Whistleblowing Channel in a Polish Branch of a Group. Why Copying a Solution from Abroad Is Not Enough.

The group sent over a ready-made configuration of the reporting system already in use at a sister company. The tool has been tried and tested. The platform is up and running. Yet the whistleblowing channel at the Polish branch still does not comply with the Act.

Why? Because the risks that really matter are not in the software. They lie in who sits on the committee, who provides advice, where the register is kept, and whether the Polish company conducted its own consultation with the workforce.

The Act of 14 June 2024 on the Protection of Whistleblowers (Journal of Laws 2024, item 928) has been in force since 25 September 2024. The provisions on external reports entered into force on 25 December 2024. The obligation to establish an internal reporting procedure rests with each legal entity employing at least 50 people — not with the corporate group as a whole (Act, Journal of Laws 2024, item 928).

During the first full reporting period (up to 31 December 2025), public authorities recorded 1,908 external reports (2024–2025 gov.pl Report). This shows that whistleblowers use reporting channels — and if your internal channel does not work properly, the report will go to a public authority or the media.

In this article, I will explain what a Polish subsidiary must do to ensure that its reporting channel complies with the law — regardless of how well the tool provided by the group works.

Key terms you need to know

Before we go any further, it is worth clarifying the terminology. The Whistleblower Protection Act and the GDPR use terms with specific legal meanings.

Why copying the group’s solution is not enough

Many Polish branches of international groups take the same approach to implementing a reporting channel: the headquarters provides a platform, a sister company shares its configuration, and the local branch “simply launches the system". The tool is good. But legal compliance requires more than a functional platform.

Each legal entity has its own obligations

Article 8(3) of Directive (EU) 2019/1937 states explicitly that the obligation to establish an internal channel rests with each legal entity employing at least 50 people — not with the group (Directive (EU) 2019/1937). A central group platform may serve as a technical tool, but the Polish company must have:

1. Its own internal reporting procedure — containing the 8 mandatory elements specified in Article 25(1) of the Act
2. Its own consultation with the workforce — with a trade union or representatives of people performing work (5–10 days to consult the final wording of the procedure)
3. Its own internal reports register — including reports deemed unfounded
4. Its own data protection impact assessment (DPIA) — whistleblowing systems are included in the list issued by the President of the Personal Data Protection Office
5. Its own written authorisations for people handling reports

Copying a sister company’s technical configuration does not replace any of these obligations.

Liability is local

The GDPR assigns legal liability to the controller with an establishment in the EU — even for breaches of binding corporate rules by group members outside the European Union (Article 47(2)(f) of the GDPR). The processing of employee data in the employment context in a single Member State is subject to oversight by the local supervisory authority (Recital 127 of the GDPR).

This has a specific consequence: the President of the Personal Data Protection Office is the competent authority for the reporting channel at a Polish subsidiary, regardless of where the group’s headquarters is located. Any inspection or fine will affect the Polish entity.

Three risks that have nothing to do with the platform

An analysis of an anonymised case involving the Polish branch of an international group identified 14 entries in the risk register: 1 critical, 7 high, and 6 medium. The three most serious risks did not concern the tool.

A one-person committee as a bottleneck

Having one person receive reports may appear to be a simple model. But it creates three problems at once:

1. Deadline risk — every absence (annual leave, illness, business travel) puts statutory deadlines at risk: 7 days to acknowledge receipt of a report and 3 months to provide feedback (The role of the National Labour Inspectorate in the whistleblower protection system)
2. Conflict of interest — a report concerning the committee’s sole member goes directly to that same person. Without a recusal procedure, the whistleblower will bypass the internal channel
3. Lack of impartiality — the Act requires the designation of an impartial person responsible for taking follow-up measures (Article 26). One person performing both functions — receiving and investigating reports — does not meet this requirement in every scenario

What to do: appoint at least two authorised people. Describe in the procedure how substitutes are appointed and how a committee member is recused from a specific case. Create a separate channel for reports concerning a committee member and name an impartial person who will investigate such reports.

The unresolved role of the group’s legal department

The group wants its legal department to advise the committee “without disclosing information identifying the whistleblower". This model is lawful. But it falls apart without a pseudonymisation protocol.

A discussion about a case quickly becomes a discussion about a person — particularly in an email thread. Disclosing a whistleblower’s identity without their consent is a criminal offence punishable by a fine, restriction of liberty, or imprisonment for up to one year (Article 56 of the Act).

The Act does not require a lawyer to sit on the committee. It requires an authorised person to receive reports and an impartial person responsible for follow-up measures. These are two separate functions.

What to do: formally select one of the following two options:

Reports register maintained outside the system

An internal reports register is mandatory — including for reports deemed unfounded (Article 29 of the Act). Reporting platforms usually do not offer this function.

As a result, the register is created in a spreadsheet on a shared drive. It then becomes a second, less secure copy of data identifying the whistleblower — outside access controls and event logging.

What to do: designate a single location and format for the register. Restrict access to it. Prohibit keeping it in email or on shared drives without access controls. The register should contain the information required by the Act, but not the full content of the report.

Contact us

What must be ready before the channel is launched

The following checklist covers the obligations that must be completed before the channel launch date — not afterwards.

Procedure and consultation

1. Prepare an internal reporting procedure containing the 8 elements required under Article 25(1) of the Act
2. Consult the final wording of the procedure with a trade union or representatives of people performing work (5–10 days from presentation of the draft)
3. Document how representatives were elected if you do not have a trade union
4. Publish the procedure and communicate it to the workforce, allowing a vacatio legis period before it enters into force
5. Prepare a Polish version of the form and procedure — even if the company’s working language is English

People and authorisations

1. Appoint at least two people authorised to handle reports, one of whom must be independent of the head of the entity
2. Issue named written data-processing authorisations and confidentiality undertakings — also effective after the employment relationship ends
3. Maintain a register of authorisations and block system access for anyone without authorisation
4. Name an impartial person to investigate reports concerning a committee member
5. Train all authorised people before granting them access: confidentiality of identity, criminal liability for disclosure, the prohibition on taking report content outside the system, and use of the tool

Reporting channels

1. Launch an online form on a reporting platform that guarantees confidentiality
2. Provide an oral channel: a telephone hotline or a procedure expressly providing for an in-person meeting within 14 days at the whistleblower’s request
3. Make the channel available to people outside the organisation: contractors, candidates, and associates
4. If you share an address or tool with another group company — separate the labels and form addresses, and confirm that the instances are separate

GDPR and the platform provider

1. Conduct a data protection impact assessment (DPIA) — this obligation applies regardless of scale (list issued by the President of the Personal Data Protection Office, Polish Monitor 2019, item 666, point 9)
2. Negotiate the access model with the platform provider: disable or transfer super-administrator rights, and if access is retained — specify its scope in the data processing agreement
3. Require the provider to issue named authorisations to its personnel and log every access to the instance
4. Complete the list of subprocessors in the data processing agreement
5. Document the legal basis for transferring data to a third country (for the UK — Adequacy Decision (EU) 2025/2574 of 19 December 2025)
6. Enable multi-factor authentication for accounts with access to report content
7. Update the record of processing activities to include “handling whistleblower reports"

Ongoing processes

1. Implement a process for reviewing and deleting accidentally collected, irrelevant data within 14 days of determining that it is irrelevant (Article 8 of the Act)
2. Set the data retention period: 3 years after the end of the calendar year in which follow-up measures were completed
3. Plan to review the DPIA at least once every 12 months and whenever the provider, architecture, or committee membership changes

Penalties — what you may personally face

The Whistleblower Protection Act provides for criminal, rather than administrative financial, penalties. This distinguishes this regime from GDPR fines and means that individuals may be held personally liable.

(Act, Journal of Laws 2024, item 928)

However, the most serious operational consequence of not having a functioning channel is not a penalty. The whistleblower bypasses the internal channel and goes directly to a public authority or publicly discloses the matter. Polish law (Article 30(1) of the Act) does not require the internal channel to be used first — a whistleblower has the right to choose an external channel immediately.

Data from the first year confirms that whistleblowers use this option: 1,908 external reports were received by public authorities between 25 December 2024 and 31 December 2025 (gov.pl Report).

The most common scenarios in which the model falls apart

The following situations repeatedly arise at Polish branches of international groups. Each leads to a breach that is not caused by a flaw in the tool.

Scenario 1: the report recipient goes on holiday

A report is received on the first day of the sole committee member’s two-week absence. The 7-day deadline for acknowledging receipt passes without a response. The whistleblower receives no acknowledgement — and is entitled to conclude that the internal channel does not work.

Safeguard: describe a substitution procedure with automatic notification forwarding.

Scenario 2: the report concerns a committee member

A report concerns the sole member of a one-person committee — and goes directly to that person. There is no penalty for this, but the whistleblower bypasses the internal channel and goes to a public authority or the media. The company loses control of the narrative.

Safeguard: create a separate channel and name an impartial person (e.g. a management board member who is not on the committee).

Scenario 3: two companies at one address

Two group companies use the same platform. A person employed by company A joins company B’s committee without authorisation from the controller and without a legal basis for sharing data between the entities.

Safeguard: separate the instances, issue authorisations from the appropriate controller, and document the legal basis for sharing the data.

Scenario 4: the platform provider can see report content

The provider retains super-administrator rights. Technically, its personnel can access the environment containing report content — yet the data processing agreement says nothing about this.

Safeguard: negotiate the disabling or transfer of super-administrator rights. If access is retained — specify its scope in the data processing agreement, require named authorisations, and log every access.

Scenario 5: “anonymity" in a small team

A report is formally anonymous, but its content clearly identifies its author. In a small team, procedural anonymity is not actual anonymity. Small scale reduces the likelihood of a confidentiality breach but increases its impact on the individual concerned.

Safeguard: accepting anonymous reports is not a statutory obligation — it is an optional element of the procedure. Regardless of the decision, protect the confidentiality of the whistleblower’s identity by restricting access and training authorised people.

Data protection impact assessment (DPIA) — why it is mandatory regardless of scale

Whistleblowing systems are included in the list issued by the President of the Personal Data Protection Office (Polish Monitor 2019, item 666, point 9). A data protection impact assessment is mandatory regardless of the number of employees or the expected number of reports (DPIA in the context of reporting breaches — Personal Data Protection Office).

Regardless of the list, at least two criteria from the European Data Protection Board’s WP248 rev.01 guidelines are met:

1. Data of a highly personal nature — reports may contain information about breaches of law, workplace relationships, and people’s conduct
2. Vulnerable data subjects — whistleblowers are employees, associates, and candidates — people who are dependent on the entity they are reporting

The DPIA must be conducted before the channel is launched and reviewed at least once every 12 months and whenever the provider, architecture, or committee membership changes.

In the case analysed, the DPIA risk register contained 14 entries. After implementing the highest-priority measures, the residual risk fell to a medium level — allowing the channel to be launched without prior consultation with the President of the Personal Data Protection Office (Article 36 of the GDPR).

We can help you with this

Whether a reporting channel is compliant depends on its organisational model — who receives reports, who investigates them, who provides advice, and how the data is secured. The tool is only one component.

We support Polish subsidiaries and branches of international groups through three service options:

We combine employment law, the GDPR, and the Whistleblower Protection Act in a single process — because these three areas intersect when managing a reporting channel.

Contact us

A reporting channel is not an IT project — it is an organisational project

A Polish subsidiary has its own obligations, which the group cannot fulfil on its behalf. The procedure, workforce consultation, register, DPIA, authorisations, and training are local tasks, regardless of how efficient the tool provided by headquarters may be.

The three most serious risks in the case analysed did not concern the platform. They concerned a one-person committee, the unresolved role of the group’s legal department, and a register maintained in a spreadsheet on a shared drive.

If you are launching a reporting channel or want to check whether an existing one meets the requirements — contact us. We will help you define roles, prepare the procedure, conduct the workforce consultation, and complete the DPIA before launch.

Frequently asked questions

Does our lawyer or the group’s legal department have to sit on the committee?
No. The Act does not require a lawyer to be a committee member. It requires an authorised person to receive reports and an impartial person responsible for follow-up measures. The group’s legal department may act in an advisory capacity — provided that this role is included in the procedure, advice is based on anonymised facts, and the people on the group’s side have written authorisations and confidentiality undertakings before accessing any identifying information.

The group has a functioning system in another country — how much of it can I transfer to the Polish company?
You can transfer the tool (the platform). You cannot transfer the procedure, workforce consultation, reports register, DPIA, or authorisations. Each of these elements must be established at the level of the Polish legal entity. Directive (EU) 2019/1937 permits resources to be shared only by entities employing 50–249 people, while maintaining confidentiality and independence (Directive (EU) 2019/1937).

Do we have to accept anonymous reports?
No. Anonymous reports are an optional element of the procedure — a design decision, not a statutory obligation. In a small entity, the content of the report will usually identify its author anyway. Regardless of your decision, protect the confidentiality of the whistleblower’s identity by restricting access and training authorised people.

Is a data protection impact assessment (DPIA) mandatory where the scale of processing is small?
Yes. Whistleblowing systems are included in the list issued by the President of the Personal Data Protection Office (Polish Monitor 2019, item 666, point 9). The obligation to conduct a DPIA does not depend on the number of employees or the expected number of reports. At least two criteria from the European Data Protection Board’s guidelines are met: data of a highly personal nature and data concerning vulnerable individuals.

What may I personally face if a whistleblower’s identity is leaked?
Disclosing a whistleblower’s identity without their consent is a criminal offence punishable by a fine, restriction of liberty, or imprisonment for up to one year (Article 56 of the Act). Liability is personal — it applies to the specific person who disclosed the data, not only to the organisation.

Is a form in an office tool or a company email inbox sufficient as a reporting channel?
A free form created in an office tool is not acceptable — there is no data processing agreement or guarantee of confidentiality. A dedicated email address used as the sole channel also fails to meet the requirements: correspondence is not confidential, people outside the organisation have no access, and there is no way to communicate with an anonymous whistleblower. The channel must ensure confidentiality, accessibility, and two-way communication.