Failing to act can expose people to criminal sanctions, including a fine, restriction of liberty or imprisonment for up to one year. This guide outlines the duties, deadlines and risks described for your company.
How Poland’s whistleblower rules came about
Whistleblower protection rules stem from an EU directive. Poland was required to implement it by 17 December 2021, but did not meet the deadline.
Consequences of the delay:
- The European Commission brought proceedings against Poland before the Court of Justice of the EU.
- Legislative work accelerated. On 12 July 2023, a new version of the draft act was published on the Government Legislation Centre’s website.
- On 6 March 2024, another draft was published that significantly expanded the scope of matters whistleblowers could report.
- The Act was passed on 14 June 2024, published in the Journal of Laws on 24 June 2024 and entered into force on 25 September 2024.
Read more about the whistleblower directive itself here.
Who is covered: employee threshold
The duty to implement internal reporting rules applies to two groups of employers:
- 250 or more employees: the duty has applied since 25 September 2024.
- 50 to 249 employees: the duty has also applied since 25 September 2024. The law removed the longer transition period previously planned for this group.
If you employ fewer than 50 people, the Act does not require you to have internal reporting rules unless other specific provisions say otherwise.
Internal reports: what you need to implement
Internal reports concern legal violations reported inside a company, for example by an employee to a designated person or department.
Your duties as an employer
- Adopt internal reporting rules that define how reports are received, verified and handled.
- Appoint a person or department responsible for receiving reports and conducting follow-up investigations.
- Provide a reporting channel, such as a dedicated email inbox, form or another contact method.
- Keep a register of reports and retain documentation for the statutory periods.
Sharing procedures
If you employ 50 to 249 employees, you may enter into an agreement with another entity in the same group to establish shared rules for:
- receiving and verifying reports
- conducting follow-up investigations
This can reduce the cost of operating the reporting system.
Data retention: a new three-year period
The Act changes how long personal data related to whistleblower reports must be retained.
| Previous period | New period |
|---|---|
| 15 months | 3 years after the end of the calendar year in which follow-up action was completed |
What “follow-up action” means
Follow-up action may include:
- conducting an internal investigation
- starting an inspection
- concluding proceedings initiated by a report
What you must retain for 3 years
- employee personal data connected with the report
- documents concerning the report
- information in the register of reports
Check whether your data storage system and retention policy account for the new, longer period.
External reports: automatic certificate and risk to the whistleblower
An external report is a report of a legal violation to a public authority, such as the prosecutor’s office or another competent authority.
What changes
A certificate confirming whistleblower protection:
- No longer requires an application from the reporting person. The authority issues it automatically for each external report.
- Protects the whistleblower against dismissal, demotion, discrimination and other disciplinary measures.
A risk you should know about
- Criminal liability for false statements: the certificate is issued after the reporting person makes a statement under penalty of criminal liability. If the report proves false, the whistleblower faces consequences.
- The authority may refuse to issue a certificate if the reporting person does not sufficiently substantiate the legal violation or the report does not meet the condition of being made in the public interest.
- A 30-day gap in protection: the authority has 30 days to issue the certificate. During this period, the whistleblower is not protected. This creates a real risk for the reporting person because the employer may act before protection begins.
Criminal provisions: penalties for obstructing reports
The Act introduces criminal sanctions for conduct directed against whistleblowers.
Preventing or obstructing a report
- Penalty: a fine, restriction of liberty or imprisonment for up to 1 year.
- Applies to: anyone who prevents a report or materially obstructs the reporting of a legal violation.
Use of force, threats or deception
- Penalty: imprisonment for up to 3 years.
- Applies when: the report is obstructed through force, threats or deception.
If you manage a team, make sure managers know these rules. Criminal liability applies to individuals, not only to the company.
Other changes introduced by the Act
- Compensation for a false report: if someone knowingly reports or publicly discloses false information, a person harmed by that report may claim compensation or redress.
- Exclusion of uniformed services: the Act does not cover soldiers or service personnel. Provisions concerning service relationships were removed.
What to do now: implementation checklist
If you employ at least 50 people, check the following:
- Confirm that internal reporting rules are in place. The duty has applied since 25 September 2024.
- Appoint a person responsible for receiving reports and conducting follow-up investigations.
- Launch a reporting channel that is accessible, confidential and documented.
- Update the data retention policy. The new period is 3 years after the end of the year in which follow-up action was completed.
- Train managers on criminal provisions and the ban on retaliation against whistleblowers.
- Keep a register of reports, including documentation of follow-up action.
- Verify that your organization meets all statutory requirements. If in doubt, consult a legal adviser.
Failure to implement the rules creates more than inspection risk. It may expose specific people in your company to criminal liability.
Frequently asked questions
Does my company have to implement an internal reporting procedure if it employs at least 50 people? Yes. If you employ at least 50 people, you must implement internal reporting rules. The duty has applied since 25 September 2024, both for employers with 50 to 249 employees and for those with 250 or more. Failure to implement the rules may lead to criminal sanctions, including a fine, restriction of liberty or imprisonment for up to one year.
What exactly must a company implement to meet the Whistleblower Protection Act requirements? You must do four things: adopt internal reporting rules covering how reports are received and handled; appoint a person or department responsible for receiving reports and conducting follow-up investigations; launch a reporting channel, such as an email inbox or form; and keep a register of reports with documentation of follow-up action. You must also update your data retention policy and train managers on criminal provisions and the ban on retaliation against whistleblowers.
How long must data and documents related to a whistleblower report be retained? Retain personal data, documents concerning the report and information in the report register for 3 years after the end of the calendar year in which follow-up action was completed, such as an investigation or an inspection initiated by the report. This changes the previous 15-month period. Check that your storage system and retention policy reflect the longer period.
What penalties apply to obstructing whistleblower reports or retaliating against people who report? Preventing or obstructing a report may lead to a fine, restriction of liberty or imprisonment for up to 1 year. If the obstruction involves force, threats or deception, the penalty increases to imprisonment for up to 3 years. Criminal liability applies to specific individuals, not only to the company, so make sure your managers know these rules.
Can companies in the same group use a shared whistleblower reporting procedure? Yes, but only if each company employs between 50 and 249 people. In that case, entities in the same group may enter into an agreement to share rules for receiving and verifying reports and conducting follow-up investigations. This can reduce the cost of operating the reporting system.
