Whistleblower Act – new obligations for businesses
9 July 2025 • Autor: Kancelaria Brysiewicz Bokina i Wspólnicy
For the last few years, we have seen an increasingly strong sealing of the VAT anti-fraud system. The sealing is so strong that it is sometimes starting to take the oxygen out of the mouths of honest but sometimes unaware entrepreneurs too. It gets not only the buyers, but even the drivers or shippers.
Key tenets of the new whistleblower protection: What do you need to know?
The new legislation is designed to provide protection for so-called whistleblowers, i.e. individuals who report information about a violation of the law in a work-related context.
In particular, notifications will be able to be made by employees, including temporary employees and persons providing work on a basis other than employment relationship, as well as entrepreneurs, proxies, shareholders, partners and members of the body of a legal person or organisational unit without legal personality.
What categories of violations are covered by whistleblower protection?
The most relevant categories of violations to be covered include corruption, public procurement, financial services, products and markets, anti-money laundering and countering the financing of terrorism, product safety and compliance, transport safety, environmental protection and public health.
Whistleblower reporting options
A person, upon becoming aware of a violation of the law within the scope of the Act, will be able to make:
(1) internal reporting, which consists in informing a legal entity of which the whistleblower is an employee or has other for-profit relations with;
(2) external reporting, which consists in directing the information to a public body or the Ombudsman;
(3) public disclosure, which consists in making the information about the violation of the law public by the whistleblower himself (the discloser).
The whistleblower can choose which option to use first.
It should be noted that it is not mandatory to make an internal notification before an external one, thus, the employer should be aware that the whistleblower may skip the internal channel and immediately submit a notification to the Ombudsman or a public body.
Who is affected by the obligations under the Whistleblower Protection Act?
The provisions of the Act, in terms of the obligation to establish internal whistleblowing channels, will apply to:
- public and private sector entities for which , as at 1 January or 1 July of a given year, there are at least 50 persons performing gainful employment;
- public and private sector entities performing activities in the fields of financial services, products and markets and anti-money laundering and terrorist financing, transport safety and environmental protection, regardless of the number of employees employed.
The threshold of 50 persons performing remunerated work for a legal entity, according to the Law, includes full-time employees, as well as persons performing remunerated work on a basis other than an employment relationship, if they do not employ other persons for such work.
Obligations of legal entities affected by the Law on protection of whistleblowers
| Obligation to establish an internal reporting procedure | 1. Draft intra-organisationallegal act A legal entity is obliged to establish an intra-organisational legal act enabling internal reporting and regulating internal channels and procedures for whistleblowers to make such reports and to take follow-up actions (the so-called “internal reporting procedure“). |
|
The draft law sets out the minimum content of the internal reporting procedure (Article 25(1) of the draft law on the protection of whistleblowers), as well as its optional elements (Article 25(2) of the draft law on the protection of whistleblowers). 2. Consultation The procedure shall be established after mandatory consultation with trade unions or employee representatives if there is no trade union organisation at the employer.The consultation shall last no less than 5 days and no more than 10 days from the date of presentation of the draft procedure. |
| (3) Notification and entry into force The Internal Notification Procedure shall enter into force 7 days after it has been made known to persons performing work in the manner adopted in the legal entity. | |
| Obligation to keep a register of internal notifications | The legal entity will be obliged to keep a register of internal notifications and will be the controller of the data collected in this register |
| . |
| The law also specifies the scope of data to be included in the register, which will be able to be kept for a period of 3 years after the end of the calendar year in which the follow-up actions have been completed or the proceedings initiated by these actions have been completed. |
| The register in question will also contain the personal data of the whistleblower and the person to whom the notification relates, as specified in the bill, necessary for the identification of those persons. | |||
| Obligation to maintain the confidentiality | of the whistleblower | ‘s data | The legal entity will be obliged to prevent unauthorised persons from gaining access to the information covered by the notification and to ensure that the confidentiality of the identity of the whistleblower, the person to whom the notification relates and the third party identified in the notification is protected |
| . |
| Only persons with written authorisation from the legal entity may be allowed to receive and verify internal reports, follow up and process personal data of persons. | |
| Obligation to ensure protection against retaliation | The legal entity may not retaliate or attempt or threaten to do so by, inter alia, terminating or terminating without notice the employment relationship, reducing the salary of the employee; withholding a promotion or omitting to promote. |
| In addition, the employer bears the burden of proof that the action taken is not retaliatory. | |
| Additional obligations during recruitment | The legal entity is required to inform the person applying to perform work under an employment or other legal relationship of the internal reporting procedure with the commencement of recruitment or pre-contract negotiations. |
What about employment law?
Can whistleblowers report violations in this area?
Despite the inclusion of labour law in the initial draft of the whistleblower law, in the published law, labour law was finally removed from the catalogue of legal violations that can be subject to
whistleblowing.
This means that whistleblowers will not be able to report violations such as, among others, mobbing, discrimination, harassment, or failure to comply with health and safety obligations.
This is because, as the business side has pointed out from the beginning, this area is protected by other legislation, and the body investigating violations of the law in this area is the State Labour Inspectorate.
| Authors: | |
| laywer Emilia Mierzejewska | |
| junior lawyer Zuzanna Ciesiołkiewicz |
O autorach
Zadaj pytanie autorowi
O autorach
Kontakt dla mediów
