Key terms before you begin
Before you begin implementing a whistleblowing procedure, it helps to clarify the terminology. The statute uses several terms with specific consequences for your business.
| Term | What it means for your business |
|---|---|
| Whistleblower | A person reporting a breach of law: an employee, contractor, trainee, volunteer, member of a corporate body, former employee, or even a person applying for a job. |
| Internal report | A report of a breach of law made to the employer through a dedicated channel, in writing, orally, or electronically. |
| External report | A report made to the Commissioner for Human Rights or another public authority. A whistleblower is entitled to use this route if the internal channel does not work or produces no result. |
| Follow-up action | Steps taken by the company after receiving a report, such as an investigation, inspection, correction of procedures, or closure of the case. |
| Internal reporting procedure | A document setting out how reports are received, handled, and recorded. Implementing it is a legal obligation for the employer. |
| Report register | A record of all internal reports, including dates, case descriptions, and follow-up information. Keep it for three years after the end of the year in which the case was closed. |
With these terms in mind, you can move on to implementation. The four steps below are arranged in the order in which they should be completed.
Step 1: audit your workforce. Count everyone, not only employees
First determine whether your company is subject to the obligation at all. The threshold is at least 50 people performing work for remuneration, but the counting rules are not self-evident.
Who counts toward the threshold
Determine the headcount as of 1 January or 1 July of a given year. Include:
- Employees under employment contracts, calculated as full-time equivalents. Someone working 0.5 full-time equivalent counts as 0.5.
- People working under civil-law service contracts and B2B arrangements, provided they do not employ their own staff to perform the same work. A sole trader without employees counts; a company team engaged to deliver a service does not.
- Trainees and volunteers performing work for the entity for remuneration.
Who does not count
- Subcontractors and contractors who employ their own workers to provide the service.
- Temporary agency workers. The obligation rests with the agency.
Sector-specific exceptions: the obligation applies without a headcount threshold
If your company operates in one of the sectors below, the 50-person threshold does not apply. You must implement a procedure regardless of headcount. This includes entities required to implement the procedure regardless of the number of people employed.
| Sector | Examples of entities |
|---|---|
| Financial services and markets | Banks, investment funds, audit firms, leasing providers, and insurance distributors. |
| Obliged entities under AML rules | Accounting firms, real estate brokers, currency and cryptocurrency exchanges, and entities accepting cash payments of at least EUR 10,000. |
| Transport safety | Entities regulated in respect of transport safety. |
| Environmental protection | Entities in the environmental protection sector. |
Step 1 outcome
Prepare a workforce-audit document showing the reference date, categories of people counted, full-time-equivalent calculation, and conclusion: “the company is subject to the obligation” or “the company is not subject to the obligation, subject to sector-specific exceptions.” Keep this document. If the National Labour Inspectorate (PIP) carries out an inspection, it can show that you checked your status.
Step 2: reporting channels. Written, oral, and electronic
The statute requires the procedure to describe how reports are submitted, in the plural. Your company must therefore provide at least two types of channel: written and oral. Providing only one channel breaches Article 25(1) of the statute and may constitute obstructing a report, an offence punishable by a fine.
Types of channels and when to use them
| Channel type | Format | Examples | Particularly useful for |
|---|---|---|---|
| Traditional written | Paper | Postal correspondence marked “WHISTLEBLOWER” and kept outside the ordinary mail workflow; a physical reporting box. | Organizations with employees who do not have access to digital tools. |
| Electronic written | Digital | A dedicated email address, a website form, or a reporting platform supporting anonymous two-way communication. | Technology companies, distributed teams, and anonymous reports. |
| Oral | Voice | A dedicated telephone line or an in-person meeting with an authorized person, within 14 days of the request. | Urgent matters, including health and safety risks, and reports that need clarification. |
Why provide more than one channel
Data from the Commissioner for Human Rights for the first quarter in which the rules applied, from 27 December 2024 to 31 March 2025, show that 18 of 79 external reports meeting the statutory criteria were anonymous, or 23%. Without an anonymous channel, almost one in four potential whistleblowers may skip the internal route and report directly to the Commissioner. An oral channel, in turn, allows an immediate response when quick clarification is needed. PIP says the procedure must allow follow-up contact with the whistleblower; a telephone call or meeting is the fastest way to clarify a report.
Choose channels in proportion to the size of the organization. A company with 55 people does not need to invest in an advanced platform. A dedicated email address and an opportunity to arrange a conversation with a designated person may be enough. A larger organization should consider a platform for anonymous correspondence, using a unique identifier without disclosing personal data.
Requirements for every channel
Regardless of format, every channel must meet five requirements:
- Protect the whistleblower’s identity through encryption and restricted access to information.
- Allow two-way communication so the whistleblower can receive a response.
- Confirm receipt of the report within seven days.
- Provide feedback on follow-up action within three months after confirming receipt.
- Support keeping a register of reports.
If an electronic channel is intended to allow anonymous reports, it must prevent the reporting person’s identifying data from being traced, including the computer’s IP address and device parameters.
Decision on anonymous reports
The statute permits anonymous reports, but your company decides whether to accept and investigate them. Investigating anonymous reports is not mandatory; investigating reports that contain the whistleblower’s personal data is mandatory. Record the decision in the internal reporting procedure.
Step 2 outcome
Prepare a list of the selected channels, describing their format, how to access them, and how they are handled. Record the board’s decision on anonymous reports, yes or no. Prepare a technical specification for the electronic channel, if applicable.
Contact us for help choosing channels suited to the size and structure of your company.
Step 3: the internal procedure. Required content, consultation, and board approval
The internal reporting procedure is the central document in the system. Article 25(1) of the Polish Whistleblower Protection Act lists eight mandatory elements. An inspection may challenge a procedure that omits them.
Eight mandatory elements of the procedure
| No. | Element | What to include |
|---|---|---|
| 1 | Entity responsible for receiving reports | An internal organizational unit, designated person, or external entity, such as a law firm, acting under an agreement with confidentiality clauses. |
| 2 | How reports are submitted | Description of written, oral, and electronic channels, including addresses, telephone numbers, and links. |
| 3 | Impartial person or unit handling follow-up | A person independent from anyone who may be concerned by a report and not directly involved in the area covered by it. |
| 4 | Rules for anonymous reports | Whether the company accepts and investigates them, yes or no, with reasons. |
| 5 | Contact with the whistleblower | Receipt confirmation within seven days, feedback within three months, and the method for follow-up contact. |
| 6 | Catalogue of follow-up actions | An investigation, inspection, administrative proceedings, filing charges, recovery of funds, and closure of the proceedings. |
| 7 | Information about external reports | A statement that the whistleblower may report a breach to the Commissioner for Human Rights or another public authority. |
| 8 | Confidentiality and data protection | GDPR compliance, restricted access, and the retention period: three years after the end of the year in which the case was closed. |
Who must be consulted
Before adopting the procedure, you must conduct consultations. This is required by Article 24(3) of the statute. The order of consultation is:
- The workplace trade union organization, if one operates in the company.
- All workplace trade union organizations, if there is more than one.
- Employee representatives selected under the procedure adopted in the company, if there is no trade union.
If there is no trade union, you must select representatives. The statute refers to “representatives” in the plural; at least two people are recommended. Once selected, representatives may take part in later consultations without a new election. This is useful because the legislature increasingly requires such consultation, including on remote work, GDPR, and whistleblowing.
To select representatives, notify employees of the need to elect them by email or noticeboard; allow nominations; hold a vote, openly at a meeting in a small company or electronically in a larger one, provided all employees can participate; and prepare minutes recording the result.
Consultation period and effect
Consultations last from five to ten days after the draft procedure is presented, under Article 24(4). They are mandatory but not binding. The employer is not required to accept any employee suggestions; it is enough that the procedure was consulted on. The final content is for the employer to decide. After the consultation, prepare minutes signed by the employee representatives or trade union organization.
Formal adoption of the procedure
The statute does not prescribe a particular form of adoption. In a limited liability company (sp. z o.o.), the most common form is a board resolution. A board order is an alternative, depending on the company’s decision-making practice. The resolution should include:
- A title and date.
- Reasons, referring to the Act of 14 June 2024.
- Information about consultations: with whom, when, and their result.
- The procedure as an attachment.
- The date on which the procedure takes effect.
- Signatures of the people authorized to represent the company.
Senior management must approve the procedure before it is put into use. In a limited liability company, this means the management board. Detailed documents, such as instructions for handling reports and forms, may be approved by a designated person at a lower level.
Step 3 outcome
Have a completed internal reporting procedure with all eight mandatory elements, consultation minutes signed by employee representatives or the trade union, and a board resolution adopting the procedure.
Step 4: communicate with the team. Announce the procedure and make sure people know it
The procedure takes effect seven days after it is announced to people performing work, under Article 25(2) of the statute. The announcement must use the method adopted by that employer. The statute deliberately does not prescribe one form because organizations communicate differently.
Ways to announce the procedure
| Announcement method | When to use it | What to remember |
|---|---|---|
| Email to all employees and collaborators | Companies where the whole team has digital access. | Keep proof of sending and delivery; attach the procedure as a PDF. |
| Intranet or internal communications platform | Companies with a functioning intranet. | Make sure everyone has access and log the publication date. |
| Workplace noticeboard | Companies with on-site workers who lack digital tools. | Photograph the notice with the date and consider additional written confirmation. |
| Team meeting or training | Any company, as a supplement to written notice. | Prepare an attendance list and a short presentation of the key rules. |
What to tell the team
Sending the procedure is not enough. Employees and collaborators need to know:
- What the procedure covers: the company has introduced a system for reporting breaches of law under the Whistleblower Protection Act.
- Who may report: employees, contractors, trainees, volunteers, former employees, and job applicants.
- Which channels are available: email addresses, telephone numbers, platform links, and whether an in-person meeting is possible.
- What happens after a report: confirmation within seven days, feedback within three months, and confidentiality of data.
- That whistleblowers are protected by a ban on retaliation, including dismissal, demotion, a pay cut, or bullying.
- That an external report may be made to the Commissioner for Human Rights or another authority.
Confirmation that people have read the procedure
The statute does not require written confirmation that someone has read the procedure, but it is worth collecting, particularly if your company operates in a regulated sector. Options include a paper or electronic acknowledgment list, a read receipt in the HR system, or an optional short knowledge test after training.
Step 4 outcome
Keep dated proof that the procedure was announced, such as an email, screenshot, or noticeboard photograph; a list of people who have read it; and the effective date, seven days after the announcement.
Deadlines and consequences: what you need to know after implementation
Once the procedure is in operation, deadlines start running. Missing them creates legal and reputational risks. A whistleblower who receives no response may make an external report to the Commissioner for Human Rights.
Deadlines for handling reports
| Action | Deadline | Legal basis |
|---|---|---|
| Confirm receipt of a report | Seven days after receipt | Article 25(1)(5) of the statute. |
| Provide feedback on follow-up action | Three months after confirming receipt | Article 25(1)(5) of the statute. |
| Arrange an in-person meeting, at the whistleblower’s request | Within 14 days of the request | Practice arising from implementation by public entities. |
| Retain report-register data | Three years after the end of the calendar year in which follow-up was closed | Statutory requirement. |
Consequences of having no procedure or breaching it
Article 56 of the Whistleblower Protection Act provides for a fine for failing to establish an internal reporting procedure. A fine may also be imposed for obstructing a report, for example by failing to provide an accessible channel or deliberately delaying a response. For entities in the AML sector, failing to have a whistleblowing procedure is a separate administrative violation punishable under Article 147(10) of the Anti-Money Laundering Act.
In addition to legal sanctions, the absence of a procedure creates a risk that a whistleblower will go directly to the Commissioner for Human Rights or another authority. During the first quarter in which the rules applied, the Commissioner received 229 cases, of which 79 met the criteria for external reports. Some might have first gone to the employer if it had an effective internal channel.
Maintaining the procedure after implementation
Implementation is not the end. Review and update the procedure as the organization changes, business processes develop, or the law changes. Appoint someone to review the procedure at least once a year.
Corporate legal support for whistleblowing procedures
Implementing a whistleblowing procedure requires knowledge of the statute and an understanding of how your company actually operates: who reports to whom, which communication channels are used, and how the workforce is structured. We support boards and operational managers at technology and service companies in organizing this area. We work with the organization’s actual operations rather than imposing a standard template, and design a procedure suited to its operating model.
Our support includes:
- Workforce audit: checking the 50-person threshold and all categories of collaborators.
- Selection of reporting channels suited to company size and team structure.
- Preparation of a procedure containing all eight mandatory elements.
- Support with consultation, selecting employee representatives, and preparing minutes.
- Preparation of a board resolution formally adopting the procedure.
- Team communications, including information materials and acknowledgment templates.
We combine corporate legal support with operational context, including intellectual property, ownership structure, and development plans, so that the whistleblowing procedure fits with the company’s other processes. Contact us. We will guide you through the entire process, from the audit to a completed document.
A whistleblowing procedure is an obligation and an opportunity to organize communication
The four steps are a workforce audit, selection of reporting channels, preparation and formal adoption of the procedure, and communication with the team. Each step ends with a document that you can present in a PIP inspection. The deadlines are fixed: seven days to confirm receipt of a report and three months to provide feedback. Having no procedure can result in a fine. Having no channel can amount to obstructing a report and lead to another fine.
A well-implemented procedure does more than meet an obligation. It can help identify problems inside the organization earlier, before they reach the Commissioner for Human Rights or the media. If you need implementation support, contact us. We can guide you from the workforce audit through announcing the procedure to the team.
Frequently asked questions
Who counts toward the 50-person threshold for implementing a whistleblowing procedure?
Count employees under employment contracts as full-time equivalents, and people working under civil-law contracts or B2B arrangements who do not employ their own staff to perform the same work. Determine headcount as of 1 January or 1 July. Do not count subcontractors with their own teams or temporary agency workers. Financial-sector entities, AML-obliged entities, and certain other industries must implement a procedure regardless of headcount.
Does the company have to accept anonymous reports?
No. Investigating anonymous reports is not mandatory. Your company decides whether to accept and investigate them. It must investigate reports that include the whistleblower’s personal data. Record the decision on anonymous reports in the internal procedure. Commissioner data show that 23% of external reports in the first quarter were anonymous, which is worth considering.
Do employee consultations mean that I must include their comments in the procedure?
No. Consultation with a workplace trade union or employee representatives is mandatory and lasts five to ten days, but it is not binding. The employer need not accept any suggestion; the procedure only needs to have been consulted on. The final content is for the employer to decide. Prepare signed consultation minutes as evidence that the process took place.
How should the board adopt the whistleblowing procedure?
The statute does not prescribe a form. For a Polish limited liability company, the most common form is a board resolution containing its title, date, reasons, consultation information, the procedure as an attachment, and signatures of authorized representatives. A board order is an alternative. Senior management must approve the procedure before it is put into use.
How long does a company have to respond to a whistleblower?
Confirm receipt within seven days. Then provide feedback on follow-up action no later than three months after the confirmation. Missing these deadlines may lead the whistleblower to make an external report to the Commissioner, taking the investigation outside the company’s control.
What are the consequences of failing to implement a whistleblowing procedure?
Article 56 of the Whistleblower Protection Act provides for a fine for failing to establish the procedure. A fine may also apply to obstruction of a report. For AML-sector entities, the absence of a whistleblowing procedure is a separate administrative violation under Article 147(10) of the Anti-Money Laundering Act. Apart from legal sanctions, the whistleblower may go directly to the Commissioner or another public authority.
