A whistleblower report has landed on your desk. Someone on the team is asking what to do next. HR does not know who should take charge. A manager is wondering whether they can speak to the person named in the report. And time is running: the Whistleblower Protection Act gives you 7 days to acknowledge receipt of a report and 3 months to provide feedback.
The lack of a clear response procedure is one of the most common problems companies face after the Act of 14 June 2024 on the Protection of Whistleblowers entered into force (Journal of Laws 2024, item 928). Managers and HR teams do not know who verifies facts, who makes decisions, or how to communicate the status of a case. The result is confusion, escalation, and legal mistakes that can cost the company compensation, criminal sanctions, and, above all, the team’s trust.
This article provides a practical sequence for handling a whistleblower report, from receipt through verification and decision-making to closing the case. Each step is described from the perspective of an employer seeking to protect the company without infringing the reporting person’s rights. It draws on the Act and experience providing legal support to technology and service companies.
Key terms before you continue
Before turning to the procedure, it is useful to clarify some terms used in the Act and this article.
| Term | Meaning |
|---|---|
| Whistleblower | A person who reports a breach of law in a work-related context, including an employee, associate, contractor, or external person connected with the company. |
| Internal report | Information about a breach of law submitted to the employer through internal reporting channels. |
| Follow-up action | Action taken by the employer after receiving a report, including verification, an investigation, and a decision on next steps. |
| Retaliation | Any adverse consequence imposed on a whistleblower because they made a report, from dismissal to being passed over for promotion. |
| Feedback | A message to the whistleblower about follow-up action taken or planned. The statutory deadline is 3 months. |
| Reversed burden of proof | The employer must show that adverse treatment of a whistleblower was not retaliation for the report. |
The first 24 hours after a report: what not to do and why
The Act does not identify the “first 24 hours” as a separate stage. Whistleblower protection begins when the report is made (Article 6 of the Act), not after verification, a board decision, or a finding that the report is substantiated. Protection is immediate and unconditional, provided the whistleblower had reasonable grounds to believe the information was true.
This means that three absolute prohibitions apply from the first moment a report is received.
No retaliation
No adverse action may be taken against a whistleblower because they made a report. The open-ended list in Article 12 of the Act includes:
- Termination or cancellation of an employment contract
- Reducing remuneration or withholding a bonus
- Passing the person over for promotion or training
- Changing the workplace or working-time schedule
- Bullying, discrimination, intimidation, or exclusion
- Imposing a disciplinary measure
- Unjustifiably initiating proceedings against the whistleblower
The prohibition covers not only actions already taken, but also attempts and threats to take them. The penalty is imprisonment for up to 2 years, or up to 3 years for persistent conduct.
No breach of confidentiality
The whistleblower’s identity must be protected from the outset. Information about the reporting person must not be disclosed to anyone outside the strictly authorized circle. This includes corridor conversations, comments at team meetings, entries in IT systems, and email correspondence. Disclosing the identity carries a penalty of imprisonment for up to 1 year.
Remember that confidentiality also covers information that could indirectly identify the whistleblower, for example, saying that “someone in finance made a report” when there are only three people in that department.
Do not obstruct a report
Refusing to accept a report, “losing” a document, blocking access to the reporting channel, or pressuring someone to withdraw a report is punishable. The penalty is imprisonment for up to 1 year, or up to 3 years if force or a threat is used.
What this means for an employer in the first hours
Do not prejudge the report. Do not call the person named in it to “sort things out informally.” Do not discuss the report with managers who are not authorized. Do not make employment decisions concerning the whistleblower.
Remember the reversed burden of proof: if a whistleblower is treated adversely, your company must show that the action was unrelated to the report. The shorter the time between the report and the adverse decision, the harder it will be to prove that.
Who handles reports in the organization: roles, authority, escalation
The Act does not specify which job title must handle reports. It gives three options: an authorized employee, an internal organizational unit, or an external entity (such as a law firm). The choice depends on the company’s size, structure, and business profile.
Four models used by organizations
| Model | How it works | Suitable for |
|---|---|---|
| Representative plus committee | The representative receives the report, conducts an initial review, and acknowledges it within 7 days; a committee conducts the investigation and decides on follow-up action. | Medium-sized and large organizations with a developed structure |
| Organizational unit | A dedicated department, such as compliance, receives reports, organizes meetings, documents cases, assigns case numbers, and maintains the register. | Companies with a separate compliance or legal department |
| Team appointed under the procedure | A small team named in an appendix to the procedure receives reports, acknowledges them, maintains the register, and takes follow-up action. | Smaller companies without a separate compliance department |
| External entity | A law firm or consulting company takes over report handling and provides independence and confidentiality. | Companies that want to separate report handling from their internal structure |
Regardless of the model, the person responsible for reports must not be someone whom a report may concern, such as a board member when the report concerns a board decision. This is a condition of impartiality that follows from the logic of the system.
Responsibilities of the person or unit in charge
- Managing reporting channels (written, oral, and electronic)
- Maintaining a register of reports and recording each report as it arrives
- Acknowledging receipt within 7 days
- Conducting an initial formal and substantive review
- Organizing investigations
- Providing feedback to the whistleblower within 3 months
- Protecting the identities of the whistleblower and people named in the report
- Limiting access to the report to authorized people only, on a “need to know” basis
- Holding written authorization to process personal data
When and how to escalate
Not every report requires board involvement. A representative can handle minor procedural irregularities together with the relevant department. Reports concerning serious breaches of law, corruption, data security breaches, or conduct by board members should go to the follow-up committee and be reported to senior management.
The person or unit responsible for reports must have direct access to senior management. The board should decide whether to notify an external authority, such as the Commissioner for Human Rights.
Working with other departments
Handling a report rarely stays within one department. HR is involved in breaches concerning employment relationships. IT is involved in data security incidents. Internal audit is involved in systemic irregularities. The person responsible for reports coordinates this work while retaining independence in assessing whether a report falls within the Act.
Verifying a report: separating facts from interpretation
The Act refers to “investigations” and “follow-up action” but does not set operational criteria for verifying reports. No public authority, including the Commissioner for Human Rights, the Personal Data Protection Office, or the National Labour Inspectorate, has published detailed standards for assessing credibility. Your organization’s internal procedures must establish those standards.
Three categories of content in a report
Every report contains a mix of three kinds of information. Separating them is the first step in verification.
| Category | Example | How to verify |
|---|---|---|
| Facts | “On 15 March, the president signed an agreement with Company X without the required board resolution.” | Compare it with records such as minutes, agreements, registers, and system logs. |
| Interpretations | “This conduct violates Article 210 of the Commercial Companies Code.” | Assess whether the legal classification is correct. That is a lawyer’s task, not the whistleblower’s. |
| Value judgments | “The company is dysfunctional and nepotistic.” | Set the judgment aside and focus on the facts behind it. |
The “reasonable grounds” standard
A whistleblower does not have to prove a breach beyond any doubt. It is enough that they had a genuine belief based on objectively reasonable grounds that a breach of law had occurred. Protection applies even if a report turns out to be unfounded, provided the whistleblower acted in good faith.
Knowingly providing false information is a different matter and carries a penalty of imprisonment for up to 2 years (Article 57 of the Act). However, the employer may not unilaterally decide that a report is false and use that as a reason to deny protection.
Credibility assessment criteria
The Act does not provide a ready-made checklist, but the following criteria can be drawn from general principles and the practice of authorities:
Formal criteria:
- Did the whistleblower identify themselves, except in anonymous reports?
- Did they identify the entity that may be concerned by the report?
- Did they identify a breach area within the meaning of Article 3 of the Act?
- Was the report submitted through a prescribed channel?
- Is the description of the breach sufficiently precise?
Substantive criteria:
- Internal consistency of the account
- Consistency with other available sources, such as documents, IT logs, and correspondence
- Plausibility of the described conduct in the organizational context
- No obvious conflict with the established legal position
Protecting the person named in a report
Confidentiality applies to both sides. A person named as having breached the law is also entitled to protection of their identity and personal rights. If false information was knowingly reported, that person may seek compensation under Article 15 of the Act and the Civil Code.
Communicating with the whistleblower: information duties and statutory deadlines
The Act specifies three deadlines. Missing them may expose the company to an allegation of non-compliance, so keep them at hand.
| Deadline | Obligation | Counted from |
|---|---|---|
| 7 days | Acknowledge receipt of the report | The day the report is received |
| 14 days | Arrange a meeting at the whistleblower’s request | The day the meeting request is received |
| 3 months | Provide feedback on follow-up action | The day receipt is acknowledged, or the end of the 7-day period after the report if no acknowledgment was sent |
Acknowledging receipt of a report
The acknowledgment should be sent to the whistleblower in the same or an appropriate form to the one used for the report. The 7-day deadline runs from the day the report is actually received by the organization, not the day the whistleblower sent it.
If the whistleblower did not provide a contact address, for example, an anonymous report with no return channel, there is no obligation to acknowledge receipt. It is therefore useful for the reporting system to allow anonymous two-way communication, for example, through a unique case number.
Feedback after 3 months
Feedback should state whether an investigation was opened, what action was taken, and what the outcome was. The Act does not specify the required content or form, but the more concrete the response, the lower the risk of an allegation of inaction.
If the investigation is not complete within 3 months, tell the whistleblower the current status and planned next steps. No response at all may prompt the whistleblower to use the external reporting route and report to the Commissioner for Human Rights.
Duty to inform about external reporting
The internal reporting procedure must include clear information about the option of making an external report to the Commissioner for Human Rights or the relevant public authorities. You must not design the procedure to suggest that an internal report is the only permissible route.
Communication rules
All communication with the whistleblower must remain confidential. Do not use named email addresses that unauthorized people might access. Do not hold conversations in open areas. Limit access to the whistleblower’s data to the absolute minimum, on a “need to know” basis.
Closing a case: records, findings, and corrective action
The Act requires an internal report register (Article 29 of the Act). Keep the data for 3 years from the date the report is received. The Act does not provide a template for a final report; your internal procedure should specify how a case is closed.
What a final report should contain
Based on statutory requirements and good organizational practice, a case-closing report should include:
- Case number and report date, as recorded in the register
- Description of the report, including the subject of the breach, area, and people named
- Course of the investigation, including actions taken, people interviewed, and documents reviewed
- Findings of fact, including what was confirmed, not confirmed, and any discrepancies found
- Legal assessment: whether the established facts constitute a breach of law within the meaning of Article 3 of the Act
- Corrective action taken, such as procedure changes, measures concerning people responsible for breaches, training, or process corrections
- Preventive action: what should change in the organization to prevent a similar situation
- Case closure date
- Information about feedback sent to the whistleblower, including its date and form
Required elements of the report register
Under Article 29 of the Act, the register must contain:
- Report number
- Subject of the breach
- Personal data of the whistleblower and the person concerned, unless the report is anonymous
- Contact address for the reporting person
- Date the report was made
- Information about follow-up action taken
- Case closure date
Corrective and preventive action
Closing a case is more than making an entry in the register. If an investigation confirms a breach, the company should implement concrete changes: update procedures, train the team, change supervision, or take disciplinary action against the people responsible.
Every report, even one that is not substantiated, provides information about how employees and associates perceive the organization. It is worth treating it as a diagnostic signal.
Common employer mistakes in handling reports and how to avoid them
| Mistake | Why it is risky | How to avoid it |
|---|---|---|
| No internal reporting procedure | The company has failed to meet its statutory obligation since 25 September 2024 and risks sanctions and lack of procedural protection. | Implement a procedure compliant with Articles 24 to 29 of the Act. If you already have a whistleblowing procedure, check whether it includes the required elements. |
| Late implementation of the procedure | A report arrives before the procedure is ready: there are no channels, no designated person, and no register. | Do not wait for the “perfect moment.” Implement the operational minimum and develop the system. |
| Incorrect subject-matter scope | The procedure covers too few or too many breach categories, leading to valid reports being rejected or matters outside the Act being accepted as covered. | Refer to the list in Article 3 of the Act. Remember that labor law was removed from the list. |
| No consultation with employee representatives | A procedure implemented without the required consultation may be challenged. | Consult before implementation. The Act requires it. |
| Missing communication deadlines | No acknowledgment within 7 days or no feedback within 3 months may cause the whistleblower to lose trust and report externally. | Set automatic reminders and appoint someone to monitor deadlines. |
| Breach of confidentiality | Disclosing a whistleblower’s identity, even unintentionally, carries a penalty of imprisonment for up to 1 year and undermines the entire reporting system. | Restrict access to data, apply the “need to know” principle, and train people who handle reports. |
| Employment decisions about a whistleblower soon after a report | The burden of proof is reversed: the company must show there was no causal link. The shorter the time, the harder it is. | Pause employment decisions concerning the whistleblower until the investigation ends. Document independent grounds for every decision. |
How we can help handle whistleblower reports
Implementing a procedure is only the beginning. The real challenge starts when a report arrives and specific decisions are needed: who conducts the investigation, how confidentiality is protected, how to communicate with the whistleblower, and what to do with the verification results.
As part of our legal support for companies, we assist organizations at every stage:
- We design internal reporting procedures tailored to your company’s structure and operating model. We do not copy templates.
- We define roles and escalation paths, including who receives reports, conducts investigations, and makes decisions.
- We conduct investigations as an external entity, providing independence and separating report handling from the internal structure.
- We train managers and HR on the obligations, deadlines, and prohibitions under the Act.
- We prepare closing documentation, including reports, register entries, and feedback to the whistleblower.
- We monitor changes in the rules and update procedures when new interpretations or positions from authorities emerge.
Having a law firm handle reports has specific advantages: cases are handled by people experienced in employment law and dispute resolution; the firm keeps whistleblower data itself, without passing it to the employer; and you gain assurance that the confidentiality requirement is met.
An organized reporting procedure protects the company and team
A whistleblower report does not have to mean a crisis. With a clear procedure, assigned roles, and monitored deadlines, the company can respond efficiently and reduce the risk of legal errors.
Three things to remember:
- Whistleblower protection applies from the moment the report is made, not from your decision.
- Confidentiality is fundamental to the system. Without it, the reporting channel loses its purpose.
- The deadlines are specific: 7 days, 14 days, and 3 months. Missing them creates risk.
We can help you build a system that protects the company, the team, and people who report concerns.
Frequently asked questions
Does a company have to accept anonymous reports?
The Act does not require companies to accept anonymous reports. That depends on your internal procedure. You may decide that your system accepts them, but you do not have to. If you do accept them, handle them on the same basis as other reports: investigate and document follow-up action. It is useful to implement a system for anonymous two-way communication, such as a unique case number, so you can provide feedback even to an anonymous whistleblower.
Does a report about a breach of labor law fall under the Whistleblower Protection Act?
Parliament removed labor law from the list of areas covered by the Act (Article 3). Reports concerning only Labor Code breaches are not protected under the whistleblower legislation. However, many labor-related breaches also involve other areas, such as employees’ personal data, financial interests, or employees’ constitutional rights. In those cases, a report may be covered by the Act. Each case requires individual assessment.
Who should handle reports: an internal employee or an external entity?
Both options are permitted. An external entity, such as a law firm, offers independence, experience in conducting investigations, and an easier way to meet confidentiality requirements because whistleblower data remains outside the company’s structure. An internal model can work well in organizations with a dedicated compliance department. A mixed arrangement is also possible: an internal employee receives the report while an external entity conducts the investigation.
What if a report concerns a board member?
A report concerning a board member should be handled with the board excluded from the decision-making path. The matter should be referred to the supervisory board or an external entity. The procedure must describe an escalation route for this situation; otherwise, you risk a conflict of interest and a breach of confidentiality.
Can a whistleblower report directly to an external authority, bypassing the company?
Yes. A whistleblower may submit an external report to the Commissioner for Human Rights or a relevant public authority. External reporting channels to the Commissioner include an online form at sygnalisci.gov.pl, traditional mail marked “Report of a breach of law,” a recorded telephone hotline, and a direct meeting with a member of the Whistleblower Team. The company’s internal procedure must explain this option and must not suggest that an internal report is the only permissible route.
What does it cost a company not to have an internal reporting procedure?
Direct costs may include criminal sanctions (a fine, restriction of liberty, or imprisonment for up to 2 years for obstructing a report) and compensation to the whistleblower of no less than the average monthly wage in the national economy. Indirect costs include loss of the team’s trust, the risk of external reports (which may be more damaging to the company), and losing control over the investigation if the matter goes directly to public authorities.
