{"id":3833,"date":"2026-08-20T12:06:07","date_gmt":"2026-08-20T12:06:07","guid":{"rendered":"https:\/\/sawaryn.com\/?p=3833"},"modified":"2026-10-26T12:46:55","modified_gmt":"2026-10-26T12:46:55","slug":"poland-whistleblowing-internal-reporting-procedure","status":"publish","type":"post","link":"https:\/\/sawaryn.com\/en\/publikacje\/poland-whistleblowing-internal-reporting-procedure\/","title":{"rendered":"Whistleblower Protection Act 2024. What Your Company Must Implement Before It Is Too Late"},"content":{"rendered":"

Your developer discovers that user data is being processed in breach of the GDPR. They search the intranet for a reporting procedure. They cannot find one. They write to the Commissioner for Human Rights. The next day, the story appears in the industry media. And you learn that you (personally) could face a fine for failing to have a procedure in place.<\/p>\n

This is not a hypothetical scenario. The Whistleblower Protection Act<\/a><\/strong> has been in force since 25 September 2024. It requires employers to implement an internal reporting procedure, establish secure reporting channels and protect whistleblowers against retaliation. Criminal liability for failure to implement the procedure is personal<\/strong>: it applies not to the company as an entity, but to the specific person responsible for establishing the procedure.<\/p>\n

In this article, you will learn who the Act applies to, what obligations it imposes<\/a>, what penalties may apply for non-compliance and what you should do to address this issue in your company, step by step.<\/p>\n

Key terms you need to know<\/h2>\n

Before we move on to the obligations, here is a brief glossary. The Act uses terms that are worth understanding from the outset.<\/p>\n\n\n\n\n\n\n\n\n\n\n
Term<\/th>\nMeaning<\/th>\n<\/tr>\n<\/thead>\n
Whistleblower<\/strong><\/td>\nAn individual who reports a breach of law discovered in a work-related context, this may be an employee, a B2B contractor, an intern, a volunteer or even a former employee<\/td>\n<\/tr>\n
Internal report<\/strong><\/td>\nA report of a breach of law made under the employer\u2019s internal procedure<\/td>\n<\/tr>\n
External report<\/strong><\/td>\nA report of a breach of law submitted to the Commissioner for Human Rights or another public authority, a whistleblower may submit it without first using the internal channel<\/td>\n<\/tr>\n
Public disclosure<\/strong><\/td>\nMaking information about a breach available to the public (e.g. the media), as a rule, this requires a prior internal or external report<\/td>\n<\/tr>\n
Retaliatory measures<\/strong><\/td>\nAny negative consequences imposed on a whistleblower because of a report, dismissal, demotion, workplace bullying, being passed over for promotion or a change in responsibilities<\/td>\n<\/tr>\n
Internal reporting procedure<\/strong><\/td>\nA written document setting out the rules for receiving, verifying and investigating reports of breaches of law within an organisation<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Who the Whistleblower Protection Act applies to<\/h2>\n

The 50-person threshold: how to calculate it<\/h3>\n

The Act applies one threshold<\/strong><\/a>: at least 50 people performing paid work<\/strong> for a legal entity (Article 23 of the Act). The Polish Act does not provide for any additional division between companies with 50 to 249 employees and those with 250+ employees. This division came from EU Directive 2019\/1937 and was only temporary; it was not transposed into national law.<\/p>\n

The total of 50 people includes:<\/p>\n

    \n
  1. Employees calculated on a full-time equivalent basis<\/strong> (not by headcount; two half-time employees equal one full-time position)<\/li>\n
  2. People performing paid work on a basis other than an employment relationship (civil-law contracts, B2B), provided that they do not employ other people to perform that work<\/strong><\/li>\n<\/ol>\n

    You must verify the threshold twice a year<\/strong>: based on the headcount as at 1 January<\/strong> and 1 July<\/strong>.<\/p>\n

    The Ministry of Family, Labour and Social Policy has confirmed in its official materials that the only numerical threshold is 50 people.<\/p>\n

    Exceptions: who must implement the procedure regardless of headcount<\/h3>\n

    The obligation to implement a procedure regardless of the number of people<\/strong> applies to entities operating in the following areas:<\/p>\n

      \n
    1. Financial services, products and markets<\/li>\n
    2. Prevention of money laundering and terrorist financing (AML)<\/a><\/li>\n
    3. Transport safety<\/li>\n
    4. Environmental protection<\/li>\n<\/ol>\n

      Companies in these sectors have been required to have a procedure since 25 September 2024<\/strong>, with no option to benefit from a \u201csoft” extension of the deadline.<\/p>\n

      Exemption<\/strong>: organisational units of municipalities and counties with fewer than 10,000 residents.<\/p>\n

      Entities below the 50-person threshold may implement a procedure voluntarily<\/strong>, in which case all the requirements of the Act apply to them.<\/p>\n

      Who can be a whistleblower: not just employees<\/h3>\n

      Article 4 of the Act contains an open-ended list of people who may obtain whistleblower status<\/a>. This group is much broader than \u201cemployees”:<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
      Category of person<\/th>\nCan they be a whistleblower?<\/th>\n<\/tr>\n<\/thead>\n
      Employee (employment contract)<\/td>\nYes<\/td>\n<\/tr>\n
      Temporary worker<\/td>\nYes<\/td>\n<\/tr>\n
      B2B contractor<\/td>\nYes<\/td>\n<\/tr>\n
      Civil-law contractor<\/td>\nYes<\/td>\n<\/tr>\n
      Intern<\/td>\nYes<\/td>\n<\/tr>\n
      Volunteer<\/td>\nYes<\/td>\n<\/tr>\n
      Trainee<\/td>\nYes<\/td>\n<\/tr>\n
      Shareholder \/ partner<\/td>\nYes<\/td>\n<\/tr>\n
      Member of a company body (management board, supervisory board)<\/td>\nYes<\/td>\n<\/tr>\n
      Commercial proxy<\/td>\nYes<\/td>\n<\/tr>\n
      Job applicant (person taking part in a recruitment process)<\/td>\nYes<\/td>\n<\/tr>\n
      Former employee \/ contractor<\/td>\nYes<\/td>\n<\/tr>\n
      Officer, soldier<\/td>\nYes<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

      Protection applies from the moment a report is made, provided that the whistleblower acts in good faith.<\/p>\n

      For IT and SaaS companies that combine employment contracts with a B2B model, this has a specific implication: a contractor providing services under a civil-law contract has the same right to protection as an employee under an employment contract.<\/p>\n

      Contact us<\/a>. We will check whether your company is subject to the Act and what obligations you need to meet.<\/p>\n

      What breaches of law are covered by the Act<\/h2>\n

      The Act (Article 3(1)) protects reports concerning breaches of law in 17 areas<\/strong><\/a>:<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
      No.<\/th>\nArea<\/th>\nExample for a technology company<\/th>\n<\/tr>\n<\/thead>\n
      1<\/td>\nPublic procurement<\/td>\nManipulating a tender bid<\/td>\n<\/tr>\n
      2<\/td>\nFinancial services, products and markets<\/td>\nBreaches of fintech regulations<\/td>\n<\/tr>\n
      3<\/td>\nAML<\/td>\nLack of customer verification<\/a> procedures<\/td>\n<\/tr>\n
      4<\/td>\nProduct safety<\/td>\nReleasing software with security vulnerabilities<\/td>\n<\/tr>\n
      5<\/td>\nTransport safety<\/td>\n–<\/td>\n<\/tr>\n
      6<\/td>\nEnvironmental protection<\/td>\n–<\/td>\n<\/tr>\n
      7<\/td>\nRadiation protection and nuclear safety<\/td>\n–<\/td>\n<\/tr>\n
      8<\/td>\nFood and feed safety<\/td>\n–<\/td>\n<\/tr>\n
      9<\/td>\nAnimal health and welfare<\/td>\n–<\/td>\n<\/tr>\n
      10<\/td>\nPublic health<\/td>\n–<\/td>\n<\/tr>\n
      11<\/td>\nConsumer protection<\/td>\nUnfair practices towards platform users<\/td>\n<\/tr>\n
      12<\/td>\nProtection of privacy and personal data (GDPR)<\/strong><\/td>\nProcessing user data in breach of the GDPR<\/td>\n<\/tr>\n
      13<\/td>\nSecurity of networks and information systems<\/td>\nIgnoring cybersecurity incidents<\/td>\n<\/tr>\n
      14<\/td>\nFinancial interests of the State Treasury \/ local government units \/ EU<\/td>\nSubsidy fraud<\/td>\n<\/tr>\n
      15<\/td>\nEU internal market<\/td>\nBreaches of competition rules<\/td>\n<\/tr>\n
      16<\/td>\nCorruption<\/strong><\/td>\nBribes in connection with contracts<\/td>\n<\/tr>\n
      17<\/td>\nConstitutional freedoms and human rights<\/strong><\/td>\nViolations of civil rights by public authorities<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

      Categories 16 and 17 were added by the Polish legislature, they go beyond the minimum requirements of the EU Directive.<\/p>\n

      Employment law was deliberately excluded<\/strong> from the list during the parliamentary process. Breaches such as workplace bullying or discrimination are not generally covered by the external reporting system, unless they also fall within another category (e.g. protection of privacy, public health, constitutional rights and freedoms).<\/p>\n

      Article 3(2) allows for an optional extension<\/strong> of the internal procedure to cover breaches of internal regulations or ethical standards (including employment law), but the provisions on external reporting do not apply to such reports.<\/p>\n

      Deadlines: what came into force and when<\/h2>\n\n\n\n\n\n\n\n
      Date<\/th>\nWhat came into force<\/th>\n<\/tr>\n<\/thead>\n
      25 September 2024<\/strong><\/td>\nThe main provisions: whistleblower protection, the prohibition of retaliation, the obligation to establish an internal reporting procedure and the criminal provisions (Articles 54 to 58)<\/td>\n<\/tr>\n
      25 December 2024<\/strong><\/td>\nExternal reports to the Commissioner for Human Rights and public authorities (Chapter 4), and the obligation to include information on the option of external reporting in the internal procedure<\/td>\n<\/tr>\n
      1 January 2025<\/strong><\/td>\nThe first date for verifying the 50-person threshold after the Act came into force, the position of the Ministry of Family, Labour and Social Policy identifies this date as the effective implementation deadline for entities reaching the 50-person threshold<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

      For entities in regulated sectors (finance, AML, transport, environment), the obligation arose as early as 25 September 2024<\/strong>, with no option to defer it.<\/p>\n

      There are no standard transitional provisions setting different implementation deadlines for different groups of entities.<\/p>\n

      Penalties: the consequences of failing to implement the procedure<\/h2>\n

      Petty offence for failure to establish a procedure (Article 58 of the Act)<\/h3>\n

      Failure to implement an internal reporting procedure, or establishing one in material breach of the Act\u2019s requirements, constitutes a petty offence<\/strong>. Liability rests with the individual<\/strong> responsible for establishing the procedure, not the company as an entity.<\/p>\n

      Penalty: a fine of between 20 and 5000 z\u0142<\/strong> (the range specified in Article 24 \u00a7 1 of the Petty Offences Code).<\/p>\n

      The amount may seem low, but it is not the only risk. A defective procedure creates exposure to much more serious consequences involving retaliation, damages and reputational harm.<\/p>\n

      Offences under Articles 54 to 57: more severe penalties<\/h3>\n\n\n\n\n\n\n\n\n
      Act<\/th>\nPenalty<\/th>\n<\/tr>\n<\/thead>\n
      Preventing or obstructing the submission of a report (Article 54)<\/td>\nA fine, restriction of liberty or imprisonment<\/td>\n<\/tr>\n
      Retaliatory measures against a whistleblower (Article 55)<\/td>\nA fine, restriction of liberty or imprisonment for up to 2 years<\/strong> (if persistent, up to 3 years<\/strong>)<\/td>\n<\/tr>\n
      Disclosing a whistleblower\u2019s identity in breach of the law (Article 56)<\/td>\nA fine, restriction of liberty or imprisonment for up to 1 year<\/strong><\/td>\n<\/tr>\n
      Knowingly reporting false information (Article 57)<\/td>\nA fine, restriction of liberty or imprisonment for up to 2 years<\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

      Fines for criminal offences are imposed in daily rates<\/strong> (under the Criminal Code), and may potentially be many times higher than 5000 z\u0142.<\/p>\n