This guide sets out the full list of employer duties described under Poland’s whistleblower rules: what an organization operating in Poland must implement, how to organize its reporting system and what actions to avoid toward people who report irregularities.
Who is covered and when the rules took effect
Poland’s Act on the Protection of Persons Reporting Violations of Law entered into force on 25 September 2024. The deadline for implementing internal procedures has already passed.
A whistleblower is a person reporting violations within an organization, such as an employee, contractor or external person connected with the company. The employer must provide that person with safe conditions to report irregularities.
If your company has not yet implemented procedures, act immediately. The Polish rules are in force, and having no system does not release you from liability.
Internal reporting procedure: what you need to prepare
A whistleblower protection system is not a single document. It is a set of connected elements: a procedure, a technical tool, reporting channels and a body that handles cases.
What the reporting system includes
- Internal reporting procedure: written rules for whistleblowing within the company, consistent with the requirements of the Polish Act.
- IT system: a platform that allows reports to be submitted online, including anonymously.
- Oral channel: an additional way to report a matter without making a written submission.
- Body or person handling reports: a committee, designated employee or external entity.
Reporting channels: what you must make available
Poland’s Act requires you to provide at least two types of channel:
- Online report: through a dedicated platform. The system should:
- allow anonymous reports,
- automatically register every report,
- confirm receipt of a report,
- allow anonymous exchange of messages with the whistleblower.
- Oral report: choose between two options:
- designating a contact person (risk: the whistleblower may decide not to report for fear of losing anonymity),
- an automated voicemail system, a better option because the whistleblower can record a message without revealing their identity.
Who should handle reports
You have three options:
- Internal committee: made up of company employees.
- External entity: for example, a law firm.
- Mixed body: an employer representative together with an external lawyer.
Assigning report handling to a law firm has specific benefits:
- Cases are handled by people experienced in employment law and dispute resolution.
- It is easier to take appropriate action, for example in workplace bullying cases.
- The law firm keeps the whistleblower’s data itself and does not pass it to the employer, which the source says meets the statutory anonymity requirement.
Example: A company with more than 250 employees implemented an online platform for anonymous reports. Each report is automatically registered, and the whistleblower receives confirmation of receipt. An external law firm handles the reports and communicates while preserving anonymity.
Ban on retaliation: the most important whistleblower protection rule
The Polish Act (Articles 11 and 12) prohibits taking any negative action against a whistleblower because they made a report. This is not a recommendation. It is described as a legal obligation carrying criminal sanctions.
What counts as retaliation
Retaliation means any negative consequences experienced by a whistleblower after reporting, directly because of the report. The list is open-ended: it covers any action intended to cause a disadvantage to the whistleblower.
Examples listed in Poland’s Act:
- dismissal,
- demotion,
- reduction in pay,
- workplace bullying or discrimination,
- being passed over for training,
- change of work position,
- being referred for additional medical examinations.
Consequences for people who retaliate
- A prison sentence of up to 2 years for retaliating against a whistleblower.
- The employer must not only refrain from retaliation but also actively protect the whistleblower from retaliatory actions by other people in the organization.
Example: Anna, a quality specialist, reported irregularities in product inspections. The company responded by disciplining the person responsible for the errors, Andrzej. The employer must also make sure that Andrzej does not take revenge on Anna. If he does, the employer must take further action against Andrzej and bring the situation to an end.
What you need to put in place in practice
- Make sure employees know about the ban on retaliation and the penalty that may apply.
- Provide at least one safe reporting channel.
- Build an organizational culture that supports reporting irregularities, not only on paper but in day-to-day operations.
Feedback to the whistleblower: deadline and content
Poland’s Act requires you to give the whistleblower feedback on the action taken in response to a report. You have a maximum of 3 months from the date of the report.
The feedback should state:
- whether an investigation was opened,
- what action was taken,
- the outcome of that action.
The challenge: how to respond to an anonymous whistleblower
If the whistleblower did not provide contact details, you need a system that allows anonymous correspondence, for example through a unique report number. The whistleblower logs in with that number and checks the response. You reply without learning their identity.
Example: Company Z ensures that each whistleblower receives an update on the case’s progress within three months, including information about investigations opened and their outcomes. Communication takes place through a platform without revealing the whistleblower’s details.
Report register: what you need to document
Poland’s Act requires you to maintain a register of internal reports. Every report must be documented.
Required register entries
- Report number.
- Subject of the violation.
- Personal data of the reporting person and the person concerned by the report, unless the report is anonymous.
- Contact address for the reporting person.
- Date the report was made.
- Information about follow-up action taken.
- Date the case was closed.
Keep the register up to date. Each report must end with an entry about the action taken and the outcome. This is linked to the duty to provide feedback.
Training and system monitoring
Implementing the procedure is not the end. You must regularly check that the system works and that employees know about it.
What to do regularly
- Monitor system effectiveness: check whether reports are being received, channels work and deadlines are met.
- Update internal procedures: adapt them to changes in Polish law and the organization’s needs.
- Review the system: at least once a year. Take account of employee feedback, report records and changes in the law.
- Train employees: make sure they know how to report irregularities, what rights they have and what consequences apply to retaliation.
Example: Company Z reviews its whistleblower protection system every year. It considers employee feedback, records of reports and changes in the law. On that basis, it updates its procedures and tools.
What to do if you have not implemented the rules yet
The Polish rules have been in force since September 2024. Failure to implement them creates a risk of legal liability for both the company and its managers.
Order of action
- Check whether your company is covered by Poland’s Act: verify the number of people working for you and the nature of your business.
- Prepare an internal reporting procedure that meets the requirements of Poland’s Act.
- Implement an IT system that allows anonymous reports and correspondence.
- Set up an oral channel, preferably an automated voicemail system.
- Appoint a body to handle reports: internal, external or mixed.
- Start maintaining a report register from the first day the system operates.
- Train employees on the procedure, whistleblower rights and the ban on retaliation.
- Schedule periodic system reviews, at least once a year.
If you need legal support with implementation in Poland, contact a law firm specializing in whistleblower services.
Frequently asked questions
What duties does an employer have toward whistleblowers under Poland’s Act?
An employer must prepare and implement an internal reporting procedure, launch reporting channels (online and oral), appoint a body to handle reports, maintain a report register, give the whistleblower feedback within 3 months and actively protect them from retaliation. Ongoing duties also include employee training, monitoring system effectiveness and reviewing procedures periodically, at least once a year.
What should an internal whistleblowing system compliant with Poland’s Act include?
The system must include four elements: a written reporting procedure; an IT platform that allows anonymous online reports with automatic registration and confirmation of receipt; an oral channel, such as an automated voicemail system; and an appointed body to handle reports, which may be an internal committee, an external entity such as a law firm, or a mixed body. The platform should also allow anonymous message exchanges with the whistleblower so you can correspond and provide feedback without learning the reporting person’s identity.
Must a company allow anonymous whistleblower reports, and how can it arrange this in practice?
Yes. The IT system should allow anonymous reports, register them automatically, confirm receipt and support anonymous messaging between the whistleblower and the company. In practice, the whistleblower receives a unique report number, uses it to log into the platform and check the response. You reply without learning their identity. For the oral channel, an automated voicemail system is a better solution than appointing a contact person because it removes the risk that the whistleblower will decide not to report for fear of losing anonymity.
Which actions against a whistleblower count as retaliation, and what are the consequences?
Retaliation means any negative consequences experienced by a whistleblower after reporting, directly because of the report. The list is open-ended and includes dismissal, demotion, reduced pay, workplace bullying, discrimination, being passed over for training, a change of work position or referral for additional medical examinations. Retaliation carries a prison sentence of up to 2 years. The employer must not only refrain from retaliation but also actively protect the whistleblower from such actions by others in the organization.
When must feedback be given to the whistleblower, and what must the report register contain?
You have a maximum of 3 months from the report date to give feedback stating whether an investigation was opened, what action was taken and its outcome. The internal report register must contain seven entries: the report number; subject of the violation; personal data of the reporting person and the person concerned (unless the report is anonymous); the reporting person’s contact address; the report date; information about follow-up action taken; and the case closure date.
