This article answers the following questions:

• Who is a whistleblower?
• Which entities are obliged to incorporate the provisions of the Whistleblower Protection Act?
• What can whistleblowers report?
• What obligations are imposed on employers as a result of the Whistleblower Protection Act entering into force?
• From what point is a whistleblower under protection and what does the protection provide?
• What are the penalties for retaliation against a whistleblower?
• What are the penalties for failure to fulfil the obligation of establishing an internal reporting procedure or establishing it in breach of legal regulations? 

The Whistleblower Protection Act of 14 June 2024 (Journal of Laws item 928) (hereinafter referred to as "the Whistleblower Protection Act" or "the Act") takes effect as of 25 September 2025. It lays down completely new comprehensive regulations which adequately standardise in Polish law legal protection for persons who decide to report irregularities in institutions and business organisations. However, the implementation of the new provisions poses a great challenge for Polish companies, especially taking into consideration a relatively short period of time left for employers to take relevant actions and establish proper procedures. What should employers and HR departments focus on to avoid penalties? Read our advice below! 

Who is a whistleblower?

A whistleblower is an individual who reports or publicly discloses information on illegal activities in an employment context. The list of such persons includes:

• employees;
• temporary employees;
• persons working on a different basis than an employment contract, in particular under a civil-law contract;
• entrepreneurs;
• company authorised representatives;
• shareholders or partners;
• members of a governing body of a legal person or an unincorporated legal entity;
• persons performing work under the supervision and management of a contractor, subcontractor, or supplier;
• trainees;
• volunteers;
• interns;
• officials;
• soldiers.

Which entities are obliged to incorporate the provisions of the Whistleblower Protection Act?

A whistleblower protection scheme and an internal reporting procedure must be established and implemented by organisations which, as at 1 January or 1 July of a given year, have at least 50 salaried employees. 

The number of 50 salaried employees of an entity includes full-time equivalent staff or persons performing paid work on a different basis than an employment contract.

Importantly, the above threshold does not apply to legal entities operating within the areas of financial services, products, and markets as well as anti-money laundering and countering the financing of terrorism, transport safety, and environmental protection.

What kind of irregularities can be reported by whistleblowers?

The whistleblower protection system applies to persons reporting illegal activities concerning: 

• corruption;
• public procurement;
• financial services, products, and markets;
• anti-money laundering and countering the financing of terrorism;
• product safety and compliance;
• transport safety;
• environmental protection;
• radiological protection and nuclear safety;
• food and feed safety;
• animal health and welfare;
• public health;
• consumer protection;
• protection of privacy and personal data;
• security of networks and computerised systems;
• financial interests of the State Treasury of the Republic of Poland, local government units, and the European Union;
• internal market of the European Union, including public-law rules of competition and state aid, and taxation of legal persons;
• constitutional human and citizen rights and freedoms in relations between individuals and public authorities, and not connected with the areas listed in points 1-16 above. 

In addition, if the procedure which is in place in an organisation provides for such a possibility, a whistleblower may report information on illegal activities concerning the internal regulations or ethical standards applicable in the organisation which have been established under and are in compliance with the binding provisions of law.

What obligations are imposed on employers as a result of the Whistleblower Protection Act entering into force?

The employer is obliged to establish an internal procedure for reporting illegal activities and to undertake follow-up actions.

The internal reporting procedure must define: 

• an internal organisational unit or a person within the organisational structure of the legal entity, or a third party authorised to receive internal complaints;
• methods of submitting internal complaints by whistleblowers together with their correspondence address or e-mail address;
• an impartial internal organisational unit or a person within the organisational structure of the legal entity authorised to take follow-up actions, including verification of internal complaints and subsequent communication with whistleblowers, which also covers requests for additional information and providing whistleblowers with feedback (this function may be held by the internal organisational unit or the person referred to in point 1 above if impartiality is maintained);
• a procedure concerning anonymous reporting of illegal activities;
• the obligation to notify whistleblowers of receiving the internal complaint within 7 days from its receipt. This is not mandatory if the whistleblower has not provided the contact address to which the notification should be delivered;
• the obligation to take follow-up actions, maintaining due diligence, by the internal organisational unit or the person referred to in point 3 above;
• the final time limit for providing whistleblowers with feedback, not exceeding 3 months from the day of the receipt of the internal complaint, or, if the notification referred to in point 5 above is not sent, not exceeding 3 months from the expiry of the 7-day period from the date of submitting the internal complaint. This is not mandatory if the whistleblower has not provided the contact address to which the feedback should be sent;
• easy to understand and readily accessible information on submitting an internal complaint to the Commissioner for Human Rights or to public authorities and, where appropriate, to institutions, authorities, or organisational units of the European Union.

It should be remembered that the establishment of an internal reporting procedure must be preceded by consultations, lasting from 5 to 10 days, with the trade union, or, if there is no trade union in the organisation, with representatives of the employees of the legal entity appointed in accordance with the policy adopted by the given legal entity. 

The procedure takes effect after 7 days of its announcement to the employees, in the manner adopted by the given employer. 

Importantly, the employer has the duty to ensure the confidentiality of the whistleblower's identity. The employer must:

• establish an internal reporting procedure (also covering the processing of personal data in connection with reporting) in a manner preventing unauthorised access to reported information;
• protect the confidentiality of the identity of both the whistleblower and the reported person as well as of any third parties indicated in the complaint. The protection of confidentiality covers information on the basis of which the above-mentioned persons may be directly or indirectly identified;
• written authorisations for persons having the right to receive and verify internal complaints, take follow-up actions, and process personal data. These persons are obliged to maintain the confidentiality of information and personal data which they gained access to when receiving and verifying internal complaints and taking follow-up actions.  

In addition to establishing the procedure, the employer is obliged to keep an internal reporting register, with entries made on the basis of internal reporting. The said register must contain: 

• complaint number;
• description of the illegal activity;
• personal data of the whistleblower and of the reported person (necessary to identify these persons);
• whistleblower's contact address;
• date of submitting the complaint;
• information on follow-up actions;
• case completion date.

Personal data and other information must be kept in the internal reporting register for 3 years from the end of the calendar year in which the follow-up actions were completed or from the completion of proceedings initiated by such actions.

From what point is a whistleblower under protection and what does the protection provide?

A whistleblower is under protection from the moment of submitting a complaint, provided that: 

1. the complaint or disclosure pertains to information on illegal activities within the scope covered by the Whistleblower Protection Act or the internal procedure; 
2. the reporting person acted in the reasonable belief that the reported or publicly disclosed information was true at the moment of reporting or public disclosure and that it concerned illegal activities¹.

It is not allowed to retaliate against a whistleblower. 

Retaliation is a direct or indirect action or omission in an employment context which is a response to a complaint or public disclosure made by a whistleblower, and which violates (or may violate) the whistleblower's rights, or which causes or may cause wrongful damage to the whistleblower. This definition also covers unjustified initiation of proceedings against the whistleblower. 

What are the penalties for retaliation against a whistleblower?

A whistleblower retaliated against has the right to seek compensation for material damage (in an amount not lower than the average monthly salary) or compensation for non-material damage. 

If an employee performing work under an employment contract has retaliated against the whistleblower (in an employment context), the obligation to pay compensation is imposed on the employer (pursuant to Article 120 of the Labour Code²). If retaliatory actions have been taken by a person performing work under a civil-law contract, then damage resulting from the perpetrator's actions will be attributed to the ordering entity (pursuant to Article 430 of the Civil Code³).

The burden of proving that the actions were not retaliatory lies with the employer. 

What are the penalties for failure to fulfil the obligation of establishing an internal reporting procedure or establishing it in breach of legal regulations? 

An internal procedure is the primary document for bringing the concept of whistleblower protection into life. Failure to fulfil the obligation of establishing an internal reporting procedure (or establishing it in serious breach of the requirements arising from the statute) is a misdemeanour and is subject to a fine of PLN 20 to PLN 5000⁴.

The persons who will be held liable for the above are management board members in the case of companies, and partners in partnerships. 

Summary of the Whistleblower Protection Act – What are the most important duties of employers?

In order to avoid penal and civil liability as provided for in the statute, employers must perform the following activities by 25 September 2024:

• calculate the headcount in the organisation; 
• verify the existing procedures; 
• establish an internal reporting procedure; 
• prepare relevant authorisations;
• prepare a draft internal reporting register; 
• train the staff; 
• correctly process complaints (if received);
• store data. 

As you can see, the list of obligations related to the implementation of the provisions of the Whistleblower Protection Act is long and comprehensive. RSM Poland can provide you with complete support in this complicated process.

¹ D. Tokarczyk [in:] E. Rutkowska, D. Tokarczyk, Ustawa o ochronie sygnalistów. Komentarz, LEX/el. 2024, Article 6.
² D. Tokarczyk [in:] E. Rutkowska, D. Tokarczyk, Ustawa o ochronie sygnalistów. Komentarz, LEX/el. 2024, Article 14.
³ D. Tokarczyk [in:] E. Rutkowska, D. Tokarczyk, Ustawa o ochronie sygnalistów. Komentarz, LEX/el. 2024, Article 14.
⁴ D. Tokarczyk [in:] E. Rutkowska, D. Tokarczyk, Ustawa o ochronie sygnalistów. Komentarz, LEX/el. 2024, Article 58.