Since 25 September 2024, Poland’s Whistleblower Protection Act has been in force. If at least 50 people perform paid work for your organisation, you must implement an internal reporting procedure tailored to your operations. The employee threshold does not apply to organisations in the financial, transport and environmental sectors. Below you will find the rules, examples of sectors covered by the Act and practical steps for meeting the requirements.
Who must implement the Whistleblower Protection Act?
The Act entered into force on 25 September 2024. The implementation obligation applies to approximately 30,000 private entities and 12,000 public entities.
The main rule: a threshold of 50 people
The obligation applies to entities for which, as of 1 January or 1 July of a given year, at least 50 people perform paid work.
Check the number of people working for you on those dates. If the threshold is met, you must implement the procedure. If it is not, monitor the number every six months.
In the rest of this article, “company” means an enterprise or another legal entity.
Sectors covered when the 50-person threshold is met
The list below gives examples of entities required to implement the Act.
Manufacturing and industry
- Manufacturing businesses, including factories and industrial plants
- Chemical companies
- Pharmaceutical companies
- Cosmetics, clothing and furniture companies
- Electronic equipment manufacturers
- Food and beverage producers
- Manufacturers of packaging, toys and musical instruments
- Businesses involved in extracting raw materials
- Printing and graphic arts businesses
Finance and insurance
- Banks, credit institutions and payment institutions
- Leasing, factoring and lending companies
- Investment and pension funds
- Insurance companies
- Brokerage firms
- Financial advisory firms
- Asset management companies
- Currency exchange offices
- Accounting firms
- Payment system operators
- Debt collection companies
- Risk analysis businesses
Transport and logistics
- Transport, freight forwarding, logistics, courier and postal companies
- Air, sea and rail transport companies
- Airport terminal and seaport operators
- Companies responsible for maintaining roads and motorways
IT, technology and telecommunications
- IT and technology companies
- Telecommunications companies
- Cybersecurity companies
- Software production and distribution companies
- IT outsourcing companies
- Website design companies
- E-commerce platforms
- Video game producers
Construction and real estate
- Construction companies
- Property developers
- Real estate agencies
- Architecture and engineering firms
- Interior design companies
- Garden and landscape design companies
Trade and services
- Retail chains, including supermarkets and store chains
- Wholesale, retail and international trade companies
- Hotels, hostels and motels
- Travel agencies
- Catering companies
- Event companies
- Cleaning companies
- Security companies
- Gyms and fitness centres
- Hair salons with more than 50 people
- Animal shelters and veterinary clinics
Energy and environmental protection
- Energy companies
- Water supply and sewerage companies
- Recycling and waste management companies
- Renewable energy companies
- Biotechnology companies
Health and science
- Private clinics and hospitals
- Rehabilitation and physiotherapy centres
- Pharmacies and pharmaceutical wholesalers
- Medical equipment suppliers
- Research laboratories
- Clinical research entities
- Research and development companies
Education and training
- Universities and higher education institutions
- Private universities, schools and language schools
- Training companies
- Employee development companies
Consulting and professional services
- Consulting companies
- Marketing and advertising companies
- HR and recruitment service providers
- Legal service providers, including law firms
- Tax, strategy, logistics and HR advisory firms
- Companies providing GDPR and compliance services
- Market research and public opinion research companies
- Translation, graphic design and commercial photography companies
- Project management companies
- Detective agencies
- Occupational health and safety advisory firms
- Technical equipment servicing and repair companies
- Call centres and technical support services
Media, culture and entertainment
- Media companies, including television, radio and online portals
- Publishing companies
- Entertainment businesses, including cinemas and theatres
- Film and music distribution companies
- Museums and art galleries
- Heritage conservation companies
Agriculture and the natural environment
- Large farms
- Fishing and aquaculture companies
- Forestry companies
- Organisations protecting animal rights
Other sectors
- Automotive companies and repair shops with more than 50 people
- Jewellery companies
- Companies producing and selling sports equipment
- Companies transporting radioactive materials
- International trade intermediary companies
- Technology park management companies
- Fashion design companies
Entities exempt from the 50-person threshold: the obligation applies regardless of headcount
The 50-person threshold does not apply to entities operating in areas covered by the AML Directive and related regulations. If your company operates in one of the areas below, implementation is required regardless of the number of people working for it.
Financial services and anti-money laundering
- Financial institutions: banks, credit institutions, payment institutions and credit intermediaries
- Other financial entities: insurance companies, pension funds, entities managing assets and investment funds, providers of custodial wallets and entities providing cryptocurrency services
- Regulated professions: notaries, advocates and legal advisers when participating in transactions involving real estate, managing a client’s budget, or establishing companies, trusts or foundations; statutory auditors, accountants and tax advisers
- Real estate agents
- Businesses accepting or making cash payments of at least EUR 10,000
- Providers of gambling services: land-based and online casinos and other gambling entities
- People trading in or storing works of art where the transaction value is at least EUR 10,000
Transport security
- Transport companies and carriers
- Managers of road and rail infrastructure, airports and seaports
- Providers of transport security systems
- Air traffic control entities
- Entities conducting transport security audits
- Aviation agencies
- Motorway and expressway operators
- Airlines
Environmental protection
- Waste processing plants
- Water supply and sewerage companies
- Power stations and energy plants
- Recycling entities
- Chemical companies
- Industrial plants with a significant environmental impact, such as metalworks
- Entities managing parks and nature reserves
- Entities monitoring greenhouse gas emissions
- Renewable energy entities
- Waste management companies
- Companies analysing drinking water quality
- Landfill and waste disposal site operators
- Companies disposing of medical waste
- Entities working on climate change adaptation and monitoring
- Non-governmental organisations working to protect the environment
- Entities monitoring air quality
- Companies analysing and managing environmental risk
- Entities responsible for biodiversity protection
Who does not have to implement the Act?
The rules do not apply to small entities with fewer than 50 people that do not operate in the sectors listed above (finance, transport and environmental protection). Examples include:
- Small grocery shops
- Small hair and beauty salons
- Car repair shops
- Small cafés and restaurants
- Local cultural and sports associations
- Small family businesses
What implementation gives you, and what you risk without it
Failing to implement the procedure creates a risk of legal sanctions, including financial and criminal penalties. Implementation removes that risk and also means employees know they can report irregularities, including anonymously, without fear of retaliation. This can help identify problems earlier and reduce the cost of addressing them.
What to do: the Whistleblower Support Programme
If your company is covered by the obligation, you need four things:
- Documentation: an internal reporting procedure tailored to your company’s specific nature and practices
- A reporting channel: an online tool available to employees and contractors, enabling them to report irregularities
- Report handling: a legal team to conduct an investigation and advise on next steps
- Training: video materials with instructions and explanations for both employers and employees
All these elements are provided by our law firm’s Whistleblower Support Programme. It can help you meet the statutory obligations, while specialists handle reports using straightforward tools and processes designed to keep handling costs low.
BUY ACCESS TO THE FULL TRAINING
Frequently asked questions
Must my company implement the Whistleblower Protection Act if it works with at least 50 people?
Yes. If at least 50 people perform paid work for your company, you must implement an internal reporting procedure. The Act has been in force since 25 September 2024 and applies to approximately 30,000 private entities and 12,000 public entities. If you operate in finance, transport or environmental protection, the implementation obligation applies regardless of the number of people working with you.
How is the 50-person threshold calculated, and when must it be checked?
Check the number of people performing paid work for your company as of 1 January or 1 July of a given year. If the threshold of 50 people is met on either date, you must implement the procedure. If it is not met, monitor the number every six months.
Are there sectors that must implement a whistleblower procedure even with fewer than 50 people?
Yes. The threshold does not apply to entities in three areas: financial services and anti-money laundering (including banks, payment institutions, insurers, gambling service providers, cryptocurrency service providers, notaries, statutory auditors and tax advisers); transport security (including carriers, infrastructure managers and airlines); and environmental protection (including waste processing plants, power stations and water supply and sewerage companies). If your company operates in any of these sectors, implementation is required regardless of headcount.
What does a company risk if it does not implement an internal reporting procedure?
Failure to implement the procedure creates a risk of legal sanctions, both financial and criminal. In addition to formal consequences, you lose the opportunity to detect irregularities in your organisation earlier, which can mean higher costs when problems come to light another way.
What exactly should a company implement to meet the Whistleblower Protection Act requirements?
You need four elements: documentation in the form of an internal reporting procedure tailored to your company; an online reporting channel available to employees and contractors; report handling by a legal team that conducts an investigation; and training with video materials for employers and employees. Each element is necessary to meet the requirements of the Act.
