Support Centre

You have out of 5 free articles left for the month

Signup for a trial to access unlimited content.

Start Trial

Continue reading on DataGuidance with:

Free Member

Limited Articles

Create an account to continue accessing select articles, resources, and guidance notes.

Free Trial

Unlimited Access

Start your free trial to access unlimited articles, resources, guidance notes, and workspaces.

Poland: An overview of the updated draft whistleblowing bill

On 12 April 2022, the Polish Government published its updated draft whistleblowing bill.1 The updated draft bill embodies nearly 1,000 comments and proposals submitted during public consultation. A number of systemic and organisational changes were made to the original draft bill, published in October 2021.

Poland, like other EU Member States, had until 17 December 2021 to implement Directive on the Protection of Persons who Report Breaches of Union Law (Directive (EU) 2019/1937) ('the Whistleblowing Directive'). However, the Polish legislative mills have been grinding slowly.

The updated draft bill regulates reporting violations, both internally (i.e. within organisations) and externally (i.e. to outside authorities), and sets out the ways and means of reporter protection. Magdalena Gad-Nowak, Attorney-at-law at Timelex, outlines the key changes to the updated draft bill.

watchara_tongnoi / Essentials collection /

Whistleblowing legislation applies to more entities

The updated draft bill lists significantly more entities, which would be affected by it, and, consequently, obliged to put in place an internal procedure for receiving and following up on violation reports. In the original draft bill, only employers of 50 plus staff were obliged to establish and implement the internal reporting procedure. In this regard, entities employing fewer than 50 staff could, but were not obliged to, adopt an internal procedure.

The updated draft bill extends this obligation to entities for which at least 50 persons 'perform work’. Though the updated draft does not expressly define the 'person performing work for the benefit of a legal entity' - leaving it up to the market to interpret, and rendering it problematic to determine whether a given participant must apply the new law - the framers of the new law appear to have meant for the notion to include, aside employees, civil law contractors (but also sole traders, trainees, volunteers, and persons working under the supervision and management of a contractor, subcontractor, or supplier).

As in the original draft bill, the headcount threshold does not apply to entities operating in financial services, products, and markets, and in preventing money laundering and terrorist financing, transportation safety, and environmental protection. The updated draft bill will apply to them regardless of their staff complement.

Broader circle of reporters

One of the key changes to the updated draft bill is that the group of persons who can actually report a violation, and are thus entitled to protection, has been expanded.

Under the original draft bill, whistleblowers included, without limitation, employees and former employees, candidates, contractors or sole traders, entrepreneurs, corporate officers, volunteers, and persons working under the supervision and management of a contractor, subcontractor, or supplier. The updated draft bill also specifically includes temporary employees and trainees/apprentices, but also police officers, the Internal Security Agency, the Foreign Intelligence Agency, the Military Intelligence Service, the Central Anti-Corruption Bureau, the Border Guard, the Marshal's Guard, the State Protection Service, the State Fire Department, as well as the Customs and Penitentiary Service.

In the updated draft bill, any natural person who becomes aware of a violation in the workplace may report it, which is also applicable if they have learned of such violation before or after their employment.

This is closely tied to the novel requirement that the entity must inform a candidate of its internal procedure (i.e. either early in the recruitment process or during the pre-contract negotiations). Previously, the employer was only obliged to acquaint the employee with the internal reporting regulations upon completing the recruitment, but before admitting the employee to work.

Therefore, in order to safeguard their interests, legal entities should require applicants to submit a declaration, or otherwise acknowledge that they have reviewed the internal procedure applicable to the hiring entity.

Not only whistleblowers under protection

As per the updated draft bill, any retaliatory action, not only against the reporter themselves, but also against those assisting in reporting, or against the whistleblower's circle, will be prohibited. The updated draft bill also extends this protection to witnesses.

Entrepreneurs under new obligations

The most important obligation imposed by the updated draft bill on organisations is to establish an internal procedure for reporting violations and following up on those reports.

In particular, the internal procedure should be first consulted with the entity's trade union organisation(s). If the legal entity does not have a trade union organisation, an internal procedure should be established after consultation with the staff (not merely employee) representatives. The consultation deadlines have been precisely defined, indicating that they should last between seven and 14 days from the entity's submission of the proposed internal procedure for consultations. The internal procedure becomes effective at least two weeks after being communicated to the staff.

Taking into account the requirement to consult staff representatives and the two-week grace period, the largest companies should, in practice, start working on the internal procedure shortly after the bill's promulgation.

Internal procedures requirements

There have been rather few changes as to the minimum required contents of the internal notification procedure. As in the previous iteration, the procedure should in particular specify:

  • the internal organisational unit responsible for accepting the reports;
  • the methods for submitting the reports;
  • the obligation to acknowledge to the reporter receipt of the report within seven days following submitting it;
  • the obligation to follow up on the report; and
  • the obligation to provide the reporter with feedback (no later than three months after acknowledging receipt of the report or - if there was no such an acknowledgement - within three months following the seven-day period after submitting the report, unless the reporter did not provide their contact details).

As a novelty, the internal procedure may now provide for a system of incentives encouraging internal reporting. In fact, previously, the entity could indicate the types of irregularities and/or violations that were encouraged to be reported in the first place.

Unlike in the previous version, the internal procedure no longer has to contain information on:

  • whether anonymous reports are accepted (these will now - as a general rule - be unprocessed); and
  • the follow-up actions to verify information about the violations or measures that may be applied in case of a violation.

Given critical perceptions of whistleblowers in society, and considering that there may be ulterior motives behind reporting, the introduction of gratification incentives for making an internal report, may actually do more harm than good. In particular, entities that decide to introduce such incentives (especially financial ones) can expect an influx of reports of dubious quality based on unverified data and unfounded allegations. Entities should make it abundantly clear in their internal procedure documentation that, legally, a person who knowingly provides false information may face criminal liability (up to, and including, imprisonment) and damages.

Methods of submitting the reports

The updated draft bill does away with the obligation to observe the classic written form (i.e. with a handwritten signature). Applications can, in fact, now be made not only verbally and in writing, but also electronically.

In addition, the updated draft bill details how verbal notifications should be documented so that verbal reports:

  • made via a recorded telephone line or other recorded voice communication system, will - upon the reporter's consent - be documented as a recording or a transcript;
  • made via a non-recorded telephone line or other non-recorded voice communication system will be documented as a detailed account of the conversation; and
  • made during a face-to-face meeting, conducted at the reporter's request, must be documented as a recording of the conversation or its accurate account, upon the reporter's consent.

The whistleblower will have the right to check, correct, and approve the transcript or the account of the conversation by signing it.

It is questionable, however, why verbal notifications made during face-to-face meetings could be documented upon the whistleblower’s consent (unlike in the case of non-recorded telephone line reports where such consent is not required, by the mere nature of the communication channel).

Anonymous reports

The updated draft bill prohibits anonymous notifications (previously, it was ultimately up to the employer who could offer such possibility in the internal regulations). According to the explanatory memorandum to the updated draft bill, 'anonymous notifications will not be subject to the rigours of the Act, which means that they may be unprocessed'. This means that in order for a report to be considered, the reporter will have to disclose their identity and contact address, as anonymous reports will not be processed (unless the employer decides otherwise, in which case such reports will not be subject to whistleblowing legislation, and the reporters will not be protected thereunder).

More retaliatory measures

The updated draft bill features an extended list of retaliatory measures, adding to it mobbing, discrimination, unfavourable, or unjust treatment, causing financial loss (including economic loss or loss of income) or inflicting other non-material damage, including damage to reputation, in particular on social media. Moreover, even threatened or attempted use of any of those measures against a whistleblower will be deemed retaliatory adverse treatment and, as such, penalised.

However, only good-faith whistleblowers will be protected, i.e. if they actually had reasonable grounds to believe that the information about a violation was true at the time of reporting, and that the information indeed relates to a violation.

Damages for knowingly false accusation

The minimum compensation that may be claimed by a person who suffered damage due to a whistleblower knowingly reporting or publicly disclosing untrue information has been now increased, and equals at least the average remuneration in the enterprise sector on the day of the report (or public disclosure). Previously, it was no less than the minimum remuneration for work.

Shorter data retention periods

As per the updated draft bill, the entity concerned will retain personal data processed in connection with a whistleblower report for 15 months after completion of follow-up actions on that report (previously, it was five years from the acceptance of the notification).

Personal data in the register of internal reports will also be retained only for 12 months after conclusion of the follow-up actions, and not for five years after the acceptance of the report, as originally envisaged.

Interestingly, the updated draft bill no longer obliges to apply technical and organisational measures, which would ensure that the whistleblower's personal data is stored separately from the document, or any other information carrier related to the whistleblowing report.


The updated draft bill does not set out administrative sanctions, but merely criminal penalties (including imprisonment). These may be imposed on persons who do not establish an internal reporting procedure, obstruct a report, retaliate, or breach the confidentiality obligation, as well as on those who knowingly submit a report based on false information (or those who aid in submitting such a report).

The revision scraps the highly criticised imprisonment, as a sanction for failure to implement an internal procedure. Currently, no procedure, or a procedure that falls short of the minimum requirements set out in the updated draft bill, will only be fined, although no specific range has been set. This means that the entity may be fined up to PLN 1,080,000 (approx. €232,160), as provided for in the applicable criminal laws.

Longer grace period for compliance

The draft extends the vacatio legis from 14 days to two months.

Entities with 250 or more employees, as well as entities operating in financial services, products, and markets, and in sectors relating to the prevention of money laundering and terrorist financing, transport safety, and environmental protection, will be required to establish an internal procedure within one month of the bill's effective date, giving them, in practice, a total of three months to comply.

Private entities employing between 50 and 249 people will be expected to establish an internal procedure for receiving reports and following up on those until 17 December 2023.

Entities should note, however, that whistleblowers will enjoy protection as of the very first day the bill comes into force, and not from the effective date of the internal procedure.


Whether the proposed changes will meet the stakeholders' expectations is yet to be seen. However, the proposed regulations may still change to an even greater extent, as the updated draft bill has not yet been submitted to the Parliament. It is also unclear when the legislative process will come to an end, and when the bill will be promulgated.

Nevertheless, entities who have not yet implemented internal whistleblowing procedures should already start analysing their potential and possibilities in this regard. Those who have already done so, will certainly have less work to do as they will only need to slightly tweak their policies.

Magdalena Gad-Nowak Attorney-at-law
[email protected]
Timelex, Warsaw

1. Available to download at: (only available in Polish); see progress of the bill at: (only available in Polish)