{"id":3220,"date":"2026-08-24T13:22:40","date_gmt":"2026-08-24T13:22:40","guid":{"rendered":"https:\/\/sawaryn.com\/publikacje\/whistleblowers-in-the-workplace-employer-obligations-and-what-you-need-to-implement-before-it-is-too-late\/"},"modified":"2026-08-24T13:22:40","modified_gmt":"2026-08-24T13:22:40","slug":"whistleblowers-in-the-workplace-employer-obligations-and-what-you-need-to-implement-before-it-is-too-late","status":"publish","type":"post","link":"https:\/\/sawaryn.com\/en\/publikacje\/whistleblowers-in-the-workplace-employer-obligations-and-what-you-need-to-implement-before-it-is-too-late\/","title":{"rendered":"Whistleblowers in the workplace \u2013 employer obligations and what you need to implement before it is too late"},"content":{"rendered":"<p>If you manage a company employing at least 50 people, the Whistleblower Protection Act imposes specific obligations on you \u2013 and has done so since 25 September 2024. Failure to implement an internal reporting procedure carries the risk of a fine, and retaliatory action against a whistleblower can result in a sentence of up to 2 years&#8217; imprisonment. In the first six months since the Act came into force, 331 cases were submitted to the Commissioner for Human Rights, of which 111 were classified as external reports. This shows that the provisions are already working \u2013 and that employees are making use of them.   <\/p>\n<p>In this article, you will find a structured <a href=\"https:\/\/sawaryn.com\/publikacje\/jakie-obowiazki-ma-pracodawca-w-zwiazku-z-ochrona-sygnalistow\/\">list of <\/a><a href=\"https:\/\/sawaryn.com\/publikacje\/jakie-obowiazki-ma-pracodawca-w-zwiazku-z-ochrona-sygnalistow\/\">employer obligations<\/a>, requirements for reporting channels, statutory deadlines, sanctions for non-implementation, and an indicative timeline of actions. The whole thing is designed so that you can make decisions and launch implementation without unnecessary delays. <\/p>\n<h2>Basic concepts you need to know<\/h2>\n<p>Before we move on to the obligations, it is worth clarifying the terminology. The Act uses terms that have a precise legal meaning \u2013 and misinterpreting them can lead to a flawed implementation. <\/p>\n<table>\n<thead>\n<tr>\n<th style=\"text-align: left;\">Concept<\/th>\n<th style=\"text-align: left;\">Meaning<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"text-align: left;\">Whistleblower<\/td>\n<td style=\"text-align: left;\">A person reporting a breach of law who has or had a work-related connection &#8211; an employee, a contractor, an intern, a volunteer, a job candidate, a former employee, a shareholder, a member of a governing body (Article 4 <\/td>\n<p>of the Act)<br \/>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">Internal report<\/td>\n<td style=\"text-align: left;\">Passing on information about a breach of law to the legal entity concerned by the report \u2013 via an internal reporting channel<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">External report<\/td>\n<td style=\"text-align: left;\">Passing on information about a breach of law to the Commissioner for Human Rights or another public authority \u2013 without the need for a prior internal report<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">Follow-up action<\/td>\n<td style=\"text-align: left;\">Steps taken by the entity to assess the veracity of the report and remedy the breach \u2013 e.g. an investigation, an audit, a change of procedures<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">Retaliatory action<\/td>\n<td style=\"text-align: left;\">Any negative consequences for the whistleblower resulting from making a report \u2013 e.g. dismissal, demotion, bullying, being passed over for promotion<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">Legal entity<\/td>\n<td style=\"text-align: left;\">A private or public entity required to implement the procedure \u2013 an employer, a legal person, an organisational unit<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>The Act of 14 June 2024 on the Protection of Whistleblowers (Journal of Laws 2024, item 928) implements Directive (EU) 2019\/1937. It entered into force on 25 September 2024, while the provisions on external reports (Chapter 4) have applied since 25 December 2024.  <\/p>\n<h2>Which companies must implement the whistleblower provisions<\/h2>\n<p>Not every company is subject to the Act. The obligation depends on two variables: the number of people performing paid work and the sector of activity. <\/p>\n<h3>The 50-person threshold \u2013 how to calculate it<\/h3>\n<p>The obligation to establish an internal reporting procedure applies to entities for which at least 50 people perform paid work \u2013 as at 1 January or 1 July of a given year.<\/p>\n<p>The threshold includes:<\/p>\n<ol>\n<li>Employees under an employment contract \u2013 converted into full-time equivalents (two employees on half-time = 1 FTE)<\/li>\n<li>B2B contractors providing services personally \u2013 provided they do not employ other people for this type of work<\/li>\n<li>Osoby na B2B \u015bwiadcz\u0105ce us\u0142ugi osobi\u015bcie \u2013 o ile nie zatrudniaj\u0105 do tego rodzaju pracy innych os\u00f3b<\/li>\n<\/ol>\n<p>You verify the threshold only on two reference dates. The average headcount over the year is not counted. <\/p>\n<p>Each company within a corporate group is assessed separately. The 50-person threshold applies to a single legal entity, not to the entire group. <\/p>\n<h3>Sectors with no headcount threshold<\/h3>\n<p>In four sectors, the obligation to implement the procedure arises regardless of the number of employees:<\/p>\n<table>\n<thead>\n<tr>\n<th style=\"text-align: left;\">Sector<\/th>\n<th style=\"text-align: left;\">Examples of entities<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"text-align: left;\">Financial services, products and markets<\/td>\n<td style=\"text-align: left;\">Fintechs, payment institutions, investment funds<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\"><a href=\"https:\/\/sawaryn.com\/publikacje\/kto-ma-obowiazek-wdrozyc-aml-w-swojej-firmie\/\">Anti-money laundering (AML\/CFT)<\/a><\/td>\n<td style=\"text-align: left;\">Currency exchange offices, accounting firms, real estate agents<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">Transport safety<\/td>\n<td style=\"text-align: left;\">Carriers, transport infrastructure operators<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">Ochrona \u015brodowiska<\/td>\n<td style=\"text-align: left;\">Firmy zajmuj\u0105ce si\u0119 gospodark\u0105 odpadami, emisjami<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>If your company operates in one of these sectors \u2013 the 50-person threshold does not apply to you. You implement the procedure regardless of the size of your team. <\/p>\n<h3>Public entities and exceptions<\/h3>\n<p>All public sector entities must implement internal reporting procedures. An exception applies to organisational units of municipalities or counties with fewer than 10,000 residents \u2013 these are exempt from the obligation. <\/p>\n<p>Companies below the 50-person threshold that are not public entities and do not operate in<strong><a href=\"https:\/\/sawaryn.com\/publikacje\/ktore-firmy-sa-objete-ustawa-o-sygnalistach\/\"> high-risk sectors<\/a><\/strong> are not required to implement the procedure. They may do so voluntarily (Article 24(2) of the Act). It is worth considering this option \u2013 a whistleblower at a company without an internal procedure may go straight to the Commissioner for Human Rights or another public authority, which means losing control over the process of clarifying the breach.  <\/p>\n<h2>What exactly you need to prepare: employer obligations<\/h2>\n<p>The Act imposes sixteen separate obligations on the employer. Below, I present them in implementation order. <\/p>\n<table>\n<thead>\n<tr>\n<th style=\"text-align: left;\">No.<\/th>\n<th style=\"text-align: left;\">Obligation<\/th>\n<th style=\"text-align: left;\">Legal basis<\/th>\n<th style=\"text-align: left;\">Deadline<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n1<\/p>\n<td style=\"text-align: left;\">Verifying whether the company exceeds the 50-person threshold or operates in a high-risk sector<\/td>\n<td style=\"text-align: left;\"><\/td>\n<td style=\"text-align: left;\">Articles 23\u201324<\/td>\n<td style=\"text-align: left;\">Ongoing (1 January \/ 1 July)<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">2<\/td>\n<td style=\"text-align: left;\">Drafting the internal reporting procedure<\/td>\n<td style=\"text-align: left;\">Articles 24\u201325<\/td>\n<td style=\"text-align: left;\">Before consultations<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">3<\/td>\n<td style=\"text-align: left;\">Consultations with trade unions or employee representatives<\/td>\n<td style=\"text-align: left;\">Article 24(3)<\/td>\n<td style=\"text-align: left;\">5\u201310 days from presenting the draft<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">4<\/td>\n<td style=\"text-align: left;\">Adopting the procedure and communicating it to employees<\/td>\n<td style=\"text-align: left;\">Article 24<\/td>\n<td style=\"text-align: left;\">After consultations are completed<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">5<\/td>\n<td style=\"text-align: left;\">Observing the internal vacatio legis (7 days)<\/td>\n<td style=\"text-align: left;\">Article 24<\/td>\n<td style=\"text-align: left;\">7 days from announcement<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">6<\/td>\n<td style=\"text-align: left;\">Establishing reporting channels (written and oral)<\/td>\n<td style=\"text-align: left;\">Articles 25\u201326<\/td>\n<td style=\"text-align: left;\">Before launching the procedure<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">7<\/td>\n<td style=\"text-align: left;\">Appointing an impartial unit\/person to receive reports<\/td>\n<td style=\"text-align: left;\">Article 25(1)<\/td>\n<td style=\"text-align: left;\">Before launching the procedure<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">8<\/td>\n<td style=\"text-align: left;\">Launching the internal reports register<\/td>\n<td style=\"text-align: left;\">Article 28<\/td>\n<td style=\"text-align: left;\">From the first day the system operates<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">9<\/td>\n<td style=\"text-align: left;\">Confirming receipt of the report to the whistleblower<\/td>\n<td style=\"text-align: left;\">Article 25(1)(5)  <\/td>\n<td style=\"text-align: left;\">7 days from receiving the report<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">10<\/td>\n<td style=\"text-align: left;\">Taking follow-up action with due diligence<\/td>\n<td style=\"text-align: left;\">Article 25(1)(6)  <\/td>\n<td style=\"text-align: left;\">Ongoing<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">11<\/td>\n<td style=\"text-align: left;\">Providing feedback to the whistleblower<\/td>\n<td style=\"text-align: left;\">Article 25(1)(7)  <\/td>\n<td style=\"text-align: left;\">Max. 3 months from confirmation <\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">12<\/td>\n<td style=\"text-align: left;\">Informing job applicants about the procedure<\/td>\n<td style=\"text-align: left;\">Article 48<\/td>\n<td style=\"text-align: left;\">At the recruitment stage<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">13<\/td>\n<td style=\"text-align: left;\">Ensuring protection against retaliatory action<\/td>\n<td style=\"text-align: left;\">Articles 11-14<\/td>\n<td style=\"text-align: left;\">Ongoing<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">14<\/td>\n<td style=\"text-align: left;\">Documenting HR decisions concerning whistleblowers<\/td>\n<td style=\"text-align: left;\">Article 14<\/td>\n<td style=\"text-align: left;\">Ongoing<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">15<\/td>\n<td style=\"text-align: left;\">Issuing written authorisations to persons handling reports<\/td>\n<td style=\"text-align: left;\">Article 27<\/td>\n<td style=\"text-align: left;\">Before launching the procedure<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">16<\/td>\n<td style=\"text-align: left;\">Training for persons handling reports and for employees<\/td>\n<td style=\"text-align: left;\">Good practice<\/td>\n<td style=\"text-align: left;\">Periodically<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>It is worth highlighting point 13: the reversed burden of proof means that the employer must demonstrate that action taken against the whistleblower was not retaliation for the report. This is why documenting HR decisions (point 14) is so important &#8211; without it, defending against claims from the whistleblower will be difficult. <\/p>\n<h2>Internal reporting channel &#8211; statutory requirements and practice<\/h2>\n<p>Article 26 of the Act requires the procedure to allow reports in at least two forms: written (paper or electronic) and oral (by telephone, via a voice messaging system, or during a meeting). <\/p>\n<h3>How to document oral reports<\/h3>\n<p>The method of documentation depends on the form of contact:<\/p>\n<table>\n<thead>\n<tr>\n<th style=\"text-align: left;\">Form of oral report<\/th>\n<th style=\"text-align: left;\">Method of documentation<\/th>\n<th style=\"text-align: left;\">Whistleblower&#8217;s rights<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"text-align: left;\">Recorded phone line<\/td>\n<td style=\"text-align: left;\">Recording (with consent) or full transcript<\/td>\n<td style=\"text-align: left;\">Right to review, correct and approve the transcript<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">Unrecorded phone line<\/td>\n<td style=\"text-align: left;\">Written record of the call<\/td>\n<td style=\"text-align: left;\">Right to review, correct and approve the record<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">In-person meeting<\/td>\n<td style=\"text-align: left;\">Recording (with consent) or minutes of the meeting<\/td>\n<td style=\"text-align: left;\">Meeting arranged within 14 days of the whistleblower&#8217;s request<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h3>Elements that the procedure must contain<\/h3>\n<p>Article 25(1) of the Act requires the internal reporting procedure to contain eight elements:  <\/p>\n<ol>\n<li>Designation of the unit or person responsible for receiving reports (this may also be an external entity)<\/li>\n<li>Methods of submitting reports, together with contact details<\/li>\n<li>Designation of an impartial unit or person authorised to take follow-up action<\/li>\n<li>Procedure for handling anonymous reports &#8211; the entity decides whether to accept them, but the procedure must specify how they are to be handled<\/li>\n<li>Obligation to confirm receipt of the report within 7 days<\/li>\n<li>Obligation to take follow-up action with due diligence<\/li>\n<li>Maximum time limit for feedback &#8211; 3 months<\/li>\n<li>Information on the possibility of making external reports to the Commissioner for Human Rights or other authorities<\/li>\n<\/ol>\n<p>Optionally, you can extend the procedure to cover additional categories of breaches (Article 25(2)) and a system of incentives for using internal channels.<\/p>\n<h3>Confidentiality and data protection<\/h3>\n<p>Article 27 of the Act requires the reporting system to prevent unauthorised persons from accessing information covered by the report. This means:  <\/p>\n<ol>\n<li>Protecting the identity of the whistleblower, the person named in the report, and third parties<\/li>\n<li>Allowing only persons with written authorisation to handle reports<\/li>\n<li>An obligation of confidentiality for authorised persons &#8211; also after the end of their employment<\/li>\n<li>The need to carry out a<a href=\"https:\/\/sawaryn.com\/publikacje\/jak-skutecznie-zarzadzac-naruszeniami-danych-osobowych-w-erze-ai\/\"> data processing risk analysis<\/a> (GDPR)<\/li>\n<li>Preparing information clauses for whistleblowers and persons concerned by the report<\/li>\n<li>Concluding a <a href=\"https:\/\/sawaryn.com\/publikacje\/twoje-dane-w-obcych-rekach-jak-bezpiecznie-powierzac-przetwarzanie-danych\/\">data processing agreement<\/a>, if you use an external platform<\/li>\n<\/ol>\n<p><a href=\"https:\/\/sawaryn.com\/en\/contact\/\">Contact us<\/a><\/p>\n<h2>Procedure for accepting and handling reports &#8211; the minimum that protects the company<\/h2>\n<p>The procedure must be in writing and form an annex to an internal act (e.g. an order). In addition to the mandatory elements under Article 25, it should include document templates: confirmation of receipt of the report, a feedback template, GDPR information clauses, and data processing authorisations.  <\/p>\n<h3>Hard statutory deadlines<\/h3>\n<table>\n<thead>\n<tr>\n<th style=\"text-align: left;\">Action<\/th>\n<th style=\"text-align: left;\">Deadline<\/th>\n<th style=\"text-align: left;\">Legal basis<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"text-align: left;\">Confirmation of receipt of the report<\/td>\n<td style=\"text-align: left;\">7 days from receipt<\/td>\n<td style=\"text-align: left;\">Article 25(1)(5)<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">Feedback to the whistleblower<\/td>\n<td style=\"text-align: left;\">Max. 3 months from confirmation <\/td>\n<td style=\"text-align: left;\">Article 25(1)(7)  <\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">In-person meeting at the whistleblower&#8217;s request<\/td>\n<td style=\"text-align: left;\">14 days from receipt of the request<\/td>\n<td style=\"text-align: left;\">Article 26<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">Forwarding the report to the competent authority (if the entity is not the appropriate one)<\/td>\n<td style=\"text-align: left;\">14 days (up to 30 days in justified cases)<\/td>\n<td style=\"text-align: left;\">The Act<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">Storing data in the reports register<\/td>\n<td style=\"text-align: left;\">3 years after the end of the year in which follow-up action was closed<\/td>\n<td style=\"text-align: left;\">Article 28<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h3>Who should handle reports<\/h3>\n<p>You have three options:<\/p>\n<ol>\n<li>Internal committee &#8211; made up of company employees. Requires ensuring impartiality &#8211; the designated person cannot be involved in the area to which the report relates <\/li>\n<li>External entity &#8211; e.g. a law firm. Provides independence and experience in conducting investigations. The whistleblower&#8217;s data remains with the external entity, which makes it easier to maintain confidentiality  <\/li>\n<li>Mixed model &#8211; employer representative + external lawyer. Combines knowledge of the organisation with an independent legal perspective <\/li>\n<\/ol>\n<p>Regardless of the model chosen, before making any HR decision regarding the whistleblower, additional consultation with the legal or compliance department is recommended. The reversed burden of proof means that any such decision must be thoroughly justified and documented. <\/p>\n<h3>Anonymous reports &#8211; a decision to be made<\/h3>\n<p>Article 7 of the Act gives the entity the option (not the obligation) to accept anonymous reports. However, the procedure must specify how they are to be handled &#8211; this is a mandatory element.  <\/p>\n<p>The government administration recommends accepting anonymous reports as good practice. From the perspective of a technology company, this makes sense: an anonymous channel increases the chance of detecting breaches that management would not otherwise know about, and reduces the risk of the whistleblower going straight to an external authority or the media. <\/p>\n<h2>Implementation timeline: what to do in the first week, month and quarter<\/h2>\n<p>The Act does not directly contain an operational implementation timeline. The plan below is based on interpretations from the Ministry of Family, Labour and Social Policy and the National Labour Inspectorate. <\/p>\n<p>Whistleblower protection (the prohibition on retaliatory action) has applied since 25 September 2024. The Ministry has indicated the need to implement an internal reporting system by 1 January 2025. If you have not yet implemented the procedure, act immediately, because the obligations are already in force.<\/p>\n<h3>Week 1: diagnosis and decisions<\/h3>\n<ol>\n<li>Verify whether your company exceeds the 50-employee threshold (as at 1 January or 1 July)<\/li>\n<li>Check whether you operate in a high-risk sector (finance, AML, transport, environmental protection)<\/li>\n<li>Decide on the reporting handling model: internal, external, or mixed<\/li>\n<li>Designate a person responsible for coordinating implementation<\/li>\n<li>Decide whether you will accept anonymous reports<\/li>\n<\/ol>\n<h3>Month 1: preparing the procedure and channels<\/h3>\n<ol>\n<li>Draft the internal reporting procedure (in accordance with Article 25)<\/li>\n<li>Conduct consultations with trade unions or employee representatives (5-10 days)<\/li>\n<li>Prepare document templates: confirmation of receipt, feedback, GDPR clauses, authorisations<\/li>\n<li>Choose and launch reporting channels (online platform, email address, phone line, meetings)<\/li>\n<li>Issue written authorisations to persons handling reports<\/li>\n<li>Adopt the procedure and communicate it to employees (internal vacatio legis: 7 days)<\/li>\n<\/ol>\n<h3>Quarter 1: launch and training<\/h3>\n<ol>\n<li>Launch the internal reports register<\/li>\n<li>Conduct training for persons handling reports &#8211; confidentiality rules, deadlines, documentation<\/li>\n<li>Train managers and the HR department &#8211; prohibition of retaliatory action, documenting HR decisions, reversed burden of proof<\/li>\n<li>Inform job candidates about the procedure (update recruitment advertisements)<\/li>\n<li>Test the reporting channels &#8211; check that they work and that confirmations are sent on time<\/li>\n<li>Schedule a periodic review of the system &#8211; at least once a year<\/li>\n<\/ol>\n<h2>Consequences of non-implementation &#8211; sanctions and risks<\/h2>\n<p>The Act provides for criminal sanctions for breach of obligations. Below is a summary: <\/p>\n<table>\n<thead>\n<tr>\n<th style=\"text-align: left;\">Breach<\/th>\n<th style=\"text-align: left;\">Sanction<\/th>\n<th style=\"text-align: left;\">Legal basis<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"text-align: left;\">Failure to establish an internal reporting procedure<\/td>\n<td style=\"text-align: left;\">Fine<\/td>\n<td style=\"text-align: left;\">Article 58<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">Obstructing the making of a report<\/td>\n<td style=\"text-align: left;\">Up to 1 year imprisonment<\/td>\n<td style=\"text-align: left;\">The Act<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">Aggravated obstruction of a report (using violence, threat or deception)<\/td>\n<td style=\"text-align: left;\">Up to 3 years imprisonment<\/td>\n<td style=\"text-align: left;\">The Act<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">Retaliatory action against a whistleblower<\/td>\n<td style=\"text-align: left;\">Up to 2 years imprisonment<\/td>\n<td style=\"text-align: left;\">The Act<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">Disclosure of a whistleblower&#8217;s identity<\/td>\n<td style=\"text-align: left;\">Up to 1 year imprisonment<\/td>\n<td style=\"text-align: left;\">The Act<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">Making a false report (by the whistleblower)<\/td>\n<td style=\"text-align: left;\">Up to 2 years imprisonment<\/td>\n<td style=\"text-align: left;\">Article 57<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h3>Financial and reputational risks<\/h3>\n<p>Beyond criminal sanctions, failing to implement the procedure generates additional risks:<\/p>\n<ol>\n<li>Compensation for the whistleblower &#8211; in an amount no lower than the average monthly salary in the national economy in the previous year (Article 14 of the Act). In addition, there is a right to compensation for the harm suffered <\/li>\n<li>Ineffectiveness of termination &#8211; a termination or dismissal made because of a report is ineffective. This means the employee must be reinstated and paid remuneration for the period without work <\/li>\n<li>External reporting risk &#8211; the lack of an internal procedure means employees direct their reports straight to the Commissioner for Human Rights or other authorities. The company loses control over the process of investigating the breach <\/li>\n<li>Reputational and ESG risk &#8211; in the context of<strong><a href=\"https:\/\/sawaryn.com\/publikacje\/ustawa-o-ochronie-sygnalistow-a-esg\/\"> ESG reporting<\/a><\/strong> and investor due diligence, the lack of a whistleblower protection system may lower a company&#8217;s rating and make it harder to obtain financing<\/li>\n<\/ol>\n<p>Data from the Commissioner for Human Rights covering the first six months of the Act&#8217;s operation (331 cases, 111 external reports) show that employees are actively using their new rights. Companies without an implemented procedure are particularly exposed &#8211; because every report goes straight outside <\/p>\n<h2>Why implementation is a business safeguard, not just an obligation<\/h2>\n<p>The whistleblower acts in the public interest or in the interest of the organisation. They are driven by a wish to help the company they are connected with in some way. Implementing whistleblower regulations can be beneficial for companies &#8211; thanks to the actions of whistleblowers, companies have a chance to discover and solve problems they are often unaware of, which affect their financial results  <\/p>\n<p>A well-designed <a href=\"https:\/\/sawaryn.com\/publikacje\/sygnalista-w-firmie-jak-wdrozyc-dyrektywe-o-sygnalistach\/\">internal reporting procedure <\/a>allows you to:<\/p>\n<ol>\n<li>Detect breaches at an early stage &#8211; before they escalate to external authorities or the media<\/li>\n<li>Limit the risk of financial losses resulting from corruption, abuse or regulatory breaches<\/li>\n<li>Build an organisational culture based on transparency &#8211; which matters when attracting investors and business partners<\/li>\n<li>Document due diligence in risk management &#8211; which can limit the board&#8217;s liability<\/li>\n<\/ol>\n<h2>Legal support for companies in whistleblower protection &#8211; how we can help<\/h2>\n<p>Implementing a whistleblower protection system is a process that requires consistency between documents, reporting channels, training and everyday practices within the company. It is not enough to prepare a procedure &#8211; it must be embedded in the organisation&#8217;s reality <\/p>\n<p>We support technology companies and growing organisations in:<\/p>\n<ol>\n<li>Verifying the entity&#8217;s status and analysing obligations arising from the Act<\/li>\n<li>Developing an internal reporting procedure tailored to the business model<\/li>\n<li>Selecting and launching reporting channels<\/li>\n<li>Preparing documentation: templates, authorisations, GDPR clauses<\/li>\n<li>Training for managers, HR and persons handling reports<\/li>\n<li>Ongoing support in handling reports and follow-up actions<\/li>\n<\/ol>\n<p>If you need legal support for your company in implementing whistleblower regulations &#8211; from diagnosis to launching the system &#8211; <strong><a href=\"https:\/\/sawaryn.com\/en\/contact\/\">get in touch with us<\/a><\/strong><\/p>\n<h2>Summary<\/h2>\n<p>The Whistleblower Protection Act is in force. Companies employing at least 50 people and entities from high-risk sectors must have implemented an internal reporting procedure, reporting channels, a register and a system protecting whistleblowers from retaliatory action. Sanctions for failure to implement include a fine, and for retaliatory action &#8211; up to 2 years imprisonment  <\/p>\n<p>Check whether your company is subject to the Act. If so &#8211; start the implementation. If you need legal support, <a href=\"https:\/\/sawaryn.com\/en\/contact\/\">get in touch with us<\/a>  <\/p>\n<h2>Frequently asked questions<\/h2>\n<p><strong>Does a company employing 48 people on employment contracts and 5 people on B2B need to implement a procedure?<\/strong><br \/>\nYes, if the total number of persons performing paid work reaches 50. The threshold includes employees converted to full-time equivalents as well as persons on civil-law contracts and B2B (each counted as 1 person, provided they perform the work personally). In this example, the total number is 53 people &#8211; the threshold is exceeded  <\/p>\n<p><strong>Do I have to accept anonymous reports?<\/strong><br \/>\nNo &#8211; it&#8217;s your decision. Article 7 of the Act gives the entity the option, not the obligation, to accept anonymous reports. However, the procedure must specify how to handle them &#8211; this is a mandatory element. The government administration recommends accepting anonymous reports as good practice, as it reduces the risk that the whistleblower will take the matter directly to an external authority    <\/p>\n<p><strong>How much time do I have to respond to the whistleblower?<\/strong><br \/>\nYou must send confirmation of receipt of the report within 7 days of receiving it (unless the whistleblower did not provide a contact address). You must provide feedback on the follow-up actions taken within a maximum of 3 months from the date of confirming receipt of the report <\/p>\n<p><strong>Can I entrust the handling of reports to an external law firm?<\/strong><br \/>\nYes. Article 25(1) of the Act allows an external entity to be designated as the unit responsible for accepting reports and taking follow-up actions. This requires concluding a data processing agreement compliant with GDPR. The external law firm keeps the whistleblower&#8217;s data with itself, which makes it easier to maintain confidentiality     <\/p>\n<p><strong>What are the penalties for failing to implement the procedure?<\/strong><br \/>\nFailing to establish an internal reporting procedure carries a fine (Article 58 of the Act). Obstructing the making of a report carries up to 1 year imprisonment. Retaliatory action against a whistleblower carries up to 2 years imprisonment. The whistleblower has the right to compensation of no less than the average monthly salary in the national economy   <\/p>\n<p><strong>How often should I review and update the procedure?<\/strong><br \/>\nThe Act does not directly specify the frequency of reviews. The recommended minimum is once a year &#8211; taking into account changes in regulations, experience from handling reports and employee feedback. The review should include checking whether the reporting channels are working properly, whether deadlines are being met, and whether the persons handling reports have completed up-to-date training  <\/p>\n","protected":false},"excerpt":{"rendered":"<p>Learn about employer obligations towards whistleblowers: deadlines, reporting channels, sanctions and an implementation plan in line with the Act<\/p>\n","protected":false},"author":9,"featured_media":3202,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1442],"tags":[1450,1448,1444,1446,1451,1452,1443,1449,1445,1447],"specialization":[1212],"practice_area":[],"class_list":["post-3220","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-labor-law","tag-commissioner-for-human-rights","tag-compliance","tag-employer-obligations","tag-gdpr","tag-internal-reports","tag-legal-sanctions","tag-reporting-channels","tag-retaliatory-action","tag-whistleblower-protection","tag-whistleblower-protection-act","specialization-labor-law"],"acf":[],"_links":{"self":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts\/3220","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/users\/9"}],"replies":[{"embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/comments?post=3220"}],"version-history":[{"count":0,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts\/3220\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/media\/3202"}],"wp:attachment":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/media?parent=3220"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/categories?post=3220"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/tags?post=3220"},{"taxonomy":"specialization","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/specialization?post=3220"},{"taxonomy":"practice_area","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/practice_area?post=3220"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}