Statutory deadlines: 7 days, 3 months and a register kept for 3 years
The Act does not say how quickly a case must be resolved. It says when the whistleblower must be answered. Three deadlines decide whether the channel operates lawfully, and all three run regardless of whether anyone in the organisation remembers them.
In this article 8
Three deadlines that run from the report
| Deadline | How long | From when | Basis |
|---|---|---|---|
| Acknowledgement of receipt of the report | 7 days | from the day the report is received | Article 25(1)(4) |
| Feedback | up to 3 months | from the acknowledgement of receipt; without acknowledgement: from the expiry of 7 days after the report | Article 25(1)(6) |
| Meeting at the whistleblower's request | 14 days | from receipt of the request for a face-to-face meeting | Article 26(4) |
On top of these there is one period that runs after the case is closed: 3 years of data retention in the register, counted from the end of the calendar year in which the follow-up actions, or the proceedings initiated by those actions, were completed (Article 29(5)).
7 days for acknowledgement
The legal entity acknowledges receipt of the report to the whistleblower within 7 days of receiving it, unless the whistleblower has not provided a contact address to which the acknowledgement should be sent. This is "7 days", not "7 working days": a report submitted on a Friday evening before a long weekend must be acknowledged by the following Friday.
The acknowledgement is not a substantive reply. A message that the report has arrived, who is handling it and by when the whistleblower can expect feedback is enough. What matters is being able to prove the date it was sent. An e-mail sent from a board member's personal mailbox is evidence only for as long as that mailbox exists.
In anonymous reports with no contact address there is no one to send the acknowledgement to. If, however, the channel gives the whistleblower a case number and an access code, the acknowledgement can be placed in the case and the whistleblower collects it by returning to the page. From the point of view of the Polish Act of 14 June 2024 on the Protection of Whistleblowers (Journal of Laws 2024, item 928), this is a "contact address" that does not need to be tied to an identity.
3 months for feedback
Feedback means informing the whistleblower of the follow-up actions planned or taken and of the reasons for them. The maximum time limit is 3 months from the acknowledgement of receipt of the report, or, if no acknowledgement was sent, 3 months from the expiry of 7 days after the report was made. In other words: the absence of an acknowledgement does not extend the deadline, it only changes how it is counted.
Two traps:
- The deadline does not close the case. An investigation may take longer than 3 months. The Act requires that within that time the whistleblower is told what has been done and why, even if the message reads "the proceedings are ongoing, an external audit has been commissioned, next update by the end of the quarter". Silence after 3 months is a breach; extending the proceedings is not.
- The deadline runs from the acknowledgement, so a quick acknowledgement shortens the time to respond. An organisation that acknowledges on the day of the report has 3 months from that day. One that waits until the seventh day gains a week. It is not worth exploiting this, but it is worth knowing that the two deadlines are linked.
14 days for a meeting
If the whistleblower wishes to make a report orally at a face-to-face meeting, the entity arranges it within 14 days of receiving the request. A written record of the meeting is drawn up or, with the whistleblower's consent, a recording is made; the whistleblower has the right to check and correct the record and approve it by signature. This deadline is often left out of procedures, and breaching it is just as measurable as exceeding the 7 days.
14 days for deleting excess data
Personal data that are irrelevant to handling the report are not collected, and if collected accidentally they must be deleted without delay, no later than 14 days from the moment it is established that they are irrelevant to the case (Article 8(4)). A report in which the whistleblower names five bystanders therefore requires a decision and an entry in the register within two weeks. Without a system that forces such an entry, no one watches this deadline.
3 years in the register
The register of internal reports retains data for 3 years after the end of the calendar year in which the follow-up actions, or the proceedings initiated by those actions, were completed. A case closed in March 2026 leaves the register after 31 December 2029. A case that ended in court proceedings concluded in 2028 remains until the end of 2031.
Two practical conclusions: retention is counted per case, not globally, and it is not "automatic". Deleting too early deprives the organisation of evidence in a dispute with the whistleblower or with the person the report concerned; deleting too late breaches the GDPR storage limitation principle. A sensible mechanism is a reminder that the period has expired and a deletion confirmed by a human, with a log entry recording who deleted it and when.
What happens when a deadline is missed
Missing the deadlines is not directly penalised by a separate criminal provision, but it has three real consequences:
- a procedure "established in breach of the Act": the absence of recorded deadlines, or their systematic non-observance, may be assessed as a failure to fulfil the obligation to establish a procedure, for which the Act provides a fine (Article 58);
- opening the external route: a whistleblower who has not received feedback in time has every right to report the matter to the Commissioner for Human Rights (RPO) or a public authority and, in specified cases, to disclose it publicly while retaining protection (Article 51);
- evidence in a dispute: in proceedings for compensation for retaliation, it is the employer who must prove that its action was not retaliatory. A register showing that a report sat unacknowledged for a month does not help.
How sygnadesk counts them
The system records the date and time the report arrived and counts the 7 days for acknowledgement from that moment. The acknowledgement can be sent from a template or placed in the case accessible via case number and PIN if the report is anonymous. The 3 months are counted from the date of acknowledgement, with reminders for the case handlers and escalation to the supervising person as the deadline approaches. A case cannot be closed without recorded feedback, and every date entry is kept in an immutable audit log. The system counts retention per case and reminds you when it expires; deletion requires confirmation and remains in the log.
This text is for information only and describes the legal position on the stated date. It does not replace legal advice in a specific case.
Related articles
- The Polish Whistleblower Protection Act: who it applies to and from when 50-person threshold on 1 January and 1 July, sectors with no threshold, small-municipality exemptions, who is a whistleblower and what the Act covers.
- The internal reporting procedure step by step What the internal reporting procedure must contain under Article 25, how to consult it in 5 to 10 days, when it takes effect and how to announce it.
- Anonymous reports: do you have to accept them and how to do it safely The Act permits but does not require anonymous reports. What each choice means, how to protect identity when given, and anonymity versus confidentiality.
A procedure is a document. A channel is the system that carries it out.
sygnadesk counts the deadlines, keeps the register and protects the reporter’s identity the way the knowledge base describes. See how it would look in your organisation.