Whistleblower law in Poland #
Poland implemented Directive (EU) 2019/1937 through the Act of 14 June 2024 on the Protection of Whistleblowers (Journal of Laws 2024, item 928). Internal reporting duties have applied since 25 September 2024. A procedure is required when at least 50 persons perform gainful work for an entity, not only 50 standard employees.
The act at a glance #
| Question | Answer |
|---|---|
| In force since? | Internal procedures from 25 September 2024; external reports to the Ombudsman from 25 December 2024 (art. 64). |
| Who needs a procedure? | A legal entity for which at least 50 persons perform gainful work, counted on 1 January or 1 July (art. 23(1)). Some sectors at any size (art. 23(3)). |
| How is it adopted? | After 5–10 days of consultation with trade unions or worker representatives (art. 24(3)–(4)). |
| Which channels? | At least oral or written reports; on request, a meeting within 14 days (art. 26). |
| Deadlines? | Acknowledgement within 7 days, feedback within 3 months (art. 25(1)). |
| Anonymous reports? | The entity may accept them; the procedure must say how they are handled (art. 7(1), art. 25(1) point 4). |
| How long to keep data? | 3 years after the end of the calendar year in which follow-up, or the proceedings it started, ended (art. 29(5)). |
| Penalty for no procedure? | A fine for the person responsible for setting it up, imposed by a court (arts. 58–59). |
Applicable law #
- Act of 14 June 2024 on the Protection of Whistleblowers — official text PDF
- Ombudsman information for external reports
Who must establish an internal channel #
Internal reporting procedures are mandatory for legal entities for which gainful work is performed by at least 50 persons. The count is taken on 1 January or 1 July of each year (art. 23(1)).
The count includes employees as full-time equivalents, plus people paid for work on another basis, such as civil-law contracts, if they do not employ others for that work (art. 23(2)).
Entities in the financial-services and anti-money-laundering, transport-safety, and environmental sectors are in scope regardless of headcount (art. 23(3)). The chapter does not apply to municipal and county units with fewer than 10,000 inhabitants (art. 23(5)). Smaller entities may adopt a procedure voluntarily (art. 24(2)).
What can be reported #
A breach of law is an act or omission that is unlawful, or aims to get around the law, in one of 17 areas listed in art. 3(1), among them:
- corruption and public procurement;
- financial services, products and markets, and anti-money laundering;
- product, transport, food and feed safety;
- environmental protection, public health, consumer protection;
- privacy and personal data, and the security of networks and IT systems;
- the financial interests of the State Treasury, local government and the EU, and the EU internal market;
- constitutional freedoms and rights in dealings with public authorities.
An entity may also allow reports about breaches of its internal rules or ethical standards (art. 3(2)). For such reports, the rules on external reporting and public disclosure (chapters 4 and 5) do not apply.
Exclusions (art. 5). The act does not apply to, among others, classified information, the professional secrecy of medical and legal professions, the secrecy of judicial deliberations, and the secrecy of pre-trial criminal proceedings.
Who is protected #
A whistleblower is a natural person who reports or publicly discloses information about a breach of law obtained in a work-related context (art. 4). The act lists, among others, employees, temporary workers, civil-law contractors, entrepreneurs, commercial proxies, shareholders and partners, board members, interns, volunteers, and people working for contractors and suppliers. Protection also covers job applicants and people whose work relationship has ended (art. 4(2)).
A whistleblower is protected from the moment of the report if they had reasonable grounds to believe that the information was true and concerned a breach of law (art. 6).
| Protection | Provision |
|---|---|
| Retaliation is prohibited, including attempts and threats | art. 11 |
| Burden of proof on the employer: the employer must show that its action was not retaliation | art. 12(3) |
| Compensation of at least the average monthly wage in the national economy in the previous year, or damages for harm suffered | art. 14 |
| No liability, including disciplinary, for a report if the whistleblower had reasonable grounds to believe it was necessary to reveal the breach; no liability for obtaining the information unless that was itself an offence | art. 16 |
| Protection for people who assist the whistleblower or are connected to them | art. 21 |
What the internal procedure must contain #
The procedure is adopted after consultation with the workplace trade union or, if there is none, with representatives of the people who work for the entity. Consultation lasts 5 to 10 days from presentation of the draft (art. 24(3)–(4)). The procedure takes effect 7 days after it is announced to the workforce (art. 24(5)). Job applicants receive information about it when recruitment starts (art. 24(6)).
Under art. 25(1), the procedure specifies:
- who receives reports: an internal unit, a person, or an external provider;
- how reports can be made, and the contact address;
- an impartial unit or person who takes follow-up action and communicates with the whistleblower;
- how anonymous reports are handled;
- the duty to acknowledge receipt and the deadline for feedback;
- information on external reporting to the Ombudsman and public authorities.
Channels (art. 26). The procedure must allow at least oral or written reports. Oral reports may be made by telephone or by electronic means. At the whistleblower’s request, an oral report is taken at an in-person meeting within 14 days. A recording or transcript requires the whistleblower’s consent, and the whistleblower can check and sign the record.
Confidentiality and access (art. 27). The procedure must protect the identity of the whistleblower, the person concerned and third parties. Only people with written authorisation may handle reports, and they must keep them confidential even after their work ends.
External provider (art. 28). Handling reports may be outsourced by contract. Responsibility for confidentiality, feedback and follow-up stays with the legal entity (art. 28(4)).
Deadlines #
| Step | Deadline |
|---|---|
| Consultation on the draft procedure | 5 to 10 days (art. 24(4)) |
| Procedure takes effect | 7 days after it is announced (art. 24(5)) |
| Acknowledge receipt of a report | within 7 days of receipt (art. 25(1) point 5) |
| Meeting at the whistleblower’s request | within 14 days of the request (art. 26(6)) |
| Feedback | within 3 months of the acknowledgement; without one, 3 months from the end of 7 days after the report (art. 25(1) point 7) |
The duty to acknowledge and give feedback does not apply if the whistleblower gave no contact address.
Anonymous reports #
Legal entities, the Ombudsman and public authorities may accept anonymous reports (art. 7(1)). This is a choice, not a duty, but the internal procedure must state how such reports are handled (art. 25(1) point 4). If an anonymous whistleblower is later identified and suffers retaliation, they are protected, provided the conditions of art. 6 are met (art. 7(2)). See also anonymous and confidential reporting.
Register and retention #
The legal entity keeps a register of internal reports and is the controller of the data in it (art. 29). The register records the report number, the subject of the breach, the personal data of the whistleblower and the person concerned, the contact address, the date of the report, the follow-up taken, and the date the case closed.
Data is kept for 3 years after the end of the calendar year in which follow-up, or the proceedings it started, ended (art. 29(5)).
Shared procedure #
Private entities with 50 to 249 people working for them may agree by contract on shared rules for receiving and checking reports and for investigations (art. 28(3)). Each stays a separate data controller with no access to the other’s data (art. 28(6)). Local governments may adopt a joint procedure within a shared-services arrangement (art. 28(5)).
Penalties and enforcement #
Poland does not use administrative fines. Chapter 6 of the Act creates criminal offences, and the penalties listed for each are alternatives: a court imposes one of them, not all of them.
| Conduct | Penalty |
|---|---|
| Preventing or substantially hindering a report (art. 54(1)) | fine, restriction of liberty, or up to 1 year’s imprisonment |
| — using violence, unlawful threat or deception (art. 54(2)) | up to 3 years’ imprisonment |
| Retaliation against a whistleblower, a person assisting, or a related person (art. 55(1)) | fine, restriction of liberty, or up to 2 years; if persistent, up to 3 years |
| Disclosing the identity of a whistleblower, assisting or related person (art. 56) | fine, restriction of liberty, or up to 1 year |
| Reporting or publicly disclosing while knowing no breach occurred (art. 57) | fine, restriction of liberty, or up to 2 years |
| No internal reporting procedure, or one established in significant breach of the Act’s requirements (art. 58) | a fine, imposed under the Code of Procedure in Petty Offence Cases (art. 59) |
Having no internal procedure is therefore a petty offence tried by a court, not an administrative breach penalised by a supervisory body. The fine targets the person responsible for setting up the procedure, not the entity itself. The Act names no amount, so the general rule of the Petty Offences Code applies: a fine of PLN 20 to PLN 5,000 (art. 24 § 1). The Rzecznik Praw Obywatelskich receives external reports but imposes none of these penalties.
An honest assessment of enforcement. Because every penalty runs through the courts and no supervisory authority imposes them, there is no central tally of fines for a missing procedure. The weightier exposure is criminal and personal: obstruction, retaliation and disclosure of a reporter’s identity can lead to imprisonment for the people responsible, and the Ombudsman’s first annual report (below) documented cases in which a confidential reporter’s identity was disclosed.
External reporting authority #
The Rzecznik Praw Obywatelskich (Ombudsman) receives external reports, checks them, and forwards them to the competent public authority within 14 days at the latest (art. 32(2)). A whistleblower may report to the Ombudsman without reporting internally first (art. 30(1)). External reporting started on 25 December 2024.
Data protection authority #
For GDPR complaints about how whistleblowing data is processed, the relevant authority is the Urząd Ochrony Danych Osobowych (UODO).
Setting up in seven steps #
- Check the duty: at least 50 persons performing gainful work on 1 January or 1 July; some sectors at any size.
- Appoint people or a provider: who receives reports, and who takes impartial follow-up action. Issue written authorisations.
- Draft the procedure with every element of art. 25, including the decision on anonymous reports.
- Consult the trade union or worker representatives (5–10 days).
- Announce the procedure in the usual way; it takes effect after 7 days. Inform job applicants about it.
- Open the channels: oral or written, a meeting on request within 14 days, access only for authorised people.
- Keep the register and meet the deadlines: acknowledgement within 7 days, feedback within 3 months, retention for 3 years.
The first year in practice #
In its first annual report — published on 10 February 2026 by the Ombudsman’s Whistleblowers Team — the Rzecznik Praw Obywatelskich set out how the external channel was used between 27 December 2024 and 31 December 2025:
- 690 submissions were received, of which 223 were accepted as qualifying external reports.
- 175 submissions were anonymous; of these, 72 were accepted and 54 were forwarded to the competent authority.
- The Ombudsman documented cases in which a confidential reporter’s identity was disclosed to the people they had reported, underlining how much depends on disciplined handling of confidentiality once a report is received.
Official sources #
- Act of 14 June 2024 on the Protection of Whistleblowers — official text PDF
- Petty Offences Code — consolidated text (Journal of Laws 2026, item 1372)
- Ombudsman — whistleblowers page
- Ombudsman — act enters into force notice
- UODO — whistleblowing and data protection
Frequently asked questions #
Who must comply with Poland’s whistleblower act? #
A legal entity for which at least 50 persons perform gainful work, counted on 1 January or 1 July, must adopt an internal reporting procedure. Entities in financial services, anti-money laundering, transport safety and environmental protection must do so regardless of headcount.
When did the Polish whistleblower act take effect? #
On 25 September 2024, when internal reporting procedures became mandatory. External reports to the Ombudsman have been accepted since 25 December 2024.
How is the 50-person threshold counted? #
Employees are counted as full-time equivalents. People paid for work on another basis, such as a civil-law contract, are added if they do not employ others for that work. The count is taken on 1 January or 1 July (art. 23).
Must the procedure be consulted with trade unions? #
Yes. The procedure is adopted after consultation with the workplace trade union or, if there is none, with worker representatives. Consultation lasts 5 to 10 days (art. 24).
Must anonymous reports be accepted? #
No. An entity may accept anonymous reports but does not have to. Its procedure must, however, state how such reports are handled (art. 7(1), art. 25(1) point 4).
What deadlines apply after a report? #
Acknowledgement within 7 days and feedback within 3 months of the acknowledgement. At the whistleblower’s request, a meeting takes place within 14 days.
What is the penalty for having no internal procedure? #
A fine for the person responsible for setting up the procedure, imposed by a court under petty-offence rules (arts. 58–59). The Act names no amount, so the general range of the Petty Offences Code applies: PLN 20 to PLN 5,000.
How long must report data be kept? #
For 3 years after the end of the calendar year in which follow-up, or the proceedings it started, ended (art. 29(5)).