{"id":3014,"date":"2026-10-21T14:09:58","date_gmt":"2026-10-21T14:09:58","guid":{"rendered":"https:\/\/sawaryn.com\/us\/?p=3014"},"modified":"2026-10-21T14:10:28","modified_gmt":"2026-10-21T14:10:28","slug":"poland-whistleblowing-channel-group-platform","status":"publish","type":"post","link":"https:\/\/sawaryn.com\/us\/poland-whistleblowing-channel-group-platform\/","title":{"rendered":"A Group Whistleblowing Platform Is Not Enough for a Polish Company"},"content":{"rendered":"

A Group Whistleblowing Platform Is Not Enough for a Polish Company<\/h1>\n

Headquarters has sent your Polish company a reporting-platform configuration already used by a sister company. The software works, and the channel is live. Yet the Polish operation may still fall short of local requirements.<\/p>\n

The most serious risks may have little to do with the platform. They concern who receives and investigates reports, how group legal counsel advises, where the reports register is kept, and whether the Polish company consulted its own workforce.<\/p>\n

Poland\u2019s Act of June 14, 2024, on the Protection of Whistleblowers<\/strong> (Journal of Laws 2024, item 928) has applied since September 25, 2024. Its provisions on external reports took effect on December 25, 2024. The obligation to establish an internal reporting procedure rests with each legal entity<\/strong><\/a> employing at least 50 people\u2014not with the corporate group as a whole (text of the Act<\/a>).<\/p>\n

Public authorities recorded 1,908 external reports<\/strong> between December 25, 2024, and December 31, 2025 (2024\u20132025 government report<\/a>). Whistleblowers are using external channels. A company whose internal channel does not work properly risks losing the opportunity to address a report internally before it reaches an authority or is disclosed publicly.<\/p>\n

This article explains what a Polish subsidiary or branch needs to put in place, regardless of how well the group\u2019s platform works.<\/p>\n

Key terms<\/h2>\n

The Act and the EU General Data Protection Regulation (GDPR) use terms with specific legal significance.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n
Term<\/th>\nMeaning<\/th>\n<\/tr>\n<\/thead>\n
Whistleblower<\/strong><\/td>\nA person reporting a breach of law, such as an employee, associate, contractor, job applicant, or freelancer.<\/td>\n<\/tr>\n
Internal reporting channel<\/strong><\/td>\nA way to submit a report within the organization, such as a form, meeting, or telephone line.<\/td>\n<\/tr>\n
Internal reporting procedure<\/strong><\/td>\nThe document setting out how reports are received, investigated, and documented; it is required by the Act.<\/td>\n<\/tr>\n
Follow-up measures<\/strong><\/td>\nSteps taken after receipt of a report, including verification, investigation, and corrective changes.<\/td>\n<\/tr>\n
Authorized person<\/strong><\/td>\nA person given written authorization to process personal data when handling reports under Article 27 of the Act.<\/td>\n<\/tr>\n
Data protection impact assessment (DPIA)<\/strong><\/td>\nAn assessment of risks to personal data protection. The source identifies it as mandatory for whistleblowing systems under the list issued by the President of Poland\u2019s Personal Data Protection Office (UODO), Monitor Polski<\/em> 2019, item 666, point 9.<\/td>\n<\/tr>\n
Data processing agreement<\/strong><\/td>\nAn agreement between a data controller and a party processing personal data on its behalf under Article 28 GDPR.<\/td>\n<\/tr>\n
Adequacy decision<\/strong><\/td>\nA European Commission decision finding that a country outside the EU provides an adequate level of personal data protection.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Why the group\u2019s existing solution is not enough<\/h2>\n

Each legal entity has its own obligations<\/h3>\n

Article 8(3) of Directive (EU) 2019\/1937<\/a> places the internal-channel obligation on each legal entity<\/strong> employing at least 50 people<\/a>, rather than on the group. A central platform can provide the technology, but the Polish company still needs:<\/p>\n

    \n
  1. Its own internal reporting procedure<\/a><\/strong>, covering the eight mandatory elements in Article 25(1) of the Act.<\/li>\n
  2. Its own workforce consultation<\/strong> with a trade union or representatives of people performing work, allowing 5\u201310 days for consultation on the procedure\u2019s final wording.<\/li>\n
  3. Its own internal reports register<\/strong>, including reports found to be unfounded.<\/li>\n
  4. Its own DPIA<\/strong>, because whistleblowing systems appear on the list issued by the President of UODO.<\/li>\n
  5. Its own written authorizations<\/a><\/strong> for people handling reports.<\/li>\n<\/ol>\n

    A copied technical configuration replaces none of these steps.<\/p>\n

    Data-protection responsibility remains local<\/h3>\n

    The GDPR assigns responsibility to a controller with an EU establishment even in relation to breaches of binding corporate rules by group members outside the EU (Article 47(2)(f) GDPR). Recital 127 GDPR addresses local supervisory oversight of employee-data processing in an employment context confined to one member state.<\/p>\n

    The practical conclusion for the model described here is that the President of UODO is the relevant supervisory authority for the Polish subsidiary\u2019s reporting channel<\/strong>, regardless of where headquarters is located. An inspection or penalty may affect the Polish entity.<\/p>\n

    Three serious risks that are not software defects<\/h2>\n

    An anonymized review of a Polish operation within an international group identified 14 risks: one critical, seven high, and six medium. The three most serious concerned the operating model, not the platform.<\/p>\n

    A one-person committee becomes a bottleneck<\/h3>\n

    Assigning one person to receive reports appears simple, but creates three problems:<\/p>\n

      \n
    1. Missed deadlines.<\/strong> Leave, illness, or travel can put the statutory timelines at risk: seven days to acknowledge receipt and three months to provide feedback (Polish National Labor Inspectorate overview<\/a>).<\/li>\n
    2. Conflicts of interest.<\/strong> A report about the sole committee member goes to that same person. Without a recusal route, a whistleblower may bypass the internal channel.<\/li>\n
    3. Impartiality concerns.<\/strong> Article 26 requires an impartial<\/strong> person responsible for follow-up. One person both receiving and investigating reports will not satisfy that condition in every scenario.<\/li>\n<\/ol>\n

      What to do:<\/strong> Appoint at least two authorized people. Set out substitution and case-specific recusal rules in the procedure. Provide a separate route for reports about a committee member, and name an impartial person to investigate them.<\/p>\n

      Group legal counsel\u2019s role is left undefined<\/h3>\n

      Group legal counsel may advise the committee without receiving information that identifies the whistleblower. That model is lawful, but it needs a protocol for removing or masking identifying details. Discussion of the facts can quickly reveal the person involved, particularly in an email thread. Disclosure of a whistleblower\u2019s identity without consent is a criminal offense<\/strong> punishable by a fine, restriction of liberty, or imprisonment for up to one year under Article 56 of the Act.<\/p>\n

      The Act does not require a lawyer to sit on the committee. It requires an authorized person to receive reports and an impartial person responsible for follow-up\u2014two distinct functions.<\/p>\n

      What to do:<\/strong> Document which of these models applies:<\/p>\n\n\n\n\n\n\n
      Model<\/th>\nGroup legal counsel\u2019s role<\/th>\nControls to put in place<\/th>\n<\/tr>\n<\/thead>\n
      Advisory<\/strong><\/td>\nAdvises on facts presented without identifying details; does not receive or investigate reports.<\/td>\nDescribe the role in the procedure, adopt a pseudonymization protocol, and prohibit copying report content into email.<\/td>\n<\/tr>\n
      Committee membership<\/strong><\/td>\nParticipates fully and can access identifying information.<\/td>\nIssue named written authorizations and confidentiality undertakings, and document the basis for data transfers. For the UK, the source identifies an adequacy decision.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

      The reports register sits outside the protected system<\/h3>\n

      Article 29 requires an internal reports register, including reports considered unfounded<\/strong>. Reporting platforms do not always provide a suitable register function. The workaround is often a spreadsheet on a shared drive\u2014a second, less protected copy of identifying information, potentially outside appropriate access controls and activity logging.<\/p>\n

      What to do:<\/strong> Choose one location and format for the register, and restrict access. Do not keep it in email or on an uncontrolled shared drive. Record the information required by the Act, rather than copying the full report into the register.<\/p>\n

      Contact us<\/a> if you need to review how responsibilities and access are divided.<\/p>\n

      What to complete before launch<\/h2>\n

      These are pre-launch tasks, not items to resolve after the channel starts receiving reports.<\/p>\n

      Procedure and workforce consultation<\/h3>\n
        \n
      1. Prepare an internal reporting procedure containing the eight elements required by Article 25(1).<\/li>\n
      2. Consult its final wording with a trade union or representatives of people performing work, allowing 5\u201310 days from presentation of the draft.<\/li>\n
      3. If there is no trade union, document how the representatives were selected.<\/li>\n
      4. Publish and communicate the procedure to the workforce, allowing a period before it takes effect.<\/li>\n
      5. Provide Polish versions of the procedure and reporting form, even if English is the company\u2019s working language.<\/li>\n<\/ol>\n

        People, authority, and training<\/h3>\n
          \n
        1. Appoint at least two people authorized to handle reports, including one independent of the head of the entity.<\/li>\n
        2. Give them named written data-processing authorizations and confidentiality undertakings that continue after employment ends.<\/li>\n
        3. Keep a record of authorizations and prevent anyone without authorization from accessing the system.<\/li>\n
        4. Name an impartial person to investigate a report concerning a committee member.<\/li>\n
        5. Train authorized people before<\/strong> granting access. Cover identity confidentiality, criminal liability for disclosure, the ban on taking report content outside the system, and use of the tool.<\/li>\n<\/ol>\n

          Reporting routes<\/h3>\n
            \n
          1. Launch a confidential online form on the reporting platform.<\/li>\n
          2. Provide an oral route: a telephone line or<\/strong> a procedure expressly offering an in-person meeting within 14 days at the whistleblower\u2019s request.<\/li>\n
          3. Make the channel accessible to people outside the organization, including contractors, applicants, and associates.<\/li>\n
          4. If another group company uses the same address or tool, distinguish the companies\u2019 forms and addresses and confirm that their platform instances are separate.<\/li>\n<\/ol>\n

            GDPR and the platform provider<\/h3>\n
              \n
            1. Complete a DPIA regardless of the expected processing volume, as identified in the President of UODO\u2019s list (Monitor Polski<\/em> 2019, item 666, point 9).<\/li>\n
            2. Agree on the provider\u2019s access model. Disable or transfer super-administrator rights where possible; if the provider retains access, specify its scope in the data processing agreement<\/a>.<\/li>\n
            3. Require named authorizations for provider personnel and log every entry into the company\u2019s platform instance.<\/li>\n
            4. Complete the agreement\u2019s list of subprocessors.<\/li>\n
            5. Document the basis for transfers to a country outside the EU. For the UK, the source points to Adequacy Decision (EU) 2025\/2574 of December 19, 2025<\/a>.<\/li>\n
            6. Enable multifactor authentication for accounts that can access report content.<\/li>\n
            7. Add \u201chandling whistleblower reports\u201d to the company\u2019s record of processing activities<\/a>.<\/li>\n<\/ol>\n

              Ongoing controls<\/h3>\n
                \n
              1. Review and delete personal data collected by accident that proves irrelevant within 14 days of determining it is irrelevant (Article 8 of the Act).<\/li>\n
              2. Set retention at three years after the end of the calendar year in which follow-up measures concluded.<\/li>\n
              3. Schedule a DPIA review at least every 12 months and whenever the provider, system architecture, or committee membership changes.<\/li>\n<\/ol>\n

                Criminal exposure and the cost of an ineffective channel<\/h2>\n

                The Act provides for criminal penalties<\/strong>, not administrative financial penalties of the kind available under the GDPR. Individuals may therefore face personal liability.<\/p>\n\n\n\n\n\n\n\n\n\n
                Conduct<\/th>\nProvision<\/th>\nPenalty stated in the source<\/th>\n<\/tr>\n<\/thead>\n
                Preventing or obstructing a report<\/td>\nArticle 54(1)<\/td>\nFine, restriction of liberty, or imprisonment for up to one year<\/strong><\/td>\n<\/tr>\n
                Obstruction using violence, threats, or deception<\/td>\nArticle 54(2)<\/td>\nImprisonment for up to three years<\/strong><\/td>\n<\/tr>\n
                Retaliation against a whistleblower<\/td>\nArticle 55(1)<\/td>\nFine, restriction of liberty, or imprisonment for up to two years<\/strong><\/td>\n<\/tr>\n
                Disclosure of a whistleblower\u2019s identity<\/td>\nArticle 56<\/td>\nFine, restriction of liberty, or imprisonment for up to one year<\/strong><\/td>\n<\/tr>\n
                Failure to establish an internal reporting procedure<\/td>\nArticle 58<\/td>\nCriminal penalty; the details require checking against the full text of the Act<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                Act of June 14, 2024, Journal of Laws 2024, item 928<\/a><\/p>\n

                The operational consequence may be just as important: a whistleblower may report directly to a public authority instead of using the company\u2019s channel. Article 30(1) does not<\/strong> require the internal channel to be used first. Public disclosure is another possible route. The government report<\/a> records 1,908 external reports<\/strong> received by public authorities from December 25, 2024, through December 31, 2025.<\/p>\n

                Five ways an otherwise working platform can fail<\/h2>\n

                1. The sole recipient is away<\/h3>\n

                A report arrives on day one of the only committee member\u2019s two-week absence. No one sends the seven-day acknowledgment, and the whistleblower has reason to conclude that the internal route is not working.<\/p>\n

                Safeguard:<\/strong> Establish a substitute and automatically forward notifications to that person.<\/p>\n

                2. The report concerns the committee member<\/h3>\n

                A report about the only committee member is delivered to that same person. The source does not identify a separate penalty for this arrangement, but the whistleblower may go to an authority or the media instead.<\/p>\n

                Safeguard:<\/strong> Provide a separate channel and name an impartial investigator\u2014for example, a management board member who is not on the committee.<\/p>\n

                3. Two group companies share an address<\/h3>\n

                Both companies use one platform, and an employee of company A joins company B\u2019s committee without authorization from the relevant data controller or a documented basis for sharing data between the entities.<\/p>\n

                Safeguard:<\/strong> Separate the platform instances, obtain authorizations from the appropriate controller, and document the basis for data sharing.<\/p>\n

                4. The provider can read reports<\/h3>\n

                The platform provider retains super-administrator rights that technically allow its personnel to access report content, but the data processing agreement does not address that access.<\/p>\n

                Safeguard:<\/strong> Seek to disable or transfer those rights. If access remains, specify its scope in the agreement, require named authorizations, and log every entry.<\/p>\n

                5. An \u201canonymous\u201d report identifies its author<\/h3>\n

                A report contains no name, but the circumstances make its author obvious to a small team. Procedural anonymity does not guarantee anonymity in practice. In a small operation, the likelihood of a confidentiality breach may be lower, but its effect on the individual can be greater.<\/p>\n

                Safeguard:<\/strong> Accepting anonymous reports is optional under the source\u2019s account of the Act. Whatever the company decides, restrict access and train authorized personnel to protect identity confidentiality.<\/p>\n

                Why the DPIA matters even for a small operation<\/h2>\n

                Whistleblowing systems appear on the list issued by the President of UODO (Monitor Polski<\/em> 2019, item 666, point 9). On that basis, the source states that a DPIA is mandatory regardless of headcount or expected report volume<\/strong> (UODO guidance on DPIAs and reporting breaches<\/a>).<\/p>\n

                The source also identifies at least two criteria from the WP248 rev.01 data-protection guidelines:<\/p>\n

                  \n
                1. Highly personal data:<\/strong> Reports may describe alleged breaches, workplace relationships, and individual conduct.<\/li>\n
                2. People in a weaker position:<\/strong> Employees, associates, and applicants may depend on the entity about which they report.<\/li>\n<\/ol>\n

                  Complete the DPIA before launch<\/strong>, then review it at least every 12 months and when the provider, architecture, or committee membership changes.<\/p>\n

                  In the anonymized case discussed above, the DPIA risk register contained 14 entries. After the highest-priority controls were implemented, residual risk fell to medium. The channel could then launch without prior consultation with the President of UODO under Article 36 GDPR.<\/p>\n

                  How we can help<\/h2>\n

                  A compliant reporting channel depends on the organizational design: who receives reports, who investigates, who advises, and who can see the data. The platform is only one part of that design.<\/p>\n

                  We support Polish subsidiaries and branches of international groups with:<\/p>\n\n\n\n\n\n\n\n
                  Service<\/th>\nScope<\/th>\n<\/tr>\n<\/thead>\n
                  Procedure and checklist review<\/strong><\/td>\nCheck an existing procedure against the eight statutory elements, identify gaps, and recommend changes.<\/td>\n<\/tr>\n
                  Procedure, authorizations, consultation, and DPIA<\/strong><\/td>\nPrepare the procedure, arrange authorizations and workforce consultation, and assess data-protection risks.<\/td>\n<\/tr>\n
                  Comprehensive support<\/strong><\/td>\nAddress the procedure, authorizations, DPIA, provider agreement, training, and periodic reviews together.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                  Our approach brings employment law, the GDPR, and Poland\u2019s Whistleblower Protection Act<\/a> into one implementation process.<\/p>\n

                  A Polish company cannot rely on headquarters to complete its local procedure, consultation, register, DPIA, authorizations, or training. If you are preparing to launch a channel\u2014or need to review one already in use\u2014contact us<\/a>. We can help define roles and complete the local work before launch.<\/p>\n

                  Frequently asked questions<\/h2>\n

                  Must our lawyer or group legal department sit on the reporting committee?<\/strong><\/p>\n

                  No. The Act calls for an authorized person to receive reports and an impartial person responsible for follow-up; it does not require a lawyer on the committee. Group legal counsel can advise on facts presented without identifying details if its role is set out in the procedure. Before anyone on the group side accesses identifying information, provide written authorizations and confidentiality undertakings.<\/p>\n

                  How much of another group company\u2019s system can we reuse in Poland?<\/strong><\/p>\n

                  You can reuse the platform. The Polish legal entity must establish its own procedure, workforce consultation, register, DPIA, and authorizations. The source notes that Directive (EU) 2019\/1937<\/a> permits entities employing 50\u2013249 people to share resources, subject to confidentiality and independence.<\/p>\n

                  Must we accept anonymous reports?<\/strong><\/p>\n

                  No. The source treats acceptance of anonymous reports as an optional element of the procedure. Even a report submitted without a name can identify its author through its contents, especially in a small team. Protect confidentiality through access limits and training either way.<\/p>\n

                  Is a DPIA required if we expect very few reports?<\/strong><\/p>\n

                  Yes, according to the source\u2019s account of the President of UODO\u2019s list (Monitor Polski<\/em> 2019, item 666, point 9). The stated requirement does not depend on employee numbers or expected report volume. The source also points to highly personal data and people in a weaker position as relevant assessment criteria.<\/p>\n

                  What if someone discloses a whistleblower\u2019s identity?<\/strong><\/p>\n

                  Under Article 56 of the Act, disclosure without the whistleblower\u2019s consent is a criminal offense punishable by a fine, restriction of liberty, or imprisonment for up to one year. Liability can attach personally to the individual who discloses the information.<\/p>\n

                  Is an office-tool form or a dedicated company inbox enough?<\/strong><\/p>\n

                  The source rejects a free office-tool form where there is no data processing agreement or confidentiality guarantee. It also rejects a dedicated email address as the sole channel, citing confidentiality risks in email circulation, lack of access for people outside the organization, and no way to maintain a dialogue with an anonymous reporter. The channel needs confidentiality, accessibility, and two-way communication.<\/p>\n","protected":false},"excerpt":{"rendered":"

                  Reusing a group whistleblowing platform in Poland? See what the local company must address, from workforce consultation to report access and data protection.<\/p>\n","protected":false},"author":14,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":"","sip_alt_url":"https:\/\/sawaryn.com\/publikacje\/kanal-zgloszen-sygnalistow-spolka-zalezna\/","sip_en_pl_url":"https:\/\/sawaryn.com\/en\/publikacje\/whistleblowing-channel-polish-branch-group\/","sip_pair_uuid":"b158c25a-4ea4-461b-b84a-552b2f97dc05","sip_pair_state":"verified"},"categories":[1],"tags":[1206,1237,1246,1219,1238],"specialization":[1130],"practice_area":[],"class_list":["post-3014","post","type-post","status-publish","format-standard","hentry","category-uncategorized","tag-gdpr","tag-personal-data-protection","tag-risk-assessment","tag-uodo","tag-whistleblowers","specialization-employment-law"],"acf":[],"_links":{"self":[{"href":"https:\/\/sawaryn.com\/us\/wp-json\/wp\/v2\/posts\/3014","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sawaryn.com\/us\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sawaryn.com\/us\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sawaryn.com\/us\/wp-json\/wp\/v2\/users\/14"}],"replies":[{"embeddable":true,"href":"https:\/\/sawaryn.com\/us\/wp-json\/wp\/v2\/comments?post=3014"}],"version-history":[{"count":1,"href":"https:\/\/sawaryn.com\/us\/wp-json\/wp\/v2\/posts\/3014\/revisions"}],"predecessor-version":[{"id":3015,"href":"https:\/\/sawaryn.com\/us\/wp-json\/wp\/v2\/posts\/3014\/revisions\/3015"}],"wp:attachment":[{"href":"https:\/\/sawaryn.com\/us\/wp-json\/wp\/v2\/media?parent=3014"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sawaryn.com\/us\/wp-json\/wp\/v2\/categories?post=3014"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sawaryn.com\/us\/wp-json\/wp\/v2\/tags?post=3014"},{"taxonomy":"specialization","embeddable":true,"href":"https:\/\/sawaryn.com\/us\/wp-json\/wp\/v2\/specialization?post=3014"},{"taxonomy":"practice_area","embeddable":true,"href":"https:\/\/sawaryn.com\/us\/wp-json\/wp\/v2\/practice_area?post=3014"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}