The internal reporting procedure step by step

Step 1. Decide who in the organisation is responsible for the channel

The Polish Act of 14 June 2024 on the Protection of Whistleblowers (Journal of Laws 2024, item 928) requires two roles to be designated, which may, but need not, be held by the same persons (Article 25(1)(1) and (3)):

• the internal organisational unit or person authorised to receive reports, that is, whoever the report physically reaches;
• the impartial unit or person authorised to take follow-up actions, including verifying the report and further communication with the whistleblower.

The word "impartial" has consequences. The person conducting the proceedings cannot be the person the report concerns, nor their subordinate. In a small company this usually means designating two people from different divisions, or entrusting the receipt of reports to an external entity, for example a law firm, which the Act permits (Article 28(1)). The agreement with such an entity must define responsibility for maintaining confidentiality and for meeting deadlines.

Persons receiving reports and conducting follow-up actions must hold a written authorisation to process personal data and be bound to secrecy (Article 8(6)). This is not a formality: the authorisation is the first document an inspection asks for, and the first whose absence will surface in a dispute with a whistleblower.

Step 2. Decide on the scope and on anonymous reports

Two decisions belong solely to the legal entity, and the procedure must record them explicitly:

1. Whether the procedure covers only breaches from the statutory list, or also internal regulations and ethical standards (Article 3(2)). Extending it is the standard, because without it the channel rejects most of the real reports employees make (mobbing, conflicts of interest, breaches of the code of ethics).
2. Whether the entity accepts anonymous reports (Article 25(2)(1)). The Act does not require them to be accepted, but if the procedure does not provide for them, an anonymous report does not trigger the statutory deadlines. The arguments for and against are discussed in a separate article on anonymous reports.

Step 3. Describe the ways of submitting reports

The procedure must define the ways in which the whistleblower can submit reports (Article 25(1)(2)), and the Act requires that a report can be made orally or in writing (Article 26(1)). An oral report may be made by telephone or through other voice communication systems, and at the whistleblower's request also at a face-to-face meeting arranged within 14 days of receiving the request (Article 26(2) and (4)). An oral report must be documented: by a recording made with the whistleblower's consent, or by a written record which the whistleblower may check, correct and approve by signature (Article 26(3)).

An electronic channel does not relieve you of handling the oral route. It does relieve you of keeping the register manually and counting deadlines by hand, provided that oral reports and meetings are also recorded in it. How to organise the channels so that they are genuinely accessible to people without a computer is described in the article on reporting channels.

Step 4. Record the deadlines and the follow-up procedure

The mandatory elements of the procedure under Article 25(1) further include:

• the obligation to acknowledge receipt of a report within 7 days of receiving it, unless the whistleblower has not provided a contact address (point 4);
• the obligation for the designated unit or person to take follow-up actions with due diligence (point 5);
• the maximum time limit for providing feedback, not exceeding 3 months from the acknowledgement of receipt, or, if no acknowledgement was sent, 3 months from the expiry of 7 days after the report (point 6);
• clear information on external reports to the Commissioner for Human Rights (RPO) or public authorities and, where applicable, to Union institutions (point 7).

The procedure may additionally define risk factors for particular areas of activity, a system of incentives to use the internal channel, and the rules for informing the person the report concerns (Article 25(2)). How the deadlines run and the consequences of exceeding them are described in a separate article.

Step 5. Consult the draft

This is the step companies skip most often, and skipping it means the procedure was established in breach of the Act. The legal entity establishes the procedure after consultation with the company trade union organisation or, if there is none, with representatives of persons performing work selected in the manner adopted at the employer (Article 24(3)). The consultation lasts no less than 5 days and no more than 10 days from the day the draft is presented (Article 24(4)).

Consultation does not mean agreement: the employer does not need consent, but must allow time for an opinion and be able to show that the draft was presented. The date the draft was handed over and the date the consultation ended should be documented, because the validity of the procedure depends on them.

Step 6. Announce the procedure and count 7 days

The procedure enters into force 7 days after the day it is made known to persons performing work, in the manner adopted at the entity (Article 24(5) and (6)). In practice this means publishing it on the intranet, sending it by e-mail or posting it in a generally accessible place, while retaining proof of the date. Many organisations ask for confirmation that it has been read, which is not required but makes a defence in a dispute much easier.

A separate obligation concerns job candidates: the legal entity provides information about the procedure to a person applying for work when recruitment or pre-contract negotiations begin (Article 24(7)). A link to the procedure in the job advertisement or in the first message to the candidate settles the matter.

Step 7. Start the register

From the day the procedure enters into force, the entity keeps a register of internal reports and is the data controller for the data collected in it (Article 29). The register contains the report number, the subject of the breach, the personal data of the whistleblower and of the person the report concerns necessary to identify them, the whistleblower's contact address, the date of the report, information on the follow-up actions taken and the date the case was closed. The data are retained for 3 years after the end of the calendar year in which the follow-up actions, or the proceedings initiated by those actions, were completed.

The register can be kept in a spreadsheet. The problem is that a spreadsheet will not acknowledge receipt within 7 days, will not remind you of the third month and will not prove who read the report and when. That is why in practice the register is a system, and the spreadsheet is at most an export from it.

Checklist before announcement

How this looks in sygnadesk

The setup wizard walks through the same points: the persons receiving and handling reports, the scope of categories, the decision on anonymity, the channels. Templates for the procedure, the privacy notice and the authorisations can be adapted in the admin panel, and the employee register with confirmation of having read the procedure closes step 6. The register of reports, the deadlines and the audit log work from the first report, with no spreadsheet on the side.