Whistleblower law in Poland #

Poland implemented Directive (EU) 2019/1937 through the Act of 14 June 2024 on the Protection of Whistleblowers. The Polish regime uses a broader 50-person threshold based on gainful work, not just standard employees.

Applicable law #

Who must establish an internal channel #

Internal reporting procedures are mandatory for legal entities for which gainful work is performed by at least 50 persons. This threshold is broader than a simple employee headcount. Internal obligations started on 25 September 2024.

External reporting authority #

The Rzecznik Praw Obywatelskich (Ombudsman) receives external reports and routes them to the competent public authority where required. External reporting started on 25 December 2024.

Data protection authority #

For GDPR complaints about how whistleblowing data is processed, the relevant authority is the Urząd Ochrony Danych Osobowych (UODO) .

Key compliance points #

Poland’s threshold counts persons performing gainful work, not only standard employees.
Local governments may organise joint internal procedures through shared-service arrangements.
The rollout is split: internal reporting from 25 September 2024, external reporting from 25 December 2024.
Anonymous reports are accepted, but under Article 7(3) anonymous reporters are excluded from procedural protections that identified reporters receive — acknowledgment of receipt, feedback on the outcome, and the certificate of whistleblower status.

The first year in practice #

In its first annual report — published on 10 February 2026 by the Ombudsman’s Whistleblowers Team — the Rzecznik Praw Obywatelskich set out how the external channel was used between 27 December 2024 and 31 December 2025:

690 submissions were received, of which 223 were accepted as qualifying external reports.
175 submissions were anonymous; of these, 72 were accepted and 54 were forwarded to the competent authority.
The Ombudsman documented cases in which a confidential reporter’s identity was disclosed to the people they had reported, underlining how much depends on disciplined handling of confidentiality once a report is received.

Official sources #

Deploy your reporting channel →

Last updated: April 24, 2026