{"id":5245,"date":"2026-11-13T12:54:49","date_gmt":"2026-11-13T12:54:49","guid":{"rendered":"https:\/\/sawaryn.com\/?p=5245"},"modified":"2026-11-13T12:56:58","modified_gmt":"2026-11-13T12:56:58","slug":"esg-audit-aggregated-whistleblowing-report","status":"publish","type":"post","link":"https:\/\/sawaryn.com\/en\/publikacje\/esg-audit-aggregated-whistleblowing-report\/","title":{"rendered":"An ESG Auditor Wants the Whistleblowing Reports Register. Do Not Give It to Them – Prepare This Document Instead."},"content":{"rendered":"

An ESG auditor or a major business partner asks you for data from your whistleblowing system. You need the document by Friday. The register is in the system. And you are not allowed to send it to anyone \u2014 not even your own ESG department.<\/p>\n

This is a situation faced by a growing number of companies undergoing sustainability assessments<\/a>, business partner audits, or supply chain due diligence. The questionnaire requires proof that the reporting channel is operational. Refusing without offering an alternative lowers your score. Disclosing the register violates the law.<\/p>\n

There is a third \u2014 and correct \u2014 option between these two bad answers. It is an aggregated report<\/strong>: a separate document prepared for the assessment that allows you to complete the relevant field in the questionnaire without breaching the confidentiality of the internal reports register.<\/p>\n

In this article, I will show you where the confidentiality boundary lies, who in your company is an \u201cunauthorized person” (the answer may surprise you), and which nine elements should be included in a document that an auditor will accept.<\/p>\n

Key terms before we begin<\/h2>\n

Before we move on to the details, it is worth clarifying several terms used later in this article.<\/p>\n\n\n\n\n\n\n\n\n\n
Term<\/th>\nMeaning<\/th>\n<\/tr>\n<\/thead>\n
Internal reports register<\/strong><\/td>\nA document maintained by a legal entity under Article 29 of the Whistleblower Protection Act. It includes, among other things, the report number, the subject matter of the breach, details of the whistleblower and the person named in the report, the date of the report, and information about follow-up actions. Access is restricted to authorized persons.<\/td>\n<\/tr>\n
Aggregated report<\/strong><\/td>\nA separate document prepared ad hoc for an audit or questionnaire. It contains statistical data (e.g. the number of reports received during a given period) from which no individual can be identified. It is not an extract from the system.<\/td>\n<\/tr>\n
Breaches committee<\/strong><\/td>\nThe body responsible for reviewing reports \u2014 internal, external (e.g. a law firm), or hybrid. Its members are the only persons authorized to process data from the register.<\/td>\n<\/tr>\n
Unauthorized person<\/strong><\/td>\nAnyone who has not been formally authorized to access the reports register. This also applies to company employees \u2014 the ESG department, HR (unless serving on the committee), administration, and, in many models, the management board as well.<\/td>\n<\/tr>\n
ESRS G1<\/strong><\/td>\nThe European Sustainability Reporting Standard concerning business conduct. With regard to whistleblowing, it requires a description of how reporting channels operate and an assessment of employee trust \u2014 it does not mandate a numerical metric.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Why you cannot disclose the reports register<\/h2>\n

What the Whistleblower Protection Act says<\/h3>\n

The Whistleblower Protection Act of 14 June 2024<\/a> (Journal of Laws of 2024, item 928), effective from 25 September 2024, clearly regulates three matters concerning the register:<\/p>\n

    \n
  1. Obligation to maintain a register<\/strong> \u2014 Article 29(1)(1) imposes this obligation on the legal entity<\/a> that is the data controller.<\/li>\n
  2. Restricted access<\/strong> \u2014 Article 29(6) permits access to the register only to persons authorized by the legal entity.<\/li>\n
  3. Retention period<\/strong> \u2014 Article 29(5) sets it at 3 years after the end of the calendar year in which the follow-up actions or related proceedings were concluded.<\/li>\n<\/ol>\n

    The register contains sensitive data: the report number, the subject matter of the breach, identifying details of the whistleblower and the person named in the report, the whistleblower\u2019s contact address (if provided), the date of the report, and information about the follow-up actions taken.<\/p>\n

    Penalties for breaching confidentiality<\/h3>\n

    Article 56 of the Act provides for criminal liability<\/strong> for unlawfully disclosing the identity of a whistleblower, a facilitator, or a person connected with the whistleblower: a fine, restriction of liberty, or imprisonment for up to 1 year<\/strong> (source: parliamentary text<\/a>).<\/p>\n

    At the same time, this may constitute a personal data breach \u2014 triggering proceedings before the President of the Personal Data Protection Office and a potential administrative fine under Article 83 of the GDPR.<\/p>\n

    Disclosing the register to an auditor or business partner without a legal basis may therefore constitute both an offense under Article 56 and a GDPR violation. The consequences are not hypothetical.<\/p>\n

    Who in your company is an \u201cunauthorized person”<\/h3>\n

    This is something that surprises many business owners. With regard to the internal reports register, unauthorized persons include:<\/p>\n

      \n
    1. The ESG \/ sustainability department<\/li>\n
    2. HR \u2014 except for members of the breaches committee<\/li>\n
    3. Administration and office management<\/li>\n
    4. The management board \u2014 if its members have not been formally authorized<\/li>\n
    5. An external auditor or business partner<\/li>\n<\/ol>\n

      The only authorized persons are members of the breaches committee<\/strong> \u2014 whether internal, external, or hybrid \u2014 who have been formally authorized by the legal entity.<\/p>\n

      This means that a sustainability specialist who sends an email saying \u201cwe need a report showing the number of reports received” cannot be given an extract from the register or a screenshot from the system. This remains the case even if the specialist is acting on the employer\u2019s instructions and in its interests.<\/p>\n

      Similar rules can be found in other legal regimes. The Anti-Money Laundering Act<\/a> (Article 80) follows the same model: the General Inspector of Financial Information designates persons authorized to receive reports, while communication methods must ensure the \u201cconfidentiality, integrity, and availability of information, including protection against access by unauthorized persons”. A limited group of authorized persons is the standard, not the exception.<\/p>\n

      Contact us<\/a> \u2014 we will check whether your access rights map for the reports register is correct.<\/p>\n

      Aggregated report \u2014 what it is and why it works<\/h2>\n

      The boundary between confidential and aggregated data<\/h3>\n

      There is one clear boundary:<\/p>\n\n\n\n\n\n\n\n\n\n\n\n
      Item<\/th>\nProtected?<\/th>\nCan it be disclosed to the auditor?<\/th>\n<\/tr>\n<\/thead>\n
      Content of the report<\/td>\nYes<\/td>\nNo<\/td>\n<\/tr>\n
      Data identifying the whistleblower<\/td>\nYes<\/td>\nNo<\/td>\n<\/tr>\n
      Data concerning the person named in the report<\/td>\nYes<\/td>\nNo<\/td>\n<\/tr>\n
      Description of the facts of the case<\/td>\nYes<\/td>\nNo<\/td>\n<\/tr>\n
      Number of reports during the period<\/td>\nNo<\/td>\nYes<\/td>\n<\/tr>\n
      Generic description of the outcome<\/td>\nNo<\/td>\nYes<\/td>\n<\/tr>\n
      Information about follow-up actions (without personal data)<\/td>\nNo<\/td>\nYes<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

      The number of reports received during a given period is itself aggregated data<\/strong> \u2014 it does not allow any individual to be identified. It may be disclosed externally. But not in the form of an extract from the system. The appropriate format is a separate document: an aggregated report prepared ad hoc.<\/p>\n

      Caution when the number of reports is low \u2014 risk of re-identification<\/h3>\n

      Recital 26 of the GDPR states that data protection rules do not apply to anonymous information \u2014 information that does not allow an individual to be identified by any means reasonably likely to be used (source: EUR-Lex, GDPR<\/a>).<\/p>\n

      If one report was received during the reporting period and the organization is small, the recipient of the report may potentially be able to link that number to a specific person. The President of the Personal Data Protection Office points out<\/a> that aggregation and the removal of identifiers alone do not necessarily ensure effective anonymization.<\/p>\n

      Before providing the report, check:<\/p>\n

        \n
      1. Whether a result of \u201c1″, combined with the period and organizational scope, makes it possible to identify the whistleblower<\/li>\n
      2. Whether the recipient (a rating platform or business partner) has additional knowledge that would allow the data to be linked to a particular person<\/li>\n
      3. Whether comparing successive reports (e.g. \u201c0″ in one period and \u201c1″ in the next) narrows down the group of possible individuals<\/li>\n<\/ol>\n

        If there is a real risk of re-identification, consider combining categories, using ranges (e.g. \u201c0\u20135 reports”), or extending the reporting period.<\/p>\n

        Nine elements of an aggregated report<\/h2>\n

        Below is the structure of a document that allows you to complete the relevant field in an ESG questionnaire, business partner audit, or supply chain due diligence process \u2014 without breaching the confidentiality of the register.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n
        No.<\/th>\nReport element<\/th>\nWhat to include<\/th>\nWhy it matters<\/th>\n<\/tr>\n<\/thead>\n
        1<\/td>\nDate and place of preparation<\/td>\nE.g. \u201cWarsaw, 15 September 2026″<\/td>\nThe document is prepared \u201cas of” a specific date \u2014 it is not an extract from the system<\/td>\n<\/tr>\n
        2<\/td>\nFull company name<\/td>\nName from the National Court Register, optionally with the logo<\/td>\nThe auditor requires the assessed entity to be identified<\/td>\n<\/tr>\n
        3<\/td>\nReference to the procedure<\/td>\nName of the internal reporting procedure<\/td>\nProof that a formal procedure exists<\/td>\n<\/tr>\n
        4<\/td>\nProcedure implementation date<\/td>\nE.g. \u201cimplemented on 1 October 2024″<\/td>\nProof that the system was operational before the reporting period<\/td>\n<\/tr>\n
        5<\/td>\nPeriod covered by the report<\/td>\nFrom the date of the previous report to the date of preparation<\/td>\nEliminates gaps \u2014 the auditor checks continuity<\/td>\n<\/tr>\n
        6<\/td>\nNumber of reports<\/td>\nA specific value (e.g. \u201c1″ or \u201c0″)<\/td>\nAggregated data \u2014 does not breach confidentiality<\/td>\n<\/tr>\n
        7<\/td>\nGeneric description of the outcome<\/td>\nE.g. \u201crejected for failing to meet the requirements of the procedure”<\/td>\nWithout describing the facts or including personal data<\/td>\n<\/tr>\n
        8<\/td>\nFollow-up actions (without personal data)<\/td>\nE.g. \u201can attempt was made to contact the reporting person, but no response was received”<\/td>\nProof that the system not only receives but also processes reports<\/td>\n<\/tr>\n
        9<\/td>\nSignature of the breaches committee<\/td>\nSigned on behalf of the committee, not the employer<\/td>\nThe committee maintains the register \u2014 this is its document<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

        Three points to agree with the auditor before preparing the document<\/h3>\n

        Before preparing the report, clarify the following with the auditor:<\/p>\n

          \n
        1. Whose letterhead to use<\/strong> \u2014 whether the document should be issued on the company\u2019s or the committee\u2019s (law firm\u2019s) letterhead<\/li>\n
        2. Signature<\/strong> \u2014 whether the signature of one committee member is sufficient or whether all members must sign<\/li>\n
        3. Form of signature<\/strong> \u2014 handwritten, electronic, or trusted profile<\/li>\n<\/ol>\n

          These three questions eliminate the risk that the document will not be accepted for formal reasons and will have to be prepared again under deadline pressure.<\/p>\n

          How to report zero reports<\/h2>\n

          A result of \u201c0″ is not a problem \u2014 provided it is presented properly. A blank field or missing document raises doubts. A clear \u201czero” accompanied by context does not.<\/p>\n

          Article 47(1) of the Whistleblower Protection Act requires public authorities to submit annual statistical reports on external reports, including the number of reports received (source: parliamentary text<\/a>). Although this obligation applies to public authorities rather than private companies, it sets a standard: a result of \u201c0″ should be reported as a specific statistical value rather than omitted.<\/p>\n

          In an aggregated report showing a result of \u201c0″, it is also worth:<\/p>\n

            \n
          1. Specifying the reporting period and organizational scope<\/li>\n
          2. Confirming that the reporting channels were available throughout the entire period (e.g. the online form was operational and the telephone line was active)<\/li>\n
          3. Attaching evidence that the channel was operational \u2014 availability logs, form tests, and employee communications<\/li>\n
          4. Demonstrating awareness-raising and training activities (e.g. training on the procedure or an internal announcement)<\/li>\n
          5. Stating that \u201c0″ means no reports were registered, not that no breaches occurred<\/li>\n<\/ol>\n

            The auditor is looking for continuity. A gap between reporting periods signals that the system was not operational or was not being managed. Therefore, each successive report should cover the period beginning on the date of the previous report \u2014 without any gaps.<\/p>\n

            What an ESG auditor really wants to see<\/h2>\n

            ESRS G1 requirements \u2014 a description, not a number<\/h3>\n

            Contrary to popular belief, ESRS G1-1 paragraph 10(d)<\/a> does not mandate a numerical metric for reports. The standard requires disclosure of whether and how the undertaking assesses that employees:<\/p>\n

              \n
            1. Are aware of the reporting channels<\/li>\n
            2. Trust these channels<\/li>\n
            3. Can use them to raise concerns and have those concerns addressed<\/li>\n<\/ol>\n

              An aggregated report stating the number of reports is therefore supporting evidence<\/strong>, not mandatory evidence. The key evidence includes:<\/p>\n

                \n
              1. A description of the reporting channels (written, oral, telephone, and in-person meetings)<\/li>\n
              2. Rules protecting against retaliation<\/li>\n
              3. Confirmation of training and internal communications<\/li>\n
              4. Results of awareness and trust assessments (e.g. employee surveys)<\/li>\n
              5. Aggregated data on reports and follow-up actions<\/li>\n<\/ol>\n

                An evidence package that convinces auditors<\/h3>\n

                An aggregated report may not be sufficient on its own. A more persuasive package includes:<\/p>\n\n\n\n\n\n\n\n\n\n
                Package element<\/th>\nFormat<\/th>\nPrepared by<\/th>\n<\/tr>\n<\/thead>\n
                Internal reporting procedure<\/td>\nInternal document<\/td>\nCompliance \/ legal counsel<\/td>\n<\/tr>\n
                Description of channels and protection rules<\/td>\nExcerpt from the procedure or a separate document<\/td>\nCompliance \/ legal counsel<\/td>\n<\/tr>\n
                Aggregated report<\/td>\nAd hoc document prepared as of a specific date<\/td>\nBreaches committee<\/td>\n<\/tr>\n
                Confirmation of training<\/td>\nList of participants, agenda, date<\/td>\nHR \/ compliance<\/td>\n<\/tr>\n
                Trust survey results<\/td>\nSurvey report<\/td>\nHR \/ ESG<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                Remember: the same evidence package works for a business partner questionnaire, a bank audit, and a rating platform assessment. You prepare the aggregated report template once and reuse it in every reporting cycle.<\/p>\n

                Five mistakes companies make most often<\/h2>\n

                Mistake 1: the ESG department exports data from the system itself<\/h3>\n

                Wanting to act quickly, a sustainability specialist exports a list of reports from the system and sends it to the auditor. This breaches the confidentiality of the register \u2014 potentially constituting an offense under Article 56 of the Act and a GDPR violation requiring an entry in the personal data breach register<\/a> (Article 33(5) of the GDPR) and potentially notification to the President of the Personal Data Protection Office.<\/p>\n

                Mistake 2: refusing without offering an alternative<\/h3>\n

                The company refuses to provide the data without proposing an aggregated report. The questionnaire field remains blank. The score falls. The business partner\u2019s procurement department asks why there is no evidence that the reporting channel is operational.<\/p>\n

                Mistake 3: a gap between reporting periods<\/h3>\n

                The first report covers the period up to April 2025. The second begins in January 2026. There is an eight-month gap between them. The auditor interprets this as a period during which the system was not operational.<\/p>\n

                Mistake 4: the document does not include the company name or reporting period<\/h3>\n

                A report that does not identify the entity or specify the reporting period will not be accepted as evidence. The work has to be done twice, with the questionnaire deadline looming.<\/p>\n

                Mistake 5: no established request process<\/h3>\n

                The request comes from the ESG department, which is not authorized either to commission work from the committee or to receive data from the register. The matter comes to a standstill. Decide in advance who on the company\u2019s side is responsible for confirming the request to prepare the report.<\/p>\n

                Checklist: what to implement in your organization<\/h2>\n\n\n\n\n\n\n\n\n\n\n\n
                No.<\/th>\nAction<\/th>\nPriority<\/th>\nCategory<\/th>\n<\/tr>\n<\/thead>\n
                1<\/td>\nPrepare a standard aggregated report template containing the nine elements and save it in the compliance repository<\/td>\nHigh<\/td>\nDocumentation<\/td>\n<\/tr>\n
                2<\/td>\nCreate an access rights map for the register: list all authorized persons (committee members) by name and confirm in writing that the ESG department, HR staff who are not on the committee, administration, and the management board do not have access to the content of reports<\/td>\nHigh<\/td>\nAudit<\/td>\n<\/tr>\n
                3<\/td>\nAdd a rule to the procedure stating that every external request for data about reports must be referred to the breaches committee, not the ESG department<\/td>\nHigh<\/td>\nProcess change<\/td>\n<\/tr>\n
                4<\/td>\nMaintain a dated report version log \u2014 each successive period should begin on the date of the previous report, with no gaps<\/td>\nHigh<\/td>\nDocumentation<\/td>\n<\/tr>\n
                5<\/td>\nTrain the ESG, HR, and administration departments on one rule: the number of reports may be disclosed, but their content and personal data may not<\/td>\nMedium<\/td>\nTraining<\/td>\n<\/tr>\n
                6<\/td>\nOrganize the request process: determine who confirms the instruction for an adviser to prepare the report<\/td>\nMedium<\/td>\nProcess change<\/td>\n<\/tr>\n
                7<\/td>\nReview the reporting procedure to determine whether it addresses aggregated reporting for external assessments \u2014 if it does not, add it<\/td>\nLow<\/td>\nLegal review<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                You can build the access rights map for the reports register using the model of a personal data processing authorization register<\/a>, which most companies already maintain under the GDPR. The structure is the same: authorization number, full name, scope, date granted, date revoked, and signature. You are extending an existing document rather than creating a new one from scratch.<\/p>\n

                How we can help<\/h2>\n

                We support companies that have implemented an internal reporting procedure and need assistance with ESG audits, business partner questionnaires, and supply chain due diligence.<\/p>\n

                We offer three support options \u2014 depending on your organization\u2019s current stage:<\/p>\n\n\n\n\n\n\n\n
                Option<\/th>\nWhat it includes<\/th>\nWho it is for<\/th>\n<\/tr>\n<\/thead>\n
                Procedure review and report template<\/strong><\/td>\nReview of the reporting procedure, preparation of an aggregated report template, and determination of the reporting period<\/td>\nCompanies with an implemented procedure<\/a> undergoing an ESG audit for the first time<\/td>\n<\/tr>\n
                Template + access rights map + training<\/strong><\/td>\nAs above + preparation of an access rights map for the register + training for the ESG, HR, and administration departments<\/td>\nCompanies with an external committee or a complex organizational structure<\/td>\n<\/tr>\n
                Full-service protection<\/strong><\/td>\nThe law firm acts as the breaches committee, maintains the register, and handles recurring aggregated reporting<\/td>\nCompanies that want to outsource the entire process and have a document ready whenever a request is received<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                Regardless of the option selected, the aggregated report is prepared by the breaches committee, not the ESG department. Your team does not handle data from the register. The document is ready the day after it is requested.<\/p>\n

                Organize your procedure before the next questionnaire arrives<\/h2>\n

                An ESG auditor, a business partner, or a bank \u2014 they all ask the same question: is your reporting channel operational? Answering it does not require disclosing the register. It requires one document containing nine elements, prepared by the appropriate body and in compliance with the Act.<\/p>\n

                Prepare the template once. Establish an access rights map. Implement a request process. Whenever another request arrives, the document can be prepared within one day.<\/p>\n

                If you want to check whether your reporting procedure will pass your next audit, contact us<\/a>. We will review it and identify what needs to be corrected.<\/p>\n

                Frequently asked questions<\/h2>\n

                Can I simply email the auditor the number of reports without preparing a formal document?<\/strong>
                \nTechnically, the number of reports alone is aggregated data, and disclosing it does not breach the confidentiality of the register. The issue lies with the auditor \u2014 a document without the company name, the reporting period, and the signature of the breaches committee may not be accepted as evidence. Auditors and rating platforms require an identifiable document. It is better to prepare a short report containing the nine elements than to risk having to redo the work under deadline pressure.<\/p>\n

                What should I do if the auditor insists on seeing descriptions of the reports rather than statistics alone?<\/strong>
                \nRefuse and explain the legal basis: Article 29(6) of the Whistleblower Protection Act restricts access to the register to authorized persons, while Article 56 provides for criminal liability for disclosing a whistleblower\u2019s identity. Offer an expanded aggregated report \u2014 including a generic description of the outcome and follow-up actions without personal data. ESRS G1 does not mandate a numerical metric or descriptions of individual cases \u2014 it requires a description of how the channels operate and an assessment of employee trust.<\/p>\n

                Can my ESG department have \u201cnumbers only” access to the reporting system?<\/strong>
                \nIt depends on the system configuration and the scope of the authorization. If the system provides a view of aggregated statistics only, without access to the content of reports or personal data, this is formally permissible, provided that the ESG employee has been authorized to process data within that scope. In most organizations, the safer model is to request the report from the breaches committee \u2014 this eliminates the risk of accidental access to sensitive data.<\/p>\n

                How should we report a period in which no reports were received \u2014 does zero look suspicious?<\/strong>
                \nNo \u2014 provided that \u201czero” is presented as a specific statistical value rather than a blank field. Include confirmation that the channels were available throughout the period (e.g. logs or form tests), demonstrate awareness-raising and training activities, and state that \u201c0″ means no reports were registered, not that no breaches occurred. The auditor is looking for continuity and evidence that the system is operational \u2014 not merely the number itself.<\/p>\n

                Will the same document be sufficient for a business partner questionnaire and a bank audit?<\/strong>
                \nYes \u2014 the aggregated report template is universal. It contains the same nine elements regardless of the recipient. Formal requirements may differ (letterhead or form of signature), so before preparing the document, it is worth asking the recipient three questions: whose letterhead should be used, whether one or all committee members must sign, and what form of signature is accepted.<\/p>\n

                What are the consequences if someone in the organization has already sent register data to an auditor?<\/strong>
                \nDisclosing a whistleblower\u2019s data to an unauthorized person may constitute an offense under Article 56 of the Whistleblower Protection Act (a fine, restriction of liberty, or imprisonment for up to 1 year). At the same time, it may constitute a personal data breach requiring an entry in the personal data breach register (Article 33(5) of the GDPR) and potentially notification to the President of the Personal Data Protection Office. Consult a lawyer to assess the scope of the breach and take appropriate remedial action.<\/p>\n","protected":false},"excerpt":{"rendered":"

                Learn how to respond to an ESG auditor with a nine-element aggregated whistleblowing report while keeping the Polish internal reports register confidential.<\/p>\n","protected":false},"author":13,"featured_media":3445,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":"","sip_alt_url":"","sip_en_pl_url":"","sip_pair_uuid":"c6c998e6-7387-468e-b108-1812e3887360","sip_pair_state":"draft_ready"},"categories":[1442],"tags":[1555,1533,1446,1540,1528,1531,1532],"specialization":[1212],"practice_area":[],"class_list":["post-5245","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-labor-law","tag-corporate-governance-en","tag-data-breach","tag-gdpr","tag-internal-procedure","tag-labor-law","tag-personal-data-protection","tag-whistleblowers","specialization-labor-law"],"acf":[],"_links":{"self":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts\/5245","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/users\/13"}],"replies":[{"embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/comments?post=5245"}],"version-history":[{"count":6,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts\/5245\/revisions"}],"predecessor-version":[{"id":5262,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts\/5245\/revisions\/5262"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/media\/3445"}],"wp:attachment":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/media?parent=5245"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/categories?post=5245"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/tags?post=5245"},{"taxonomy":"specialization","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/specialization?post=5245"},{"taxonomy":"practice_area","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/practice_area?post=5245"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}