The entry into force of the whistleblower rules - the Act of 14 June 2024 on the protection of whistleblowers (Journal of Laws, Dz.U. 2024 item 928), in force since 25 September 2024 (the provisions on external reports since 25 December 2024) - brought significant changes for many Polish businesses. Certain entities have a legal obligation to implement an internal reporting procedure, while others may decide to introduce one voluntarily. The process requires consultations with workers' representatives, which is a key element of the whole procedure. We can take over day-to-day employee matters, such as contracts, personnel files and payroll — see our HR and payroll services.
An internal reporting procedure is a comprehensive system that allows employees and other workers to report breaches of the law in a safe and orderly way. Implementing it properly requires not only knowledge of the law but also the ability to run consultations with workers and to provide appropriate mechanisms for protecting whistleblowers.
An internal reporting procedure must be implemented by entities for which, as at 1 January or 1 July of a given year, at least 50 people perform paid work. This number includes employees counted in full-time equivalents and people working for pay on a basis other than an employment relationship, provided they do not employ other people for that work (Article 23(1)-(2) of the Act). The threshold does not apply to entities in financial services, anti-money laundering, transport safety and environmental protection (Article 23(3))
Obligation to implement an internal reporting procedure
The Whistleblower Protection Act sets out precisely which entities must implement an internal reporting procedure. The decisive criterion is the number of people performing paid work, which must be at least 50 people (employees are counted in full-time equivalents). Headcount is assessed as at 1 January or 1 July of a given year. This is a different kind of criterion from registration duties such as notifying a temporary warehouse on the NIP-8 form.
When calculating the headcount threshold, it is important to include people working for pay regardless of the legal basis of the cooperation. This means that the count includes not only employees under an employment contract but also people working under civil-law contracts, B2B contracts or other legal forms - provided they do not employ other people for that work.
Smaller entities with fewer than 50 people may implement an internal reporting procedure voluntarily. Such a decision can bring benefits in the form of better legal risk management and an organisational culture based on transparency
The internal reporting procedure should set out how breaches of the law are reported and how follow-up action is taken. It is a strategic document that must be drawn up in compliance with all legal requirements and after appropriate consultations with workers.
Consultations on the internal reporting procedure
Consultation is a mandatory element of implementing an internal reporting procedure. Consultations must be held with the company trade union organisation or with representatives of the people working for the legal entity, chosen in the manner adopted by that entity.
If more than one company trade union organisation operates in the legal entity, consultations must be held with all of them. Where there is no company trade union organisation, consultations are held with representatives of the people working there, chosen in the manner adopted by the entity.
Consultations on implementing an internal reporting procedure last no less than 5 days and no more than 10 days from the day the legal entity presents the draft procedure (Article 24(4) of the Act). The Act does not provide that comments made by workers' representatives are binding on the entity setting the procedure
The time frame for consultations is set precisely in the law. A minimum of 5 days and a maximum of 10 days is the period in which the workers' side can read the draft procedure, analyse its provisions and submit comments or proposed changes. Although the Act does not make these comments binding, considering them can help produce a better solution.
Company trade union organisation - definition and tasks
The rights of a company trade union organisation belong to an organisation with at least 10 members who are employees of the employer covered by the organisation or people other than employees who perform paid work (Article 25¹ of the Trade Unions Act, consolidated text Dz.U. 2026 item 549). Members who are not employees must have worked for the employer covered by the organisation for at least 6 months.
The scope of activity of a company trade union organisation is broad and covers many aspects of working life. The organisation takes a position in individual employee matters governed by labour law and in individual matters of people performing paid work, to the extent related to that work.
The key tasks of a company trade union organisation also include:
- Taking a position towards the employer or the staff self-government body on matters concerning the collective interests and rights of people performing paid work
- Supervising compliance with labour law in the workplace, in particular occupational health and safety rules and principles
- Directing the work of the social labour inspection and cooperating with the PIP (National Labour Inspectorate)
- Dealing with the living conditions of retirees and pensioners
The company trade union organisation represents the workers in the consultations on the internal reporting procedure. Its participation ensures that the workers' perspective is taken into account when this important organisational document is drawn up
Choosing workers' representatives
Where there are no trade unions in the company, workers' representatives need to be chosen to take part in the consultations on the internal reporting procedure. If workers' representatives already exist, they can take part in the consultations, provided their mandate covers all people working in the entity.
A special situation arises where the company has a standing representation of employees under employment contracts but also has people working on other bases. The Act requires consultations with representatives of the people working for the entity (Article 24(3)(2)), not only of employees, so in such a case it is safer to choose new representatives who will represent all workers, regardless of the legal basis of their work.
Representatives of the people working in the entity are not only representatives of employees under employment contracts. Their selection must not be influenced only by people in an employment relationship, but by all people working in the entity
New elections can be skipped above all where the people working on other bases agree to be represented by the previously chosen representatives of employees under employment contracts. Such consent should be given clearly and documented.
Representatives for the consultations on the internal reporting procedure can be chosen in various ways, including traditional or electronic voting. It is important that the selection procedure is transparent and allows all eligible people to take part.
Practical examples of choosing representatives
The first situation concerns an entity in which all workers are employed under employment contracts and there is a standing employee representation chosen under labour law. In such a case, there is nothing to prevent the previously chosen standing employee representatives from taking part in the consultations on the internal reporting procedure. The workforce can be more varied, for example in firms employing foreigners — this is where the rules on seasonal work of foreigners in Poland come in.
If all workers in the entity are employed only under employment contracts and there is a standing employee representation, it can represent the staff in the consultations on the internal reporting procedure without new elections
The second situation is more complex and concerns an entity in which people work on different legal bases - employment contracts, contracts of mandate (umowa zlecenia) and B2B contracts. The company has a standing representation of employees under employment contracts. In this case, the representatives could represent everyone working in the entity, but only if the people working on a basis other than an employment contract agree to such representation.
Without such consent, it is safer to choose a new representation specifically for the consultations on the internal reporting procedure. The new representation should take into account all forms of work in the entity and represent the interests of all groups of workers.
Content of the internal reporting procedure
The Whistleblower Protection Act does not specify in detail how the consultations on the internal reporting procedure should be conducted. The legal entity decides on the form of the consultations together with the workers' side, i.e. the workers' representatives. This flexibility allows the process to be adapted to the specific features of the organisation.
The internal reporting procedure enters into force 7 days after the day it is communicated to the people working in the entity in the manner adopted by that entity (Article 24(5)). This waiting period is intended to give everyone concerned time to become familiar with the new procedure.
The internal reporting procedure must contain a number of mandatory elements set out in the law. The first is an indication of the internal organisational unit or person within the legal entity's structure, or the external entity, authorised by the legal entity to receive internal reports.
The procedure must set out how the whistleblower submits internal reports, together with the whistleblower's correspondence or email address. It is also important to indicate an impartial organisational unit or person authorised to take follow-up action
Further required elements of the procedure include:
- The procedure for handling information about breaches of the law reported anonymously
- The obligation to confirm to the whistleblower receipt of an internal report within 7 days of receiving it
- The obligation to take follow-up action with due diligence
- The maximum deadline for giving the whistleblower feedback, not exceeding 3 months from confirming receipt of the report
- Information on making external reports to the Commissioner for Human Rights (Rzecznik Praw Obywatelskich) or public authorities (Article 25(1))
Additional provisions in the procedure
Beyond the mandatory elements, the internal reporting procedure can be extended with additional provisions tailored to the specific features of the entity. These optional elements can significantly increase the effectiveness of the whistleblower protection system and legal risk management in the organisation.
One possible extension is to indicate internal breaches, if the legal entity has provided for the possibility of reporting such breaches. This allows the system to cover not only breaches of generally applicable law but also the organisation's internal rules.
The procedure can be extended to indicate risk factors that match the legal entity's business profile. Risks related to breaches of regulatory obligations or to corruption are particularly important
Other possible extensions of the procedure include:
- An indication that information about a breach of the law can in every case also be reported to the Commissioner for Human Rights or a public authority, bypassing the internal reporting procedure
- A system of incentives to use the internal reporting procedure where the breach can be effectively remedied within the legal entity's organisational structure
- Additional safeguards protecting the whistleblower from retaliation
- Detailed procedures for verifying reports and conducting internal investigations
Register of internal reports
Implementing an internal reporting procedure comes with the obligation to keep a register of internal reports. The entity that has implemented the procedure automatically becomes the controller of the personal data collected in this register, which means it must comply with data protection rules.
The register of internal reports must contain strictly defined categories of data. The first element is the report number, which allows each case to be identified unambiguously. Another mandatory element is the subject of the breach of the law, which should be described in a way that makes the essence of the problem clear.
| Register item | Description of content | Purpose of collection | Legal notes |
|---|---|---|---|
| Report number | Unique case identifier | Organisation of documentation | Makes it easier to track cases |
| Subject of the breach | Description of the legal problem | Classification of breaches | Basis for follow-up action |
| Whistleblower's details | Information identifying the reporting person | Contact and verification | Special protection of confidentiality |
| Date of report | When the report was received | Monitoring deadlines | Basis for calculating deadlines |
Personal data of the whistleblower and of the person concerned by the report may be collected only to the extent necessary to identify them. The register must also contain the whistleblower's contact address and the date of the report
The register must also contain information on the follow-up action taken and the date the case was closed. These elements are key to monitoring the effectiveness of the system and ensuring that the obligations under the internal reporting procedure are properly met.
The personal data and other information in the register are kept for 3 years after the end of the calendar year in which the follow-up action was completed, or after the end of proceedings initiated by that action. This retention period makes it possible to verify the action taken under the procedure if needed.
Protection of confidentiality and data security
The internal reporting procedure and the related processing of personal data must prevent unauthorised people from accessing the information covered by the report. It is particularly important to protect the confidentiality of the identity of the whistleblower, the person concerned by the report and any third party named in the report.
To ensure an appropriate level of security, only people holding a written authorisation issued by the entity may receive or verify internal reports, take follow-up action and process personal data. This restriction of access is fundamental to protecting the interests of all parties involved.
The security of the internal reporting system requires appropriate technical and organisational safeguards. Particular attention should be paid to protecting the whistleblower's identity from disclosure to unauthorised people
The system must be designed to minimise the risk of accidental or deliberate breaches of confidentiality. The Act does not specify particular tools, but in practice technical solutions are used for this purpose, such as data encryption, access control, monitoring of user activity and periodic reviews of safeguards.
Ways of making reports
Under the internal reporting procedure, a whistleblower can make a report in various forms suited to their needs and circumstances. The basic division is into oral and written reports, and each of these forms can be made using various means of communication.
An oral report can be made by telephone or by electronic means of communication. Where a recorded telephone line or other recorded voice communication system is used, the report is documented, with the whistleblower's consent, as a recording of the conversation or a complete and accurate transcript of it. For an unrecorded line, minutes of the conversation are prepared (Article 26(3)-(4)). Phones used by staff for work also raise tax questions — these are covered in our article on tax rules for using a private phone at work.
A whistleblower working for a logistics company noticed systematic breaches of safety rules when dangerous goods were being loaded. He decided to make an oral report at a face-to-face meeting with the person authorised to receive reports. The meeting was arranged within 10 days of his request, and its course was documented in minutes, which the whistleblower could check and approve with his signature.
An oral report can also be made at a face-to-face meeting arranged within 14 days of receiving the whistleblower's request for this form. With the whistleblower's consent, such a meeting is documented as a recording of the conversation or minutes of the meeting reproducing exactly how it went.
The minutes of the meeting must reproduce exactly how the conversation went, and the whistleblower has the right to check, correct and approve them by signing. This form of documentation makes the report highly reliable while respecting the whistleblower's rights
A written report can be made on paper or electronically. The electronic form is becoming more popular because it is easy to send and allows additional safeguards, such as encryption or delivery confirmations.
