{"id":4002,"date":"2026-10-21T14:10:11","date_gmt":"2026-10-21T14:10:11","guid":{"rendered":"https:\/\/sawaryn.com\/?p=4002"},"modified":"2026-10-22T10:31:25","modified_gmt":"2026-10-22T10:31:25","slug":"whistleblowing-channel-polish-branch-group","status":"publish","type":"post","link":"https:\/\/sawaryn.com\/en\/publikacje\/whistleblowing-channel-polish-branch-group\/","title":{"rendered":"Whistleblowing Channel in a Polish Branch of a Group. Why Copying a Solution from Abroad Is Not Enough."},"content":{"rendered":"

The group sent over a ready-made configuration of the reporting system already in use at a sister company. The tool has been tried and tested. The platform is up and running. Yet the whistleblowing channel at the Polish branch still does not comply with the Act.<\/p>\n

Why? Because the risks that really matter are not in the software. They lie in who sits on the committee, who provides advice, where the register is kept, and whether the Polish company conducted its own consultation with the workforce.<\/p>\n

The Act of 14 June 2024 on the Protection of Whistleblowers<\/strong> (Journal of Laws 2024, item 928) has been in force since 25 September 2024. The provisions on external reports entered into force on 25 December 2024. The obligation to establish an internal reporting procedure rests with each legal entity<\/strong><\/a> employing at least 50 people \u2014 not with the corporate group as a whole (Act, Journal of Laws 2024, item 928<\/a>).<\/p>\n

During the first full reporting period (up to 31 December 2025), public authorities recorded 1,908 external reports<\/strong> (2024\u20132025 gov.pl Report<\/a>). This shows that whistleblowers use reporting channels \u2014 and if your internal channel does not work properly, the report will go to a public authority or the media.<\/p>\n

In this article, I will explain what a Polish subsidiary must do to ensure that its reporting channel complies with the law \u2014 regardless of how well the tool provided by the group works.<\/p>\n

Key terms you need to know<\/h2>\n

Before we go any further, it is worth clarifying the terminology. The Whistleblower Protection Act and the GDPR use terms with specific legal meanings.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n
Term<\/th>\nMeaning<\/th>\n<\/tr>\n<\/thead>\n
Whistleblower<\/strong><\/td>\nA person who reports a breach of the law \u2014 an employee, associate, contractor, candidate, or freelancer<\/td>\n<\/tr>\n
Internal channel<\/strong><\/td>\nThe method by which a whistleblower submits a report within an organisation \u2014 a form, meeting, or telephone hotline<\/td>\n<\/tr>\n
Internal reporting procedure<\/strong><\/td>\nA document describing the rules for receiving, investigating, and documenting reports \u2014 required by law<\/td>\n<\/tr>\n
Follow-up measures<\/strong><\/td>\nActions taken after a report is received: verification, investigation, and implementation of changes<\/td>\n<\/tr>\n
Authorised person<\/strong><\/td>\nA person with written authorisation to process data when handling reports (Article 27 of the Act)<\/td>\n<\/tr>\n
Data protection impact assessment (DPIA)<\/strong><\/td>\nA data protection impact assessment \u2014 mandatory for whistleblowing systems (list issued by the President of the Personal Data Protection Office, Polish Monitor 2019, item 666, point 9)<\/td>\n<\/tr>\n
Data processing agreement<\/strong><\/td>\nAn agreement between a data controller and an entity processing data on its behalf (Article 28 of the GDPR)<\/td>\n<\/tr>\n
Adequacy decision<\/strong><\/td>\nA European Commission decision finding that a third country ensures an adequate level of personal data protection<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Why copying the group\u2019s solution is not enough<\/h2>\n

Many Polish branches of international groups take the same approach to implementing a reporting channel: the headquarters provides a platform, a sister company shares its configuration, and the local branch \u201csimply launches the system”. The tool is good. But legal compliance requires more than a functional platform.<\/p>\n

Each legal entity has its own obligations<\/h3>\n

Article 8(3) of Directive (EU) 2019\/1937 states explicitly that the obligation to establish an internal channel rests with each legal entity<\/strong> employing at least 50 people<\/a> \u2014 not with the group (Directive (EU) 2019\/1937<\/a>). A central group platform may serve as a technical tool, but the Polish company must have:<\/p>\n

    \n
  1. Its own internal reporting procedure<\/strong><\/a> \u2014 containing the 8 mandatory elements specified in Article 25(1) of the Act<\/li>\n
  2. Its own consultation with the workforce<\/strong> \u2014 with a trade union or representatives of people performing work (5\u201310 days to consult the final wording of the procedure)<\/li>\n
  3. Its own internal reports register<\/strong> \u2014 including reports deemed unfounded<\/li>\n
  4. Its own data protection impact assessment (DPIA)<\/strong> \u2014 whistleblowing systems are included in the list issued by the President of the Personal Data Protection Office<\/li>\n
  5. Its own written authorisations<\/a><\/strong> for people handling reports<\/li>\n<\/ol>\n

    Copying a sister company\u2019s technical configuration does not replace any of these obligations.<\/p>\n

    Liability is local<\/h3>\n

    The GDPR assigns legal liability to the controller with an establishment in the EU \u2014 even for breaches of binding corporate rules by group members outside the European Union (Article 47(2)(f) of the GDPR). The processing of employee data in the employment context in a single Member State is subject to oversight by the local supervisory authority (Recital 127 of the GDPR).<\/p>\n

    This has a specific consequence: the President of the Personal Data Protection Office is the competent authority for the reporting channel at a Polish subsidiary<\/strong>, regardless of where the group\u2019s headquarters is located. Any inspection or fine will affect the Polish entity.<\/p>\n

    Three risks that have nothing to do with the platform<\/h2>\n

    An analysis of an anonymised case involving the Polish branch of an international group identified 14 entries in the risk register: 1 critical, 7 high, and 6 medium. The three most serious risks did not concern the tool.<\/p>\n

    A one-person committee as a bottleneck<\/h3>\n

    Having one person receive reports may appear to be a simple model. But it creates three problems at once:<\/p>\n

      \n
    1. Deadline risk<\/strong> \u2014 every absence (annual leave, illness, business travel) puts statutory deadlines at risk: 7 days to acknowledge receipt of a report and 3 months to provide feedback (The role of the National Labour Inspectorate in the whistleblower protection system<\/a>)<\/li>\n
    2. Conflict of interest<\/strong> \u2014 a report concerning the committee\u2019s sole member goes directly to that same person. Without a recusal procedure, the whistleblower will bypass the internal channel<\/li>\n
    3. Lack of impartiality<\/strong> \u2014 the Act requires the designation of an impartial<\/strong> person responsible for taking follow-up measures (Article 26). One person performing both functions \u2014 receiving and investigating reports \u2014 does not meet this requirement in every scenario<\/li>\n<\/ol>\n

      What to do:<\/strong> appoint at least two authorised people. Describe in the procedure how substitutes are appointed and how a committee member is recused from a specific case. Create a separate channel for reports concerning a committee member and name an impartial person who will investigate such reports.<\/p>\n

      The unresolved role of the group\u2019s legal department<\/h3>\n

      The group wants its legal department to advise the committee \u201cwithout disclosing information identifying the whistleblower”. This model is lawful. But it falls apart without a pseudonymisation protocol.<\/p>\n

      A discussion about a case quickly becomes a discussion about a person \u2014 particularly in an email thread. Disclosing a whistleblower\u2019s identity without their consent is a criminal offence<\/strong> punishable by a fine, restriction of liberty, or imprisonment for up to one year (Article 56 of the Act).<\/p>\n

      The Act does not require a lawyer to sit on the committee. It requires an authorised person to receive reports and an impartial person responsible for follow-up measures. These are two separate functions.<\/p>\n

      What to do:<\/strong> formally select one of the following two options:<\/p>\n\n\n\n\n\n\n
      Option<\/th>\nRole of the group\u2019s legal department<\/th>\nRequirements<\/th>\n<\/tr>\n<\/thead>\n
      Advisory<\/strong><\/td>\nProvides advice on anonymised facts and does not receive or investigate reports<\/td>\nInclude this role in the procedure, create a pseudonymisation protocol, and prohibit transferring report content to email<\/td>\n<\/tr>\n
      Committee membership<\/strong><\/td>\nFull participation with access to identifying information<\/td>\nIssue named written authorisations and confidentiality undertakings, and document the legal basis for data transfers (for the UK \u2014 an adequacy decision)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

      Reports register maintained outside the system<\/h3>\n

      An internal reports register is mandatory \u2014 including for reports deemed unfounded (Article 29 of the Act). Reporting platforms usually do not offer this function.<\/p>\n

      As a result, the register is created in a spreadsheet on a shared drive. It then becomes a second, less secure copy of data identifying the whistleblower \u2014 outside access controls and event logging.<\/p>\n

      What to do:<\/strong> designate a single location and format for the register. Restrict access to it. Prohibit keeping it in email or on shared drives without access controls. The register should contain the information required by the Act, but not the full content of the report.<\/p>\n

      Contact us<\/a><\/p>\n

      What must be ready before the channel is launched<\/h2>\n

      The following checklist covers the obligations that must be completed before the channel launch date<\/strong> \u2014 not afterwards.<\/p>\n

      Procedure and consultation<\/h3>\n
        \n
      1. Prepare an internal reporting procedure containing the 8 elements required under Article 25(1) of the Act<\/li>\n
      2. Consult the final wording of the procedure with a trade union or representatives of people performing work (5\u201310 days from presentation of the draft)<\/li>\n
      3. Document how representatives were elected if you do not have a trade union<\/li>\n
      4. Publish the procedure and communicate it to the workforce, allowing a vacatio legis period before it enters into force<\/li>\n
      5. Prepare a Polish version of the form and procedure \u2014 even if the company\u2019s working language is English<\/li>\n<\/ol>\n

        People and authorisations<\/h3>\n
          \n
        1. Appoint at least two people authorised to handle reports, one of whom must be independent of the head of the entity<\/li>\n
        2. Issue named written data-processing authorisations and confidentiality undertakings \u2014 also effective after the employment relationship ends<\/li>\n
        3. Maintain a register of authorisations and block system access for anyone without authorisation<\/li>\n
        4. Name an impartial person to investigate reports concerning a committee member<\/li>\n
        5. Train all authorised people before<\/strong> granting them access: confidentiality of identity, criminal liability for disclosure, the prohibition on taking report content outside the system, and use of the tool<\/li>\n<\/ol>\n

          Reporting channels<\/h3>\n
            \n
          1. Launch an online form on a reporting platform that guarantees confidentiality<\/li>\n
          2. Provide an oral channel: a telephone hotline or<\/strong> a procedure expressly providing for an in-person meeting within 14 days at the whistleblower\u2019s request<\/li>\n
          3. Make the channel available to people outside the organisation: contractors, candidates, and associates<\/li>\n
          4. If you share an address or tool with another group company \u2014 separate the labels and form addresses, and confirm that the instances are separate<\/li>\n<\/ol>\n

            GDPR and the platform provider<\/h3>\n
              \n
            1. Conduct a data protection impact assessment (DPIA) \u2014 this obligation applies regardless of scale (list issued by the President of the Personal Data Protection Office, Polish Monitor 2019, item 666, point 9)<\/li>\n
            2. Negotiate the access model with the platform provider: disable or transfer super-administrator rights, and if access is retained \u2014 specify its scope in the data processing agreement<\/a><\/li>\n
            3. Require the provider to issue named authorisations to its personnel and log every access to the instance<\/li>\n
            4. Complete the list of subprocessors in the data processing agreement<\/li>\n
            5. Document the legal basis for transferring data to a third country (for the UK \u2014 Adequacy Decision (EU) 2025\/2574 of 19 December 2025<\/a>)<\/li>\n
            6. Enable multi-factor authentication for accounts with access to report content<\/li>\n
            7. Update the record of processing activities<\/a> to include \u201chandling whistleblower reports”<\/li>\n<\/ol>\n

              Ongoing processes<\/h3>\n
                \n
              1. Implement a process for reviewing and deleting accidentally collected, irrelevant data within 14 days of determining that it is irrelevant (Article 8 of the Act)<\/li>\n
              2. Set the data retention period: 3 years after the end of the calendar year in which follow-up measures were completed<\/li>\n
              3. Plan to review the DPIA at least once every 12 months and whenever the provider, architecture, or committee membership changes<\/li>\n<\/ol>\n

                Penalties \u2014 what you may personally face<\/h2>\n

                The Whistleblower Protection Act provides for criminal<\/strong>, rather than administrative financial, penalties. This distinguishes this regime from GDPR fines and means that individuals may be held personally liable.<\/p>\n\n\n\n\n\n\n\n\n\n
                Breach<\/th>\nLegal basis<\/th>\nPenalty<\/th>\n<\/tr>\n<\/thead>\n
                Preventing or obstructing a report<\/td>\nArticle 54(1)<\/td>\nA fine, restriction of liberty, or imprisonment for up to 1 year<\/strong><\/td>\n<\/tr>\n
                Obstruction involving violence, threats, or deception<\/td>\nArticle 54(2)<\/td>\nImprisonment for up to 3 years<\/strong><\/td>\n<\/tr>\n
                Retaliation against a whistleblower<\/td>\nArticle 55(1)<\/td>\nA fine, restriction of liberty, or imprisonment for up to 2 years<\/strong><\/td>\n<\/tr>\n
                Disclosure of a whistleblower\u2019s identity<\/td>\nArticle 56<\/td>\nA fine, restriction of liberty, or imprisonment for up to 1 year<\/strong><\/td>\n<\/tr>\n
                Failure to establish an internal reporting procedure<\/td>\nArticle 58<\/td>\nCriminal penalty (details require verification against the full text of the Act)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                (Act, Journal of Laws 2024, item 928<\/a>)<\/p>\n

                However, the most serious operational consequence of not having a functioning channel is not a penalty. The whistleblower bypasses the internal channel and goes directly to a public authority or publicly discloses the matter. Polish law (Article 30(1) of the Act) does not require the internal channel to be used first \u2014 a whistleblower has the right to choose an external channel immediately.<\/p>\n

                Data from the first year confirms that whistleblowers use this option: 1,908 external reports<\/strong> were received by public authorities between 25 December 2024 and 31 December 2025 (gov.pl Report<\/a>).<\/p>\n

                The most common scenarios in which the model falls apart<\/h2>\n

                The following situations repeatedly arise at Polish branches of international groups. Each leads to a breach that is not caused by a flaw in the tool.<\/p>\n

                Scenario 1: the report recipient goes on holiday<\/h3>\n

                A report is received on the first day of the sole committee member\u2019s two-week absence. The 7-day deadline for acknowledging receipt passes without a response. The whistleblower receives no acknowledgement \u2014 and is entitled to conclude that the internal channel does not work.<\/p>\n

                Safeguard:<\/strong> describe a substitution procedure with automatic notification forwarding.<\/p>\n

                Scenario 2: the report concerns a committee member<\/h3>\n

                A report concerns the sole member of a one-person committee \u2014 and goes directly to that person. There is no penalty for this, but the whistleblower bypasses the internal channel and goes to a public authority or the media. The company loses control of the narrative.<\/p>\n

                Safeguard:<\/strong> create a separate channel and name an impartial person (e.g. a management board member who is not on the committee).<\/p>\n

                Scenario 3: two companies at one address<\/h3>\n

                Two group companies use the same platform. A person employed by company A joins company B\u2019s committee without authorisation from the controller and without a legal basis for sharing data between the entities.<\/p>\n

                Safeguard:<\/strong> separate the instances, issue authorisations from the appropriate controller, and document the legal basis for sharing the data.<\/p>\n

                Scenario 4: the platform provider can see report content<\/h3>\n

                The provider retains super-administrator rights. Technically, its personnel can access the environment containing report content \u2014 yet the data processing agreement says nothing about this.<\/p>\n

                Safeguard:<\/strong> negotiate the disabling or transfer of super-administrator rights. If access is retained \u2014 specify its scope in the data processing agreement, require named authorisations, and log every access.<\/p>\n

                Scenario 5: \u201canonymity” in a small team<\/h3>\n

                A report is formally anonymous, but its content clearly identifies its author. In a small team, procedural anonymity is not actual anonymity. Small scale reduces the likelihood of a confidentiality breach but increases its impact on the individual concerned.<\/p>\n

                Safeguard:<\/strong> accepting anonymous reports is not a statutory obligation \u2014 it is an optional element of the procedure. Regardless of the decision, protect the confidentiality of the whistleblower\u2019s identity by restricting access and training authorised people.<\/p>\n

                Data protection impact assessment (DPIA) \u2014 why it is mandatory regardless of scale<\/h2>\n

                Whistleblowing systems are included in the list issued by the President of the Personal Data Protection Office (Polish Monitor 2019, item 666, point 9). A data protection impact assessment is mandatory regardless of the number of employees or the expected number of reports (DPIA in the context of reporting breaches \u2014 Personal Data Protection Office<\/a>).<\/p>\n

                Regardless of the list, at least two criteria from the European Data Protection Board\u2019s WP248 rev.01 guidelines are met:<\/p>\n

                  \n
                1. Data of a highly personal nature<\/strong> \u2014 reports may contain information about breaches of law, workplace relationships, and people\u2019s conduct<\/li>\n
                2. Vulnerable data subjects<\/strong> \u2014 whistleblowers are employees, associates, and candidates \u2014 people who are dependent on the entity they are reporting<\/li>\n<\/ol>\n

                  The DPIA must be conducted before the channel is launched<\/strong> and reviewed at least once every 12 months and whenever the provider, architecture, or committee membership changes.<\/p>\n

                  In the case analysed, the DPIA risk register contained 14 entries. After implementing the highest-priority measures, the residual risk fell to a medium level \u2014 allowing the channel to be launched without prior consultation with the President of the Personal Data Protection Office (Article 36 of the GDPR).<\/p>\n

                  We can help you with this<\/h2>\n

                  Whether a reporting channel is compliant depends on its organisational model \u2014 who receives reports, who investigates them, who provides advice, and how the data is secured. The tool is only one component.<\/p>\n

                  We support Polish subsidiaries and branches of international groups through three service options:<\/p>\n\n\n\n\n\n\n\n
                  Scope<\/th>\nWhat it includes<\/th>\n<\/tr>\n<\/thead>\n
                  Procedure and checklist review<\/strong><\/td>\nReview of the existing procedure against the 8 statutory elements, identification of gaps, and recommendations for changes<\/td>\n<\/tr>\n
                  Procedure + authorisations + consultation + DPIA<\/strong><\/td>\nPreparation of the procedure from scratch, issuance of authorisations, consultation with the workforce, and a data protection impact assessment<\/td>\n<\/tr>\n
                  Comprehensive compliance support<\/strong><\/td>\nA complete whistleblower management system: procedure, authorisations, DPIA, review of the data processing agreement with the provider, training for authorised people, and periodic reviews<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                  We combine employment law, the GDPR, and the Whistleblower Protection Act<\/a> in a single process \u2014 because these three areas intersect when managing a reporting channel.<\/p>\n

                  Contact us<\/a><\/p>\n

                  A reporting channel is not an IT project \u2014 it is an organisational project<\/h2>\n

                  A Polish subsidiary has its own obligations, which the group cannot fulfil on its behalf. The procedure, workforce consultation, register, DPIA, authorisations, and training are local tasks, regardless of how efficient the tool provided by headquarters may be.<\/p>\n

                  The three most serious risks in the case analysed did not concern the platform. They concerned a one-person committee, the unresolved role of the group\u2019s legal department, and a register maintained in a spreadsheet on a shared drive.<\/p>\n

                  If you are launching a reporting channel or want to check whether an existing one meets the requirements \u2014 contact us<\/a>. We will help you define roles, prepare the procedure, conduct the workforce consultation, and complete the DPIA before launch.<\/p>\n

                  Frequently asked questions<\/h2>\n

                  Does our lawyer or the group\u2019s legal department have to sit on the committee?<\/strong>
                  \nNo. The Act does not require a lawyer to be a committee member. It requires an authorised person to receive reports and an impartial person responsible for follow-up measures. The group\u2019s legal department may act in an advisory capacity \u2014 provided that this role is included in the procedure, advice is based on anonymised facts, and the people on the group\u2019s side have written authorisations and confidentiality undertakings before accessing any identifying information.<\/p>\n

                  The group has a functioning system in another country \u2014 how much of it can I transfer to the Polish company?<\/strong>
                  \nYou can transfer the tool (the platform). You cannot transfer the procedure, workforce consultation, reports register, DPIA, or authorisations. Each of these elements must be established at the level of the Polish legal entity. Directive (EU) 2019\/1937 permits resources to be shared only by entities employing 50\u2013249 people, while maintaining confidentiality and independence (                  Directive (EU) 2019\/1937<\/a>).<\/p>\n

                  Do we have to accept anonymous reports?<\/strong>
                  \nNo. Anonymous reports are an optional element of the procedure \u2014 a design decision, not a statutory obligation. In a small entity, the content of the report will usually identify its author anyway. Regardless of your decision, protect the confidentiality of the whistleblower\u2019s identity by restricting access and training authorised people.<\/p>\n

                  Is a data protection impact assessment (DPIA) mandatory where the scale of processing is small?<\/strong>
                  \nYes. Whistleblowing systems are included in the list issued by the President of the Personal Data Protection Office (Polish Monitor 2019, item 666, point 9). The obligation to conduct a DPIA does not depend on the number of employees or the expected number of reports. At least two criteria from the European Data Protection Board\u2019s guidelines are met: data of a highly personal nature and data concerning vulnerable individuals.<\/p>\n

                  What may I personally face if a whistleblower\u2019s identity is leaked?<\/strong>
                  \nDisclosing a whistleblower\u2019s identity without their consent is a criminal offence punishable by a fine, restriction of liberty, or imprisonment for up to one year (Article 56 of the Act). Liability is personal \u2014 it applies to the specific person who disclosed the data, not only to the organisation.<\/p>\n

                  Is a form in an office tool or a company email inbox sufficient as a reporting channel?<\/strong>
                  \nA free form created in an office tool is not acceptable \u2014 there is no data processing agreement or guarantee of confidentiality. A dedicated email address used as the sole channel also fails to meet the requirements: correspondence is not confidential, people outside the organisation have no access, and there is no way to communicate with an anonymous whistleblower. The channel must ensure confidentiality, accessibility, and two-way communication.<\/p>\n","protected":false},"excerpt":{"rendered":"

                  A group reporting platform is not enough for a Polish entity. Learn what local procedures, workforce consultation, a reports register and DPIA involve.<\/p>\n","protected":false},"author":13,"featured_media":3782,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":"","sip_alt_url":"","sip_en_pl_url":"","sip_pair_uuid":"b158c25a-4ea4-461b-b84a-552b2f97dc05","sip_pair_state":"verified"},"categories":[1442],"tags":[1446,1540,1531,1546,1532],"specialization":[1212],"practice_area":[],"class_list":["post-4002","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-labor-law","tag-gdpr","tag-internal-procedure","tag-personal-data-protection","tag-risk-assessment","tag-whistleblowers","specialization-labor-law"],"acf":[],"_links":{"self":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts\/4002","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/users\/13"}],"replies":[{"embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/comments?post=4002"}],"version-history":[{"count":9,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts\/4002\/revisions"}],"predecessor-version":[{"id":4023,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts\/4002\/revisions\/4023"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/media\/3782"}],"wp:attachment":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/media?parent=4002"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/categories?post=4002"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/tags?post=4002"},{"taxonomy":"specialization","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/specialization?post=4002"},{"taxonomy":"practice_area","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/practice_area?post=4002"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}