Knowledge base

The Polish Whistleblower Protection Act in practice

Thresholds, deadlines, the register, anonymity, retaliation, GDPR and penalties. Eight texts written for the people who have to implement the procedure and answer for it in an audit, not for search engines.

  1. The Polish Whistleblower Protection Act: who it applies to and from when

    50-person threshold on 1 January and 1 July, sectors with no threshold, small-municipality exemptions, who is a whistleblower and what the Act covers.

    7 min read · Legal status as of 2026-08-29

  2. The internal reporting procedure step by step

    What the internal reporting procedure must contain under Article 25, how to consult it in 5 to 10 days, when it takes effect and how to announce it.

    7 min read · Legal status as of 2026-08-29

  3. Statutory deadlines: 7 days, 3 months and a register kept for 3 years

    When the 7 days for acknowledgement and 3 months for feedback start, what if the whistleblower gives no address, 14 days for a meeting, 3-year retention.

    6 min read · Legal status as of 2026-08-29

  4. Anonymous reports: do you have to accept them and how to do it safely

    The Act permits but does not require anonymous reports. What each choice means, how to protect identity when given, and anonymity versus confidentiality.

    5 min read · Legal status as of 2026-08-29

  5. Reporting channels: written, oral, in a meeting and for people without a computer

    The Act requires written and oral reporting, including by phone and a meeting within 14 days. How to organise it for drivers, factory staff and outsiders.

    5 min read · Legal status as of 2026-08-29

  6. Retaliation and whistleblower protection: what an employer must not do

    The Act's list of retaliatory actions, protection conditions, reversed burden of proof, compensation of at least the average wage, facilitator protection.

    6 min read · Legal status as of 2026-08-29

  7. GDPR in whistleblower reports: controller, processor, retention

    Who controls report data, when the vendor is a processor, what the processing agreement must cover, retention and the rights of the person concerned.

    6 min read · Legal status as of 2026-08-29

  8. Penalties for not having an internal reporting procedure and for retaliation

    Fine for a missing or defective procedure, up to 3 years for obstruction and retaliation, a year for breaching confidentiality. Who is personally liable.

    5 min read · Legal status as of 2026-08-29

See all scenarios