicating with the whistleblower |
Both deadlines (7 days and 3 months) must be expressly stated in the procedure, omitting them makes the procedure defective and creates a risk of penalties under Article 58.
The 3-month period runs from the date on which receipt of the report is acknowledged. If no acknowledgement was provided, it runs from the expiry of 7 days after the report was made.
It is worth noting that experience from the AML sector (where whistleblowing procedures have been in place since 2018) provides useful practical models. Companies in the financial sector have already been through this process. The requirements of the Whistleblower Protection Act are not entirely new, their scope differs, but the underlying logic is similar.
Step 3: establish reporting channels
The Act requires at least two channels: one written and one oral.
The channels must:
- Enable anonymous reporting (a form with an optional “full name” field is not enough, the system must prevent identification of the device, including its IP address)
- Allow anonymous follow-up communication with the whistleblower (e.g. using a unique report number)
- Be separate from the company’s standard communication channels, a dedicated email address on the company server that can be accessed by HR does not meet this requirement
- Guarantee the confidentiality, integrity and availability of stored reports
Why ordinary email is not enough: a company mail server logs IP addresses, message headers and metadata. The IT administrator can identify the sender. This means there is no genuine anonymity, and a procedure implemented with such a channel has been implemented “in material breach of the requirements of the Act”.
Dedicated SaaS platforms for handling whistleblower reports are available on the Polish market (including Whistlelink, Sygnanet and Sygnalisto). Subscription costs range from several hundred to several thousand złotys per month, depending on the size of the organisation and the range of features.
Step 4: consult employee representatives
Before implementing the procedure, you must consult employee representatives. The process is similar to the consultation procedure used when implementing remote working rules:
- Select at least two employee representatives
- Consult them on the draft procedure
- Prepare a record of the consultation
- You do not have to incorporate their suggestions into the final version, but you must document that the consultation took place
Step 5: train the team and establish a reporting register
Training should cover two groups:
- Management and team leaders: what constitutes retaliation, how to recognise a whistleblower report, and what must never be done after receiving information about a report. Managers are the ones who most often (even unknowingly) take measures that qualify as retaliation (e.g. removing someone from a project, changing their responsibilities or not renewing a B2B contract)
- All employees and contractors: how to report breaches, what rights they have, what protection is available and where to find the procedure
Internal reporting register, mandatory elements:
| Register element | Description |
|---|---|
| Report number | Unique identifier |
| Description of the reported breach | What the report concerns |
| Whistleblower’s personal data | To the extent necessary for identification (unless the report is anonymous) |
| Details of the person concerned by the report | To the extent necessary |
| Whistleblower’s contact address | If provided |
| Date the report was made | – |
| Information on follow-up measures taken | What was done in response to the report |
| Case closure date | – |
Data retention period: 3 years after the end of the calendar year in which the follow-up measures were completed. Data irrelevant to the case must be deleted within 14 days of being found unnecessary.
Remember: the reporting procedure is not solely an employment law issue. It requires coordination with your personal data protection policy (GDPR), data protection applies both to the whistleblower and to the person named in the report.
4 scenarios that could affect your company
Scenario 1: no procedure → external report → loss of control over the narrative
A developer at a SaaS company discovers that user data is being processed in breach of the GDPR. They look for a reporting procedure but cannot find one. They write to the Commissioner for Human Rights. The company faces two sets of consequences: for the GDPR breach and for failing to have a whistleblowing procedure.
Scenario 2: unintentional retaliation → criminal liability for the team leader
A team leader learns that a direct report has submitted a report. The following week, they do not renew the person’s B2B contract, even if the reason is objective; the burden of proof rests with the employer. Without a documented anti-retaliation policy and training, the company has no evidence to support its position.
Scenario 3: apparent anonymity → defective procedure
An IT company implements an intranet form as its reporting channel, but the form requires users to log in with their company account. The lack of anonymity means that the procedure has been implemented in material breach of the Act, and a fine may still be imposed.
Scenario 4: unintentional disclosure of identity → imprisonment
An HR Manager receives a report from a whistleblower and, acting in good faith, informs the whistleblower’s direct manager in an attempt to investigate the matter. By doing so, they unknowingly disclose the whistleblower’s identity, exposing themselves to imprisonment for up to 1 year.
How we can help
Implementing an internal reporting procedure is not a one-off documentation task. It requires a consistent approach: from auditing the current situation, drafting the procedure and establishing reporting channels to training and the ongoing handling of reports.
We combine employment law with the business context (IP, ownership structure and growth plans) ensuring that staffing decisions are aligned with the company’s direction. We do not implement generic policies. We design rules tailored to the organisation’s operating model.
Our support includes:
- Readiness audit, verification of the headcount threshold, review of existing procedures and identification of gaps
- Drafting an internal reporting procedure, compliant with the Act and tailored to the organisation’s structure (including B2B and remote working models)
- Selection and configuration of reporting channels, recommending tools that meet anonymity and confidentiality requirements
- Conducting consultations with employee representatives, preparing consultation documentation
- Training for management and the team, how to respond to reports, what to avoid and how to communicate
- Ongoing support, handling reports, monitoring legislative changes and updating procedures
Having reports investigated by an external law firm provides additional protection: the firm keeps the whistleblower’s details exclusively within the firm and does not disclose them to the employer, satisfying the statutory requirements of anonymity and independence.
Write to us. We will review the implementation status at your company and identify what needs to be corrected.
The Whistleblower Protection Act: summary and next steps
The Act is in force. The implementation deadlines have passed. Liability for failing to establish a procedure is personal and criminal. A whistleblower may bypass the internal channel and report a breach directly to the Commissioner for Human Rights, and the burden of proof in a retaliation dispute rests with the employer.
Three things to do now:
- Check whether your company exceeds the 50-person threshold (remember to include B2B contracts and civil-law service contracts)
- Verify whether you have an internal reporting procedure that meets the requirements of the Act, including secure channels that ensure anonymity
- Make sure that management understands what retaliatory measures are and how to avoid them
If you need support with an audit, drafting a procedure or training your team, contact us. We will help you address the issue before the first report arrives.
Frequently asked questions
Does the Act apply to my company if I employ 30 people under employment contracts and engage 40 B2B contractors?
It depends on how the threshold is calculated. The 50-person threshold includes employees calculated on a full-time equivalent basis plus people performing work on another basis (B2B or civil-law service contracts), provided that they do not employ other people to perform that work. If the combined total of both groups exceeds 50, the Act applies to you. You verify the threshold based on the headcount as at 1 January and 1 July.
Can I use a dedicated email address as a reporting channel?
Ordinary company email does not meet the requirements of the Act. The mail server logs IP addresses, headers and metadata, allowing the IT administrator to identify the sender. The reporting channel must prevent identification of the device and be separate from the company’s standard communication systems. Consider a dedicated SaaS platform designed to handle whistleblower reports.
What specifically constitutes “retaliation”? Does reorganising a team after a report automatically qualify?
Retaliatory measures are any negative consequences imposed on a whistleblower as a result of making a report. The list is open-ended and includes dismissal, demotion, a reduction in pay, workplace bullying, exclusion from training and a change of position. A team reorganisation is not automatically retaliatory, but the burden of proof rests with the employer. You must prove that the decision was unrelated to the report.
Who in the company should handle reports, HR, a lawyer, the management board or an external party?
You have three options: an internal committee (company employees), an external entity (e.g. a law firm) or a mixed body (an employer representative + an external lawyer). The person handling reports must be independent, it cannot be someone who may be the subject of a report or that person’s direct report. Outsourcing the process to an external law firm reduces the risk of conflicts of interest and makes it easier to preserve the whistleblower’s anonymity.
How much time do I have to acknowledge receipt of a report and provide feedback?
You have 7 days to acknowledge receipt of a report (from the date it is received) and no more than 3 months to provide feedback on the measures taken. The 3-month period runs from the date on which receipt is acknowledged, or from the expiry of 7 days after the report was made if no acknowledgement was provided. Both deadlines must be expressly stated in your procedure.
How can I protect myself against false reports made in bad faith?
The Act provides for a penalty for knowingly reporting false information, a fine, restriction of liberty or imprisonment for up to 2 years (Article 57). Protection is available only to a whistleblower acting in good faith. The internal procedure should include a mechanism for verifying reports and documenting findings, making it possible to distinguish valid reports from abuse.
