{"id":3950,"date":"2024-07-18T11:54:48","date_gmt":"2024-07-18T11:54:48","guid":{"rendered":"https:\/\/sawaryn.com\/?p=3950"},"modified":"2026-10-23T09:27:12","modified_gmt":"2026-10-23T09:27:12","slug":"whistleblowers-what-legal-violations-can-you-report","status":"publish","type":"post","link":"https:\/\/sawaryn.com\/en\/publikacje\/whistleblowers-what-legal-violations-can-you-report\/","title":{"rendered":"Whistleblowers: What Legal Violations Can You Report? Practical Guidance"},"content":{"rendered":"<p>Poland&#8217;s Whistleblower Protection Act has been in force since September 25, 2024. It identifies specific categories of violations that <a href=\"https:\/\/sawaryn.com\/en\/publikacje\/who-can-be-a-whistleblower-role-reporting\/\"><strong>an employee may report<\/strong><\/a> under its legal protections. Below is a list of those categories with practical examples, so you know what reports your company may receive and how to prepare for them.<\/p>\n<h2>Who this concerns and why it is worth reading<\/h2>\n<p>The Act&#8217;s provisions impose an <a href=\"https:\/\/sawaryn.com\/en\/?p=3951\"><strong>obligation to implement internal reporting procedures<\/strong><\/a>. If you have not done so, your company may face:<\/p>\n<ul>\n<li>a fine,<\/li>\n<li>financial losses resulting from violations that go undetected,<\/li>\n<li>damage to its reputation and loss of customer trust.<\/li>\n<\/ul>\n<p>Knowing the list of violations helps you assess which risks affect your organization and prepare appropriate reporting channels and response procedures.<\/p>\n<p>We wrote <a href=\"https:\/\/sawaryn.com\/publikacje\/sygnalista-w-firmie-jak-wdrozyc-dyrektywe-o-sygnalistach\/\"><strong>here<\/strong><\/a> about implementation itself.<\/p>\n<h2>List of violations: what the Act says<\/h2>\n<p>Article 3(1) of the Whistleblower Protection Act states:<\/p>\n<blockquote><p>A violation of the law is an act or omission that is unlawful or intended to circumvent the law, concerning:<\/p><\/blockquote>\n<ol>\n<li>corruption<\/li>\n<li>public procurement<\/li>\n<li>financial services, products and markets<\/li>\n<li>anti-money laundering and countering the financing of terrorism<\/li>\n<li>product safety and compliance with requirements<\/li>\n<li>transport safety<\/li>\n<li>environmental protection<\/li>\n<li>radiological protection and nuclear safety<\/li>\n<li>food and feed safety<\/li>\n<li>animal health and welfare<\/li>\n<li>public health<\/li>\n<li>consumer protection<\/li>\n<li>privacy and personal data protection<\/li>\n<li>the security of networks and information and communication systems<\/li>\n<li>the financial interests of the Republic of Poland&#8217;s State Treasury, local government units and the European Union<\/li>\n<li>the EU internal market, including public-law rules on competition and state aid, and the taxation of legal persons<\/li>\n<li>the constitutional freedoms and rights of persons and citizens, where they arise in the relationship between an individual and public authorities and are not connected with the areas listed in points 1 to 16<\/li>\n<\/ol>\n<h2>Examples of violations<\/h2>\n<h3>Corruption<\/h3>\n<ul>\n<li>An employee at a private medical facility accepts <strong>gifts from a pharmaceutical company<\/strong> in exchange for writing prescriptions for its products. Patients do not receive the best medicines and may be prescribed products they do not need. The facility faces the risk of disputes with patients and criminal liability. A whistleblower may report the practice by pointing to the acceptance of material benefits.<\/li>\n<li>A department director <strong>hires a family member<\/strong> for a senior position even though that person does not meet the requirements or have the necessary qualifications. The competence level of the company&#8217;s staff declines. A whistleblower may report the situation by referring to recruitment records and evidence that the person lacks qualifications, and, if a bribe was involved, to the circumstances surrounding its transfer.<\/li>\n<li>A public official receives a <strong>bribe from an employee of a construction company in exchange for speeding up administrative proceedings<\/strong>, for example, issuing a building permit despite incomplete documentation.<\/li>\n<li>A company&#8217;s procurement manager receives a <strong>vacation in the Maldives from a computer equipment supplier in exchange for signing a long-term supply agreement<\/strong>. The company may suffer losses by overpaying for the equipment or buying lower-quality equipment.<\/li>\n<\/ul>\n<h3>Public procurement<\/h3>\n<ul>\n<li>An employee of the contracting authority <strong>falsifies tender documents<\/strong> to make a particular bidder appear to meet all the criteria when, in fact, it does not meet some requirements. The company may be harmed by buying defective products or overpaying.<\/li>\n<li>A person responsible for preparing the terms of reference for a public contract (SWZ, a document setting out the contractor&#8217;s requirements) <strong>tailors the requirements to one entity<\/strong> in exchange for a bribe, thereby eliminating competition. The company may suffer losses, primarily by overpaying for the equipment or services ordered.<\/li>\n<li>An employee of a company or municipal office <strong>shares information and details of competing bids with one of the companies participating in a tender<\/strong>, enabling it to submit the most favorable bid. The harm may be that a company without the competence to perform the contract is selected.<\/li>\n<li>Several construction companies <strong>agree to submit bids at inflated prices<\/strong> to ensure that the bidder offering the lowest price wins, then share the profits from the contract.<\/li>\n<\/ul>\n<h3>Financial services, products and markets<\/h3>\n<ul>\n<li>An employee of a large investment firm <strong>uses confidential information about a planned merger between two companies<\/strong> to buy shares before the merger is announced publicly. The investment firm may suffer very serious harm if this comes to light. A whistleblower may report the conduct by providing evidence of unauthorized access to confidential information and stock-market transactions.<\/li>\n<li>Employees of a brokerage firm <strong>artificially inflate share prices<\/strong> by placing fictitious buy orders. This misleads other investors, who buy shares in large numbers. It is stock-market price manipulation.<\/li>\n<\/ul>\n<h3>Anti-money laundering and countering the financing of terrorism<\/h3>\n<ul>\n<li>Employees of a <a href=\"https:\/\/sawaryn.com\/en\/publikacje\/who-must-implement-aml-poland\/\"><strong>company required to apply AML rules<\/strong><\/a> (anti-money laundering, a set of procedures and reporting obligations) <strong>deliberately ignore and fail to report a series of small but regular transfers from countries on the so-called high-risk country list<\/strong> so they do not reduce their sales results. The company faces very serious consequences for this conduct.<\/li>\n<li>An employee of a company required to apply AML rules <strong>fails to implement appropriate <a href=\"https:\/\/sawaryn.com\/publikacje\/jak-wdrozyc-w-firmie-procedury-aml\/\">AML procedures<\/a><\/strong>, only pretends to implement them, or does not apply them, enabling money laundering. This makes it easy for the employee to meet assigned KPIs. The company faces very serious consequences.<\/li>\n<\/ul>\n<h3>Product safety and compliance with requirements<\/h3>\n<ul>\n<li>A department at a company that makes, for example, snack bars <strong>falsifies certificates of compliance with standards<\/strong>, skips testing, or fails to follow safety regulations to meet the planned product launch deadline. The company risks serious consequences without knowing about the practice.<\/li>\n<li>An employee responsible for product certification at a manufacturing company <strong>obtains false certificates<\/strong> to stay within the planned budget. Another employee discovers this and reports the violation.<\/li>\n<li>A quality-control department, for example at a food manufacturer, <strong>skips regular quality checks required by law<\/strong>, resulting in contaminated or fermented products reaching the market. The company risks serious consequences without knowing about the practice.<\/li>\n<\/ul>\n<h3>Transport safety<\/h3>\n<ul>\n<li>An employee at a vehicle inspection station, paid by the employee responsible for a fleet, <strong>falsifies vehicle inspection records<\/strong> to make the vehicles appear to meet technical requirements. In reality, they are unfit for use. The company risks substantial costs related to fleet breakdowns or accidents.<\/li>\n<li>An employee of a transport company discovers that drivers have found a way to <strong>work more than the permitted working hours<\/strong> so they can earn more. The whistleblower reports the violation, and the company may avoid consequences in later inspections.<\/li>\n<li>A transport company <strong>decides not to install safety systems in public transit vehicles<\/strong> as a cost-saving measure.<\/li>\n<\/ul>\n<h3>Environmental protection<\/h3>\n<ul>\n<li>An employee of a chemical manufacturer notices that a coworker <strong>stores chemical waste<\/strong> contrary to guidelines and regulations, for example, in areas not designed for that purpose. A report helps the company avoid many consequences.<\/li>\n<li>An employee of a company that harvests timber discovers that workers are <strong>cutting trees outside the designated area<\/strong> to improve their daily output.<\/li>\n<li>A factory that produces toxic waste hires a contractor to dispose of it, and the contractor illegally <strong>dumps toxic waste into a river<\/strong> or stores it in an unsuitable place. A factory employee discovers this and reports the violation.<\/li>\n<li>An industrial plant <strong>emits pollutants into the air<\/strong> without the required permits, worsening air quality and endangering public health.<\/li>\n<\/ul>\n<h3>Radiological protection and nuclear safety<\/h3>\n<ul>\n<li>A facility processing radioactive waste <strong>fails to follow safety protocols<\/strong>, creating a risk of radioactive contamination.<\/li>\n<li>A person responsible for safety at a power plant <strong>conceals a leak of radioactive materials<\/strong>, endangering plant employees and nearby residents.<\/li>\n<\/ul>\n<h3>Food and feed safety<\/h3>\n<ul>\n<li>To improve sales results, employees of a food producer <strong>add prohibited substances<\/strong> and flavor enhancers to products, putting consumers&#8217; health at risk.<\/li>\n<li>Employees of a grocery store <strong>repeatedly change expiration dates on product packaging<\/strong> to increase sales. A whistleblower&#8217;s report may help the company avoid liability for selling expired products.<\/li>\n<li>Restaurant employees <strong>store raw meat and vegetables at improper temperatures<\/strong>, causing them to spoil. The company incurs avoidable losses.<\/li>\n<li>The food-safety department at a peanut producer <strong>fails to put a warning about possible allergic reactions on product packaging<\/strong>. A whistleblower informs the company&#8217;s management, helping it avoid consequences in the future.<\/li>\n<\/ul>\n<h3>Animal health and welfare<\/h3>\n<ul>\n<li>Employees of a livestock company <strong>treat animals inhumanely<\/strong>, without the company&#8217;s management knowing.<\/li>\n<li>To avoid extra work, laboratory employees <strong>conduct experiments on animals without the required permits<\/strong>. A laboratory employee discovers this and reports the violation to management.<\/li>\n<li>A cattle farmer <strong>falsifies the animals&#8217; health records<\/strong> to avoid treatment costs.<\/li>\n<li>Employees of a transport company <strong>carry animals in overcrowded, inadequately ventilated vehicles<\/strong>, which may cause suffering or even death. A whistleblower informs the company&#8217;s managers, helping it avoid consequences in the future.<\/li>\n<li>One branch of a livestock company <strong>uses steroids<\/strong> to speed up animal growth even though they are prohibited. The company faces serious legal consequences, but the whistleblower&#8217;s action helps prevent further violations.<\/li>\n<\/ul>\n<h3>Public health<\/h3>\n<ul>\n<li>Medical staff <strong>falsify patient records<\/strong> to conceal medical errors. A whistleblower notices and reports this to the hospital director.<\/li>\n<li>Local authorities <strong>fail to carry out regular sanitary inspections<\/strong> in public places, which may lead to the spread of infectious diseases.<\/li>\n<li>A doctor <strong>prescribes medication without appropriate medical indications<\/strong> or prescribes the wrong medication, usually at higher doses. The doctor receives a bribe from the patient in return.<\/li>\n<li>A <strong>hospital fails to report cases of dangerous infectious diseases<\/strong> to the relevant sanitary authorities, leading to the spread of disease.<\/li>\n<\/ul>\n<h3>Consumer protection<\/h3>\n<ul>\n<li>An insurance company representative deliberately <strong>conceals policy terms and misleads customers<\/strong>. A whistleblower may report this conduct and provide evidence that information was hidden. This helps the company avoid future problems with dissatisfied customers.<\/li>\n<li>An investment adviser <strong>recommends financial products that are unsuitable for clients<\/strong>, prioritizing commissions over clients&#8217; interests. A whistleblower may report the practices and provide evidence of unsuitable investment recommendations. This may help the investment firm avoid future problems.<\/li>\n<li>Employees of an online store <strong>deliberately relabel clothing as luxury goods<\/strong> made from high-quality materials even though it is actually made from inexpensive fabrics. They also label it as branded. A whistleblower discovers this and reports the violation, helping the company avoid problems with customer complaints.<\/li>\n<\/ul>\n<h3>Privacy and personal data protection<\/h3>\n<ul>\n<li>An employee <strong>improperly stores or shares confidential company or customer data with unauthorized people<\/strong>. The employee also uses company equipment, software or information for personal purposes without the employer&#8217;s consent. A whistleblower may report to the employer that a coworker is violating data-protection rules.<\/li>\n<li>An employee of an e-commerce company notices that, for example, <strong>the sales department is not using appropriate safeguards for customers&#8217; personal data<\/strong>, leading to a <a href=\"https:\/\/sawaryn.com\/publikacje\/zgloszenie-naruszenia-rodo-wyciek-danych-osobowych\/\"><strong>personal data breach<\/strong><\/a>. The whistleblower reports it to a supervisor, helping prevent a more serious <a href=\"https:\/\/sawaryn.com\/en\/?p=3932\"><strong>personal data breach<\/strong><\/a>.<\/li>\n<li>A marketing company manager <strong>sells the company&#8217;s customers&#8217; personal data to other companies without their knowledge or consent<\/strong>. The company faces severe legal consequences.<\/li>\n<li>A company&#8217;s HR department <strong>collects employees&#8217; biometric data without an appropriate legal basis and without their consent<\/strong>. An employee notices and reports the violation, helping the company avoid problems with personal data protection.<\/li>\n<li>Employees of a technology company <strong>fail to inform a supervisor about a personal data breach<\/strong>, even though they are required to do so. Another employee discovers this and reports the violation to management, helping to limit the effects of the breach sooner.<\/li>\n<\/ul>\n<h3>Security of networks and information and communication systems<\/h3>\n<ul>\n<li>Company employees <strong>fail to follow internal IT security procedures<\/strong>, leading to numerous data security incidents. The company risks legal consequences for personal data breaches.<\/li>\n<li>An IT department employee <strong>gives outsiders unauthorized access to the company&#8217;s information systems<\/strong>. Another employee learns about this and reports the violation to a supervisor.<\/li>\n<\/ul>\n<h3>Financial interests of the State Treasury of the Republic of Poland, local government units and the EU<\/h3>\n<ul>\n<li>A company&#8217;s finance director <strong>conceals some income by leaving it out of tax returns<\/strong>, reducing tax liabilities and improving the company&#8217;s results, for example, to receive a larger bonus. An accountant notices and reports the violation to management, helping prevent problems with the tax office.<\/li>\n<li>An employee of a company receiving a grant to develop innovation <strong>uses the funds for purposes unrelated to the project<\/strong> and conceals this in the financial records. This exposes the company to an obligation to repay the entire grant.<\/li>\n<li>A construction company <strong>falsifies cost documents<\/strong> to obtain more funding from EU funds. A whistleblower reviewing the estimate discovers this and reports the violation.<\/li>\n<\/ul>\n<h3>The EU internal market: competition rules, state aid and taxation of legal persons<\/h3>\n<ul>\n<li>A large corporation&#8217;s sales department <strong>uses predatory pricing<\/strong>, selling products below production cost to eliminate smaller competitors from the market. This is an unfair market practice that may expose the company to very high financial penalties.<\/li>\n<li>Local authorities award <strong>public grants to a favored company without carrying out the required assessment procedure<\/strong>. In exchange for a bribe, they favor that company over other businesses. If a whistleblower discovers this, they may report a violation of state-aid rules.<\/li>\n<\/ul>\n<h3>Constitutional freedoms and human and civil rights<\/h3>\n<ul>\n<li>A company&#8217;s HR department <strong>deliberately refuses to hire women<\/strong> and people of a particular origin or sexual orientation, exposing the company to allegations of employee discrimination.<\/li>\n<li>An employer <strong>monitors employees&#8217; private phone conversations without their consent<\/strong>. An employee who discovers this makes a report.<\/li>\n<li>The health and safety department <strong>fails to provide employees with appropriate protective equipment<\/strong>, exposing them to workplace accidents. Management does not know this and believes everything is working properly.<\/li>\n<li>An employer uses practices intended to <strong>make it harder for employees to organize<\/strong> and form a trade union.<\/li>\n<\/ul>\n<h2>What this means for your company<\/h2>\n<p>The list of violations is broad, from corruption and data protection to human rights. Any of these categories may affect your organization, even if it does not seem relevant at first glance.<\/p>\n<h3>What you should do:<\/h3>\n<ol>\n<li><strong>Review the list of violations<\/strong> in Article 3 of the Act and assess which categories relate to your industry and operations.<\/li>\n<li><strong>Implement an internal reporting procedure<\/strong>. If you have not done so yet, do it now. The obligation has applied since September 25, 2024.<\/li>\n<li><strong>Prepare reporting channels<\/strong> that are anonymous, accessible and described in your internal rules.<\/li>\n<li><strong>Train employees<\/strong> so they know what they can report, how to do it and that they are protected against retaliation.<\/li>\n<li><strong>Appoint a person responsible<\/strong> for receiving and handling reports.<\/li>\n<\/ol>\n<p>Whistleblowers&#8217; actions may protect your company from legal and financial consequences, provided you give them tools for reporting and clear rules for handling reports.<\/p>\n<p>If you need support implementing procedures, contact us to arrange a conversation about our firm&#8217;s <a href=\"https:\/\/sipbiznes.com\/sygnalisci\/\" target=\"_blank\" rel=\"noopener\"><strong>Whistleblower Support Program<\/strong><\/a>.<\/p>\n<h2>Frequently asked questions<\/h2>\n<p><strong>What legal violations may a whistleblower report under the Whistleblower Protection Act?<\/strong><br \/>\nArticle 3(1) of the Whistleblower Protection Act lists 17 categories of legal violations that may be reported. They include corruption, public procurement, product safety, environmental protection, personal data protection, the security of networks and information and communication systems, consumer protection, public health, the financial interests of the State Treasury and the EU, competition rules, and constitutional freedoms and human and civil rights.<\/p>\n<p><strong>Can a whistleblower report violations involving GDPR and IT security?<\/strong><br \/>\nYes. The Act expressly covers two separate categories: privacy and personal data protection, and the security of networks and information and communication systems. In practice, this may include reporting a customer data breach, selling personal data without consent, collecting biometric data without a legal basis, giving unauthorized access to IT systems, or failing to follow internal IT security procedures.<\/p>\n<p><strong>What examples of whistleblower reports might arise at a company beyond classic bribery?<\/strong><br \/>\nThe scope of reports is broad and extends well beyond bribes. A whistleblower may, for example, report falsified product-compliance certificates, concealed income in tax returns, failure to apply AML procedures, a customer data breach, deliberately misleading consumers about product quality, employment discrimination, or monitoring employees&#8217; private phone conversations without their consent.<\/p>\n<p><strong>What may happen to a company that does not implement an internal reporting procedure for whistleblowers?<\/strong><br \/>\nFailure to implement an internal reporting procedure exposes a company to a fine, financial losses resulting from violations that go undetected, and damage to its reputation and customer trust. The obligation has applied since September 25, 2024, so if the procedure has not yet been put in place, the risk grows with every day of delay.<\/p>\n<p><strong>What should a company do to prepare for whistleblower reports?<\/strong><br \/>\nStart by reviewing the 17 categories of violations in Article 3 of the Act and assessing which relate to your industry and operations. Then implement an internal reporting procedure, prepare anonymous and accessible reporting channels, train employees on what they can report and how, explain their protection against retaliation, and appoint a person responsible for receiving and handling reports.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Poland&#8217;s Whistleblower Protection Act identifies 17 categories of legal violations. See practical examples and steps your organization can take to prepare for reports.<\/p>\n","protected":false},"author":10,"featured_media":1914,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":"","sip_alt_url":"","sip_en_pl_url":"","sip_pair_uuid":"","sip_pair_state":""},"categories":[1580],"tags":[1448,1528,1532],"specialization":[1207],"practice_area":[],"class_list":["post-3950","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-compliance","tag-compliance","tag-labor-law","tag-whistleblowers","specialization-compliance"],"acf":[],"_links":{"self":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts\/3950","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/comments?post=3950"}],"version-history":[{"count":1,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts\/3950\/revisions"}],"predecessor-version":[{"id":4114,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts\/3950\/revisions\/4114"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/media\/1914"}],"wp:attachment":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/media?parent=3950"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/categories?post=3950"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/tags?post=3950"},{"taxonomy":"specialization","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/specialization?post=3950"},{"taxonomy":"practice_area","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/practice_area?post=3950"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}